Edit tour

Windows Analysis Report
LisectAVT_2403002A_133.exe

Overview

General Information

Sample name:	LisectAVT_2403002A_133.exe
Analysis ID:	1482509
MD5:	56808e1595200230cae4ae17b5dbb869
SHA1:	ce0935fefed25268069331ba6277b4d14c385e28
SHA256:	1a38e29dff73f042b8abb0ed1398a37eefa8fe3f6030e27a9a22b8964263b146
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Sigma detected: Scheduled temp file as task from temp location

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

LisectAVT_2403002A_133.exe (PID: 1088 cmdline: "C:\Users\user\Desktop\LisectAVT_2403002A_133.exe" MD5: 56808E1595200230CAE4AE17B5DBB869)

powershell.exe (PID: 1424 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_133.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7544 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

powershell.exe (PID: 1792 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 3868 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GlIToApjgGEL" /XML "C:\Users\user\AppData\Local\Temp\tmpCD6C.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

LisectAVT_2403002A_133.exe (PID: 7320 cmdline: "C:\Users\user\Desktop\LisectAVT_2403002A_133.exe" MD5: 56808E1595200230CAE4AE17B5DBB869)

GlIToApjgGEL.exe (PID: 7472 cmdline: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe MD5: 56808E1595200230CAE4AE17B5DBB869)

schtasks.exe (PID: 7676 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GlIToApjgGEL" /XML "C:\Users\user\AppData\Local\Temp\tmpE6EF.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7684 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

GlIToApjgGEL.exe (PID: 7728 cmdline: "C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe" MD5: 56808E1595200230CAE4AE17B5DBB869)

GlIToApjgGEL.exe (PID: 7736 cmdline: "C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe" MD5: 56808E1595200230CAE4AE17B5DBB869)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.kabeercommodities.com", "Username": "export@kabeercommodities.com", "Password": "w{A6H.o&sz%g"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000018.00000002.2528847260.000000000307C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000012.00000002.2527987214.00000000031AC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000012.00000002.2527987214.0000000003181000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000012.00000002.2527987214.0000000003181000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000018.00000002.2528847260.0000000003051000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000002.2528847260.0000000003051000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.1344574120.0000000004921000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.1344574120.0000000004921000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000018.00000002.2522255682.0000000000415000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000002.2522255682.0000000000415000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.1344574120.0000000004000000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.1344574120.0000000004000000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000013.00000002.1403560028.0000000003AE1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000002.1403560028.0000000003AE1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: LisectAVT_2403002A_133.exe PID: 1088	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: LisectAVT_2403002A_133.exe PID: 1088	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: LisectAVT_2403002A_133.exe PID: 7320	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: LisectAVT_2403002A_133.exe PID: 7320	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: GlIToApjgGEL.exe PID: 7472	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: GlIToApjgGEL.exe PID: 7472	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: GlIToApjgGEL.exe PID: 7472	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: GlIToApjgGEL.exe PID: 7736	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: GlIToApjgGEL.exe PID: 7736	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
19.2.GlIToApjgGEL.exe.3ae17c0.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
19.2.GlIToApjgGEL.exe.3ae17c0.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
19.2.GlIToApjgGEL.exe.3ae17c0.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3174f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x317c1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3184b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x318dd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31947:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x319b9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31a4f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31adf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
4.2.LisectAVT_2403002A_133.exe.403afe8.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.LisectAVT_2403002A_133.exe.403afe8.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.LisectAVT_2403002A_133.exe.403afe8.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3174f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x317c1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3184b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x318dd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31947:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x319b9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31a4f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31adf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
19.2.GlIToApjgGEL.exe.3b1c1e0.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
19.2.GlIToApjgGEL.exe.3b1c1e0.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
19.2.GlIToApjgGEL.exe.3b1c1e0.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3354f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x335c1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3364b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x336dd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33747:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x337b9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3384f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x338df:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
19.2.GlIToApjgGEL.exe.3b1c1e0.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
19.2.GlIToApjgGEL.exe.3b1c1e0.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
19.2.GlIToApjgGEL.exe.3b1c1e0.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3174f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x317c1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3184b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x318dd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31947:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x319b9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31a4f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31adf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
4.2.LisectAVT_2403002A_133.exe.40005c8.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.LisectAVT_2403002A_133.exe.40005c8.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.LisectAVT_2403002A_133.exe.40005c8.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3174f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x317c1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3184b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x318dd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31947:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x319b9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31a4f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31adf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
19.2.GlIToApjgGEL.exe.3ae17c0.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
19.2.GlIToApjgGEL.exe.3ae17c0.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
19.2.GlIToApjgGEL.exe.3ae17c0.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3354f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6df6f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x335c1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dfe1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3364b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6e06b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x336dd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e0fd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33747:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e167:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x337b9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e1d9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3384f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e26f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x338df:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e2ff:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
4.2.LisectAVT_2403002A_133.exe.403afe8.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.LisectAVT_2403002A_133.exe.403afe8.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.LisectAVT_2403002A_133.exe.403afe8.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.LisectAVT_2403002A_133.exe.403afe8.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3354f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x335c1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3364b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x336dd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33747:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x337b9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3384f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x338df:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
4.2.LisectAVT_2403002A_133.exe.40005c8.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.LisectAVT_2403002A_133.exe.40005c8.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.LisectAVT_2403002A_133.exe.40005c8.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.LisectAVT_2403002A_133.exe.40005c8.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3354f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6df6f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x335c1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dfe1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3364b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6e06b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x336dd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e0fd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33747:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e167:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x337b9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e1d9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3384f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e26f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x338df:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e2ff:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 21 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_133.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_133.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\LisectAVT_2403002A_133.exe", ParentImage: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe, ParentProcessId: 1088, ParentProcessName: LisectAVT_2403002A_133.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_133.exe", ProcessId: 1424, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GlIToApjgGEL" /XML "C:\Users\user\AppData\Local\Temp\tmpE6EF.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GlIToApjgGEL" /XML "C:\Users\user\AppData\Local\Temp\tmpE6EF.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe, ParentImage: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe, ParentProcessId: 7472, ParentProcessName: GlIToApjgGEL.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GlIToApjgGEL" /XML "C:\Users\user\AppData\Local\Temp\tmpE6EF.tmp", ProcessId: 7676, ProcessName: schtasks.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 45.91.139.1, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe, Initiated: true, ProcessId: 7320, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GlIToApjgGEL" /XML "C:\Users\user\AppData\Local\Temp\tmpCD6C.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GlIToApjgGEL" /XML "C:\Users\user\AppData\Local\Temp\tmpCD6C.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\LisectAVT_2403002A_133.exe", ParentImage: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe, ParentProcessId: 1088, ParentProcessName: LisectAVT_2403002A_133.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GlIToApjgGEL" /XML "C:\Users\user\AppData\Local\Temp\tmpCD6C.tmp", ProcessId: 3868, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_133.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_133.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\LisectAVT_2403002A_133.exe", ParentImage: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe, ParentProcessId: 1088, ParentProcessName: LisectAVT_2403002A_133.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_133.exe", ProcessId: 1424, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GlIToApjgGEL" /XML "C:\Users\user\AppData\Local\Temp\tmpCD6C.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GlIToApjgGEL" /XML "C:\Users\user\AppData\Local\Temp\tmpCD6C.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\LisectAVT_2403002A_133.exe", ParentImage: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe, ParentProcessId: 1088, ParentProcessName: LisectAVT_2403002A_133.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GlIToApjgGEL" /XML "C:\Users\user\AppData\Local\Temp\tmpCD6C.tmp", ProcessId: 3868, ProcessName: schtasks.exe

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 13.85.23.86 - Destination IP: 192.168.2.7

Timestamp:	2024-07-25T23:58:21.889521+0200
SID:	2022930
Source Port:	443
Destination Port:	49709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 13.85.23.86 - Destination IP: 192.168.2.7

Timestamp:	2024-07-25T23:59:00.566677+0200
SID:	2022930
Source Port:	443
Destination Port:	49714
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: LisectAVT_2403002A_133.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe

Avira: detection malicious, Label: HEUR/AGEN.1323752

Found malware configuration

Source: 4.2.LisectAVT_2403002A_133.exe.40005c8.2.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.kabeercommodities.com", "Username": "export@kabeercommodities.com", "Password": "w{A6H.o&sz%g"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: LisectAVT_2403002A_133.exe

Joe Sandbox ML: detected

Source: LisectAVT_2403002A_133.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.7:49707 version: TLS 1.2

Source: LisectAVT_2403002A_133.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 4x nop then jmp 02A572EFh		4_2_02A5696C
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 4x nop then jmp 02716507h		19_2_02715B84

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 4.2.LisectAVT_2403002A_133.exe.403afe8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.LisectAVT_2403002A_133.exe.40005c8.2.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.7:49706 -> 45.91.139.1:587

Source: Joe Sandbox View	IP Address: 45.91.139.1 45.91.139.1
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

ASN Name: MEER-ASmeerfarbigGmbHCoKGDE MEER-ASmeerfarbigGmbHCoKGDE

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.7:49706 -> 45.91.139.1:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: mail.kabeercommodities.com

Source: LisectAVT_2403002A_133.exe, 00000012.00000002.2539654353.0000000006927000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micros;
Source: LisectAVT_2403002A_133.exe, 00000012.00000002.2527987214.00000000031AC000.00000004.00000800.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2528847260.000000000307C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://kabeercommodities.com
Source: LisectAVT_2403002A_133.exe, 00000012.00000002.2527987214.00000000031AC000.00000004.00000800.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2528847260.000000000307C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.kabeercommodities.com
Source: LisectAVT_2403002A_133.exe, 00000012.00000002.2526645083.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_133.exe, 00000012.00000002.2526645083.0000000001676000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_133.exe, 00000012.00000002.2527987214.00000000031B4000.00000004.00000800.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2526896258.0000000001249000.00000004.00000020.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2528847260.0000000003084000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r10.i.lencr.org/09
Source: LisectAVT_2403002A_133.exe, 00000012.00000002.2526645083.0000000001676000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_133.exe, 00000012.00000002.2527987214.00000000031B4000.00000004.00000800.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2526896258.0000000001249000.00000004.00000020.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2528847260.0000000003084000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r10.o.lencr.org0#
Source: LisectAVT_2403002A_133.exe, 00000004.00000002.1343518581.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_133.exe, 00000012.00000002.2527987214.0000000003131000.00000004.00000800.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000013.00000002.1402251524.0000000002810000.00000004.00000800.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2528847260.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: LisectAVT_2403002A_133.exe, 00000012.00000002.2526645083.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_133.exe, 00000012.00000002.2527987214.00000000031B4000.00000004.00000800.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2526896258.0000000001214000.00000004.00000020.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2528847260.0000000003084000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: LisectAVT_2403002A_133.exe, 00000012.00000002.2526645083.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_133.exe, 00000012.00000002.2527987214.00000000031B4000.00000004.00000800.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2526896258.0000000001214000.00000004.00000020.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2539536816.00000000063CB000.00000004.00000020.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2528847260.0000000003084000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: LisectAVT_2403002A_133.exe, 00000004.00000002.1344574120.0000000004000000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_133.exe, 00000004.00000002.1344574120.0000000004921000.00000004.00000800.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000013.00000002.1403560028.0000000003AE1000.00000004.00000800.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2522255682.0000000000415000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: LisectAVT_2403002A_133.exe, 00000004.00000002.1344574120.0000000004000000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_133.exe, 00000004.00000002.1344574120.0000000004921000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_133.exe, 00000012.00000002.2527987214.0000000003131000.00000004.00000800.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000013.00000002.1403560028.0000000003AE1000.00000004.00000800.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2528847260.0000000003001000.00000004.00000800.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2522255682.0000000000415000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: LisectAVT_2403002A_133.exe, 00000012.00000002.2527987214.0000000003131000.00000004.00000800.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2528847260.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: LisectAVT_2403002A_133.exe, 00000012.00000002.2527987214.0000000003131000.00000004.00000800.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2528847260.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.7:49707 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 4.2.LisectAVT_2403002A_133.exe.40005c8.2.raw.unpack, NDL2m67zO.cs	.Net Code: recg
Source: 4.2.LisectAVT_2403002A_133.exe.403afe8.3.raw.unpack, NDL2m67zO.cs	.Net Code: recg

System Summary

Malicious sample detected (through community Yara rule)

Source: 19.2.GlIToApjgGEL.exe.3ae17c0.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.LisectAVT_2403002A_133.exe.403afe8.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 19.2.GlIToApjgGEL.exe.3b1c1e0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 19.2.GlIToApjgGEL.exe.3b1c1e0.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.LisectAVT_2403002A_133.exe.40005c8.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 19.2.GlIToApjgGEL.exe.3ae17c0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.LisectAVT_2403002A_133.exe.403afe8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.LisectAVT_2403002A_133.exe.40005c8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 4_2_00F28940	4_2_00F28940
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 4_2_00F28C52	4_2_00F28C52
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 4_2_00F274C3	4_2_00F274C3
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 4_2_00F289E1	4_2_00F289E1
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 4_2_00F271A0	4_2_00F271A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 4_2_00F2750A	4_2_00F2750A
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 4_2_00F27989	4_2_00F27989
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 4_2_02A528A7	4_2_02A528A7
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 4_2_02A528B8	4_2_02A528B8
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 4_2_02A50830	4_2_02A50830
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 4_2_02A51EF7	4_2_02A51EF7
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 4_2_02A51F08	4_2_02A51F08
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 4_2_02A52CE1	4_2_02A52CE1
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 4_2_02A52CF0	4_2_02A52CF0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 4_2_02A58C18	4_2_02A58C18
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 4_2_02A50C68	4_2_02A50C68
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 4_2_085AB668	4_2_085AB668
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 4_2_085AB658	4_2_085AB658
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 18_2_0159E6A9	18_2_0159E6A9
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 18_2_0159D9C0	18_2_0159D9C0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 18_2_01594A98	18_2_01594A98
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 18_2_01593E80	18_2_01593E80
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 18_2_015941C8	18_2_015941C8
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 18_2_06E465E0	18_2_06E465E0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 18_2_06E45580	18_2_06E45580
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 18_2_06E47D78	18_2_06E47D78
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 18_2_06E4B21F	18_2_06E4B21F
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 18_2_06E43038	18_2_06E43038
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 18_2_06E4C178	18_2_06E4C178
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 18_2_06E47698	18_2_06E47698
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 18_2_06E45CCF	18_2_06E45CCF
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 18_2_06E4059B	18_2_06E4059B
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 18_2_06E4E3A0	18_2_06E4E3A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 18_2_06E42340	18_2_06E42340
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 18_2_06E4001F	18_2_06E4001F
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 19_2_02568940	19_2_02568940
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 19_2_02568C52	19_2_02568C52
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 19_2_025671A0	19_2_025671A0
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 19_2_0256740B	19_2_0256740B
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 19_2_025689E1	19_2_025689E1
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 19_2_025674C3	19_2_025674C3
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 19_2_0256750A	19_2_0256750A
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 19_2_02567989	19_2_02567989
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 19_2_02710830	19_2_02710830
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 19_2_027128B8	19_2_027128B8
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 19_2_027128A7	19_2_027128A7
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 19_2_02711EF7	19_2_02711EF7
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 19_2_02717F20	19_2_02717F20
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 19_2_02711F08	19_2_02711F08
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 19_2_02710C68	19_2_02710C68
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 19_2_02712CF0	19_2_02712CF0
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 19_2_02712CE1	19_2_02712CE1
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 24_2_013EA190	24_2_013EA190
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 24_2_013EE6B8	24_2_013EE6B8
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 24_2_013EA958	24_2_013EA958
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 24_2_013E4A98	24_2_013E4A98
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 24_2_013E3E80	24_2_013E3E80
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 24_2_013E41C8	24_2_013E41C8
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 24_2_06B25580	24_2_06B25580
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 24_2_06B265E0	24_2_06B265E0
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 24_2_06B27D78	24_2_06B27D78
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 24_2_06B2B230	24_2_06B2B230
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 24_2_06B22350	24_2_06B22350
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 24_2_06B2C178	24_2_06B2C178
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 24_2_06B27698	24_2_06B27698
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 24_2_06B25CE0	24_2_06B25CE0
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 24_2_06B2E3A0	24_2_06B2E3A0
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 24_2_06B20006	24_2_06B20006
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 24_2_06B20040	24_2_06B20040
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 24_2_06B20324	24_2_06B20324

Source: LisectAVT_2403002A_133.exe, 00000004.00000002.1339585942.0000000000F6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs LisectAVT_2403002A_133.exe
Source: LisectAVT_2403002A_133.exe, 00000004.00000002.1347383930.0000000008503000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXE.MUIj% vs LisectAVT_2403002A_133.exe
Source: LisectAVT_2403002A_133.exe, 00000004.00000002.1347383930.0000000008503000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename#f vs LisectAVT_2403002A_133.exe
Source: LisectAVT_2403002A_133.exe, 00000004.00000002.1347383930.0000000008503000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamerTnN.exe4 vs LisectAVT_2403002A_133.exe
Source: LisectAVT_2403002A_133.exe, 00000004.00000002.1347383930.00000000084A2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameschtasks.exej% vs LisectAVT_2403002A_133.exe
Source: LisectAVT_2403002A_133.exe, 00000004.00000002.1344574120.0000000004000000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamed820472a-a748-4fee-95a9-5eaffb307398.exe4 vs LisectAVT_2403002A_133.exe
Source: LisectAVT_2403002A_133.exe, 00000004.00000002.1344574120.0000000004000000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs LisectAVT_2403002A_133.exe
Source: LisectAVT_2403002A_133.exe, 00000004.00000000.1270481428.00000000008C8000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamerTnN.exe4 vs LisectAVT_2403002A_133.exe
Source: LisectAVT_2403002A_133.exe, 00000004.00000002.1343518581.0000000002DCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamed820472a-a748-4fee-95a9-5eaffb307398.exe4 vs LisectAVT_2403002A_133.exe
Source: LisectAVT_2403002A_133.exe, 00000004.00000002.1347867209.0000000008740000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs LisectAVT_2403002A_133.exe
Source: LisectAVT_2403002A_133.exe, 00000012.00000002.2523232143.00000000012F8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs LisectAVT_2403002A_133.exe
Source: LisectAVT_2403002A_133.exe	Binary or memory string: OriginalFilenamerTnN.exe4 vs LisectAVT_2403002A_133.exe

Source: LisectAVT_2403002A_133.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 19.2.GlIToApjgGEL.exe.3ae17c0.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.LisectAVT_2403002A_133.exe.403afe8.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 19.2.GlIToApjgGEL.exe.3b1c1e0.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 19.2.GlIToApjgGEL.exe.3b1c1e0.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.LisectAVT_2403002A_133.exe.40005c8.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 19.2.GlIToApjgGEL.exe.3ae17c0.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.LisectAVT_2403002A_133.exe.403afe8.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.LisectAVT_2403002A_133.exe.40005c8.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: LisectAVT_2403002A_133.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: GlIToApjgGEL.exe.4.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 4.2.LisectAVT_2403002A_133.exe.40005c8.2.raw.unpack, OTWUo99bfyR.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.LisectAVT_2403002A_133.exe.40005c8.2.raw.unpack, OTWUo99bfyR.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.LisectAVT_2403002A_133.exe.40005c8.2.raw.unpack, Ui9qhZiA7.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.LisectAVT_2403002A_133.exe.40005c8.2.raw.unpack, Ui9qhZiA7.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.2.LisectAVT_2403002A_133.exe.40005c8.2.raw.unpack, BqMB7yHhrXg.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.LisectAVT_2403002A_133.exe.40005c8.2.raw.unpack, BqMB7yHhrXg.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.LisectAVT_2403002A_133.exe.40005c8.2.raw.unpack, BqMB7yHhrXg.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.LisectAVT_2403002A_133.exe.40005c8.2.raw.unpack, BqMB7yHhrXg.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 4.2.LisectAVT_2403002A_133.exe.40a5ac0.4.raw.unpack, oaIYYEGbjWh1PKKUmq.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 4.2.LisectAVT_2403002A_133.exe.40a5ac0.4.raw.unpack, XSiZdC5Wk4sX5ZXI0h.cs	Security API names: _0020.SetAccessControl
Source: 4.2.LisectAVT_2403002A_133.exe.40a5ac0.4.raw.unpack, XSiZdC5Wk4sX5ZXI0h.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 4.2.LisectAVT_2403002A_133.exe.40a5ac0.4.raw.unpack, XSiZdC5Wk4sX5ZXI0h.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@21/15@2/2

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe

File created: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Mutant created: \Sessions\1\BaseNamedObjects\eQQweYsDUhlpl
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6596:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2172:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7684:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6912:120:WilError_03

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe

File created: C:\Users\user\AppData\Local\Temp\tmpCD6C.tmp

Jump to behavior

Source: LisectAVT_2403002A_133.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: LisectAVT_2403002A_133.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe

File read: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe "C:\Users\user\Desktop\LisectAVT_2403002A_133.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_133.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GlIToApjgGEL" /XML "C:\Users\user\AppData\Local\Temp\tmpCD6C.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process created: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe "C:\Users\user\Desktop\LisectAVT_2403002A_133.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GlIToApjgGEL" /XML "C:\Users\user\AppData\Local\Temp\tmpE6EF.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process created: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe "C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe"
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process created: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe "C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_133.exe"	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe"	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GlIToApjgGEL" /XML "C:\Users\user\AppData\Local\Temp\tmpCD6C.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process created: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe "C:\Users\user\Desktop\LisectAVT_2403002A_133.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GlIToApjgGEL" /XML "C:\Users\user\AppData\Local\Temp\tmpE6EF.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process created: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe "C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process created: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe "C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe"	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Section loaded: wintypes.dll

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: LisectAVT_2403002A_133.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: LisectAVT_2403002A_133.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 4.2.LisectAVT_2403002A_133.exe.2cf4a18.1.raw.unpack, wehuuoKhMKMbnQu72K.cs	.Net Code: LOPk5OGwQvvejRfJl7n System.Reflection.Assembly.Load(byte[])
Source: 4.2.LisectAVT_2403002A_133.exe.6de0000.5.raw.unpack, wehuuoKhMKMbnQu72K.cs	.Net Code: LOPk5OGwQvvejRfJl7n System.Reflection.Assembly.Load(byte[])
Source: 4.2.LisectAVT_2403002A_133.exe.40a5ac0.4.raw.unpack, XSiZdC5Wk4sX5ZXI0h.cs	.Net Code: QycL3A5n98 System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 4_2_00F2EA88 push eax; iretd	4_2_00F2EA89
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 18_2_0159A1DB pushfd ; retf 0565h	18_2_0159A6B1
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 18_2_01590C45 push ebx; retf	18_2_01590C52
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Code function: 18_2_01590C6D push edi; retf	18_2_01590C7A
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 19_2_0256EA88 push eax; iretd	19_2_0256EA89
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 19_2_025697B0 push 14027692h; iretd	19_2_0256987D
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 19_2_02714821 push esi; retf	19_2_02714822
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 24_2_013E0C6D push edi; retf	24_2_013E0C7A
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 24_2_013E0C53 push ebx; retf	24_2_013E0C52
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Code function: 24_2_013E0C45 push ebx; retf	24_2_013E0C52

Source: LisectAVT_2403002A_133.exe	Static PE information: section name: .text entropy: 7.956613403047499
Source: GlIToApjgGEL.exe.4.dr	Static PE information: section name: .text entropy: 7.956613403047499

Source: 4.2.LisectAVT_2403002A_133.exe.2cf4a18.1.raw.unpack, kdFvaMFVPKs73pA7Ae.cs	High entropy of concatenated method names: 'jlLbsIppcp4pe', 'HUDVafGQx3A5lYPXEbC', 'bWxlDPGFKtjOUjq8ME9', 'J13JY7Gs9VegMR0Usdn', 'gjnvHYGCPTFBSN5sXDA', 'UXn9pRGVr5JYGFjuCRJ', 'g8bQ3yGYPoLwrRusK3E', 'KwwAwLG5jtFVjgr5V0l', 'lJyLiGG0wAjthymuVo5', 'KrHGd2G9wj507LdZGDe'
Source: 4.2.LisectAVT_2403002A_133.exe.2cf4a18.1.raw.unpack, DD.cs	High entropy of concatenated method names: 'wgRxinKHcbWANUbFNm', 'dwveif1E9jqp4XTbTA', 'iYTXHL2SDoNZBJVsGw', 'hFySdn3keDBvJSvKal', 'PVIytPpWpuEYQLk40u'
Source: 4.2.LisectAVT_2403002A_133.exe.2cf4a18.1.raw.unpack, ihWImL1h2qjtIkVYDh.cs	High entropy of concatenated method names: 'qJUttacKFT', 'djwp7oGHZ8xfNf3m5ut', 'AZqALCG67UykKuowXP2', 'dkLCJpGlCfFdqtD7Epf', 'iHWSkAGjDuGN31hXJsT', 'u4UYnDGE5xCOMnt15QR', 'jhES7Va4c', 'jWmROKkjL', 'Dispose', 'BJj7gBhfp'
Source: 4.2.LisectAVT_2403002A_133.exe.2cf4a18.1.raw.unpack, oImfMJtvGUo8fMQNBQ.cs	High entropy of concatenated method names: 'cxsORewNJ', 'VvrninWuk', 'ustvIxt9o', 'QtXoY7g0N', 'cMKlMbnQu', 'w2KLAB5Xx', 'hNkF6TG2YCh7xU8s3hJ', 'hs4l1PGKtLhAeRnm1c4', 'Dispose', 'MoveNext'
Source: 4.2.LisectAVT_2403002A_133.exe.2cf4a18.1.raw.unpack, wehuuoKhMKMbnQu72K.cs	High entropy of concatenated method names: 'NXMyxc8eI', 'GTZadPHeP', 'DEVNaDCj9', 'cflmBNqev', 'VFQ0OImLC', 'PbYVMxZvt', 'UPdFjbLed', 'AeEi93ui9', 'oM66buTLn', 'nxFUIfcfn'
Source: 4.2.LisectAVT_2403002A_133.exe.6de0000.5.raw.unpack, kdFvaMFVPKs73pA7Ae.cs	High entropy of concatenated method names: 'jlLbsIppcp4pe', 'HUDVafGQx3A5lYPXEbC', 'bWxlDPGFKtjOUjq8ME9', 'J13JY7Gs9VegMR0Usdn', 'gjnvHYGCPTFBSN5sXDA', 'UXn9pRGVr5JYGFjuCRJ', 'g8bQ3yGYPoLwrRusK3E', 'KwwAwLG5jtFVjgr5V0l', 'lJyLiGG0wAjthymuVo5', 'KrHGd2G9wj507LdZGDe'
Source: 4.2.LisectAVT_2403002A_133.exe.6de0000.5.raw.unpack, DD.cs	High entropy of concatenated method names: 'wgRxinKHcbWANUbFNm', 'dwveif1E9jqp4XTbTA', 'iYTXHL2SDoNZBJVsGw', 'hFySdn3keDBvJSvKal', 'PVIytPpWpuEYQLk40u'
Source: 4.2.LisectAVT_2403002A_133.exe.6de0000.5.raw.unpack, ihWImL1h2qjtIkVYDh.cs	High entropy of concatenated method names: 'qJUttacKFT', 'djwp7oGHZ8xfNf3m5ut', 'AZqALCG67UykKuowXP2', 'dkLCJpGlCfFdqtD7Epf', 'iHWSkAGjDuGN31hXJsT', 'u4UYnDGE5xCOMnt15QR', 'jhES7Va4c', 'jWmROKkjL', 'Dispose', 'BJj7gBhfp'
Source: 4.2.LisectAVT_2403002A_133.exe.6de0000.5.raw.unpack, oImfMJtvGUo8fMQNBQ.cs	High entropy of concatenated method names: 'cxsORewNJ', 'VvrninWuk', 'ustvIxt9o', 'QtXoY7g0N', 'cMKlMbnQu', 'w2KLAB5Xx', 'hNkF6TG2YCh7xU8s3hJ', 'hs4l1PGKtLhAeRnm1c4', 'Dispose', 'MoveNext'
Source: 4.2.LisectAVT_2403002A_133.exe.6de0000.5.raw.unpack, wehuuoKhMKMbnQu72K.cs	High entropy of concatenated method names: 'NXMyxc8eI', 'GTZadPHeP', 'DEVNaDCj9', 'cflmBNqev', 'VFQ0OImLC', 'PbYVMxZvt', 'UPdFjbLed', 'AeEi93ui9', 'oM66buTLn', 'nxFUIfcfn'
Source: 4.2.LisectAVT_2403002A_133.exe.40a5ac0.4.raw.unpack, Q0vpVvSH5GMpEnUVq3.cs	High entropy of concatenated method names: 'W8jKiuJ7LD', 'Fq2KybPnnI', 'yyZKprXC5j', 'J0eKYNvEee', 'dxlKcbcXSV', 'gUAKA5c97D', 'b91K5bQsn2', 'iHMKDgc52x', 'caDK0Eaq4t', 'XDTKkUKhZ3'
Source: 4.2.LisectAVT_2403002A_133.exe.40a5ac0.4.raw.unpack, d7eZWkjobMx1kktcNq.cs	High entropy of concatenated method names: 'twycWJ3oQk', 'AAJcyGu958', 'fG2cYeUEHI', 'wVkcAQBTiv', 'NLWc5NdjpT', 'gk5Ym4VkB6', 'RMTYeqbVsI', 'isPY4Ki7VD', 'dyXYShLbob', 'kZIYTYBwnp'
Source: 4.2.LisectAVT_2403002A_133.exe.40a5ac0.4.raw.unpack, l1ZjH3FqBk7m3jAhOp.cs	High entropy of concatenated method names: 'sN3trtrr6q', 'qIKtNenhld', 'rOptLebBA0', 'oZOtiLPsD9', 'SMxtysfFmr', 'S3StYPpOFk', 'qihtc96oQ8', 'zUHK4fuet9', 't7EKSHgFAd', 'LOQKTa5cGy'
Source: 4.2.LisectAVT_2403002A_133.exe.40a5ac0.4.raw.unpack, UABv9PrxcswaCKu77d9.cs	High entropy of concatenated method names: 'VCktZUcDgy', 'XxZtChhtHs', 'biEt3DpJul', 'koCtHwVaSl', 'AvdtEwZxfD', 'Ki8tvnmSis', 'o2AtbBSmtI', 'pDDtG4GKAK', 'n1atP5e10W', 'umutaqNo32'
Source: 4.2.LisectAVT_2403002A_133.exe.40a5ac0.4.raw.unpack, WLQyxlrNPWgvdrMdKHe.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'yN9sR2g6ZQ', 'LrRsuXPuIy', 'QdusJJe3oI', 'fkCs9ETYNZ', 'hrmsmtANhw', 'fQKse3ySm2', 'hxos4XaZib'
Source: 4.2.LisectAVT_2403002A_133.exe.40a5ac0.4.raw.unpack, p681EQzv8P3Gf2coDi.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'hUttwT2Wyj', 'AbBt8P46Xn', 'C6ut2rmo9I', 'zgWtOLaa1g', 'kDvtKBKvEh', 'qpSttVFynO', 'xDLtso2ADM'
Source: 4.2.LisectAVT_2403002A_133.exe.40a5ac0.4.raw.unpack, oaIYYEGbjWh1PKKUmq.cs	High entropy of concatenated method names: 'HBAyRmM8LY', 'wUVyuuSoPX', 'O3TyJ3i7nB', 'Lmny99S1yI', 'uyEymgt9Vu', 'QXKye9nSnc', 'nqUy4v21Bp', 'gufySu0yY8', 'y79yTxX1kh', 'UE3yFOwn82'
Source: 4.2.LisectAVT_2403002A_133.exe.40a5ac0.4.raw.unpack, VVbDJ6g1mjpxbiLeaT.cs	High entropy of concatenated method names: 'ysD3DTRk7', 'hUZHDB3PG', 'h9pvn1QkC', 'l45bclgr4', 'K3QPvLjJR', 'IPla6lFJh', 'zofZPBp8GNxAx3hw8P', 'i9d3Rvfc3tFMoGmyon', 'ugUKk43IB', 'avWsWpUdG'
Source: 4.2.LisectAVT_2403002A_133.exe.40a5ac0.4.raw.unpack, hF761QeXojqrtkst5L.cs	High entropy of concatenated method names: 'N4dOS7gQyy', 'affOFeHot3', 'BWiKxW4xB7', 'najKrpEQue', 'y2SOq1Uya7', 'r7lOBwNXlx', 'cxOOVemW8x', 'PAjORTSLBR', 'vdIOuYM5sy', 'rm0OJWpEYB'
Source: 4.2.LisectAVT_2403002A_133.exe.40a5ac0.4.raw.unpack, SEVygsUpenY03rhyRN.cs	High entropy of concatenated method names: 'SksAZILZBx', 'rbcAC5YIFx', 'omwA3s3EAh', 'TgPAHovWkW', 'AOBAEWIHkP', 'nGdAvHF9PJ', 'cTPAb8hcdd', 'WQRAGrdVIP', 'sBLAPn5vqv', 'QklAagQUFR'
Source: 4.2.LisectAVT_2403002A_133.exe.40a5ac0.4.raw.unpack, XSiZdC5Wk4sX5ZXI0h.cs	High entropy of concatenated method names: 'NLONWQeTVU', 'OhYNiXIEhM', 'VbSNy5nlVf', 'iGYNpmGC6P', 'h6bNYJldjS', 'N5nNcJyHYW', 'sWBNA0xPIX', 'DCkN5fPFVW', 'TdFNDUZZwB', 'PcaN0fGwux'
Source: 4.2.LisectAVT_2403002A_133.exe.40a5ac0.4.raw.unpack, ixE87fVco3u39tVeDd.cs	High entropy of concatenated method names: 'cTnwGk9lm5', 'mHnwP5T7f3', 'OwXwjkspvF', 'JJAwdQnbdS', 'A9RwhVN2f4', 'rm7woOa0HQ', 'jRMwfSYGaI', 'DvjwXuIUkR', 'WJhw1SmxoI', 'csNwqPbMeY'
Source: 4.2.LisectAVT_2403002A_133.exe.40a5ac0.4.raw.unpack, POksTqLv23gIDSTmtv.cs	High entropy of concatenated method names: 'JO8rAaIYYE', 'DjWr5h1PKK', 'oCQr04Qi43', 'YqNrkruhUm', 'LKWr8ncL7e', 'yWkr2obMx1', 'wvTnhcPZarpk054mmR', 'UMtRynZWACdxwUrZhC', 'T76rrqcjXX', 'PmqrNvnrcm'
Source: 4.2.LisectAVT_2403002A_133.exe.40a5ac0.4.raw.unpack, FFUGolJopXrievvJ4c.cs	High entropy of concatenated method names: 'ToString', 'iUW2qjhSAh', 'rd02dgurYc', 'chY2INAa3Z', 'PKl2hXQBeT', 'hgE2oM2jh3', 'gLl2M32bN8', 'Ets2ffjKh1', 'hSO2XfObqu', 'BTY2U9RZDE'
Source: 4.2.LisectAVT_2403002A_133.exe.40a5ac0.4.raw.unpack, YlGc4ZTI0YWd3fQsXx.cs	High entropy of concatenated method names: 'F0qKjGnNZn', 'kIvKds7BwO', 'eR4KINfIG1', 'OeUKhEqg0N', 'Du5KRh7P5p', 'AyXKo8IikI', 'Next', 'Next', 'Next', 'NextBytes'
Source: 4.2.LisectAVT_2403002A_133.exe.40a5ac0.4.raw.unpack, YjEy6M9c2BTBmsjLfO.cs	High entropy of concatenated method names: 'E7yO0KkHnM', 'nN4Ok0rb2c', 'ToString', 'OTGOiqB70W', 'VFcOyeYglF', 'bwgOpHRFcL', 'sVbOYUZVpJ', 'lkTOcxvxW6', 'aRgOAbHdNb', 'SbqO5QFGTl'
Source: 4.2.LisectAVT_2403002A_133.exe.40a5ac0.4.raw.unpack, iBZpNwPCQ4Qi43TqNr.cs	High entropy of concatenated method names: 'x81pH1NjsS', 'qv6pvIt2pO', 'R4ppGmXiq9', 'rUepPVPj45', 'rR9p8wGSpd', 'xAwp2Fuitb', 'LfNpOUwoj6', 'iJnpKC94p9', 'u3bptiWJqZ', 'iDTps6LYTG'
Source: 4.2.LisectAVT_2403002A_133.exe.40a5ac0.4.raw.unpack, RhUmNua4HbfKXXKWnc.cs	High entropy of concatenated method names: 'S7GYENfHgW', 'QXOYbYkQV6', 'amIpIW9i1S', 'IUlphdWb6j', 'P6ApocAvIU', 'gnIpM8sVjj', 'aOVpfjotY4', 'ycOpXB6kmb', 'LNxpUCrROp', 'mIIp1R018y'
Source: 4.2.LisectAVT_2403002A_133.exe.40a5ac0.4.raw.unpack, AVK0tnygKddfqQqwFa.cs	High entropy of concatenated method names: 'Dispose', 'rodrTt8uiY', 'n59gdxJVSq', 'KXm77IHRwJ', 'iV0rFvpVvH', 'kGMrzpEnUV', 'ProcessDialogKey', 'O3FgxlGc4Z', 'H0YgrWd3fQ', 'sXxggD1ZjH'
Source: 4.2.LisectAVT_2403002A_133.exe.40a5ac0.4.raw.unpack, aBA5C2rg4OGBwlweuHD.cs	High entropy of concatenated method names: 'torsZh01GT', 'PX9sCfefiK', 'spus3OF7h8', 'dJcXFUuHbYVfWKL0Mv3', 'g7c2DQuTFTb0l3JF2TZ', 'K5vX88uL9xU5AAKHIna', 'UeMxN6uPTQmh0wkDl91'
Source: 4.2.LisectAVT_2403002A_133.exe.40a5ac0.4.raw.unpack, e1U0wlhLCh8W4Il2BO.cs	High entropy of concatenated method names: 'qAHclIXBfb', 'DtycZtL2ZP', 'q4wc3EYCm8', 'R3QcHHOxTn', 'PnfcvuZN4p', 'vVHcbK8kem', 'TkdcP9Dbkp', 'SAbcapIjue', 'ppXa5yAmQMviloOFm7r', 'WIi36EAJI6oFlSeU7I9'
Source: 4.2.LisectAVT_2403002A_133.exe.40a5ac0.4.raw.unpack, aGt5rhfGQ5TrNgoLpn.cs	High entropy of concatenated method names: 'BouAifZsaZ', 'AKLApVsjhc', 'UggAcG4BpF', 'WybcFqUq3A', 'M6Zcz1PGsD', 'rNcAxccuDL', 'aE8Arj7j0Z', 'rf0Ag2pDSp', 'lmZANvNws8', 'Bv6ALX9ASL'

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe

File created: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GlIToApjgGEL" /XML "C:\Users\user\AppData\Local\Temp\tmpCD6C.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: GlIToApjgGEL.exe PID: 7472, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Memory allocated: F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Memory allocated: 2CC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Memory allocated: 2A00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Memory allocated: 87C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Memory allocated: 97C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Memory allocated: 9AB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Memory allocated: AAB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Memory allocated: 1590000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Memory allocated: 3130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Memory allocated: 5130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Memory allocated: 2520000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Memory allocated: 27A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Memory allocated: 26C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Memory allocated: 82E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Memory allocated: 92E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Memory allocated: 95D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Memory allocated: A5D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Memory allocated: 1150000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Memory allocated: 3000000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Memory allocated: 2E40000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6885	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6387	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Window / User API: threadDelayed 2420	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Window / User API: threadDelayed 7428	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Window / User API: threadDelayed 6833
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Window / User API: threadDelayed 3020

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 4532	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7188	Thread sleep count: 6885 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7388	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7304	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7440	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7364	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7620	Thread sleep count: 2420 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -99839s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -99732s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -99625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -99516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7620	Thread sleep count: 7428 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -99393s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -99266s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -99156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -99046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -98938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -98813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -98703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -98594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -98469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -98359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -98250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -98141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -98031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -97922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -97812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -97703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -97594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -97469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -97357s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -97250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -97141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -97031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -96922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -96812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -96703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -96594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -96484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -96375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -96266s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -96141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -96016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -95906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -95797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -95688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -95563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -95438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -95324s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -95219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -95094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -94984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -94875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -94766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -94656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -94547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe TID: 7596	Thread sleep time: -94438s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7512	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep count: 35 > 30
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -32281802128991695s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7836	Thread sleep count: 6833 > 30
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7836	Thread sleep count: 3020 > 30
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -99890s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -99781s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -99659s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -99531s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -99421s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -99312s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -99203s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -99084s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -98847s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -98718s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -98608s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -98499s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -98390s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -98281s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -98171s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -98062s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -97952s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -97843s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -97733s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -97624s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -97515s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -97405s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -97296s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -97187s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -97075s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -96968s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -96858s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -96749s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -96640s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -96530s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -96421s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -96312s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -96202s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -96093s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -95984s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -95874s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -95765s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -95655s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -95546s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -95437s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -95328s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -95218s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -95109s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -94999s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -94890s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -94780s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -94671s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -94562s >= -30000s
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe TID: 7832	Thread sleep time: -94437s >= -30000s

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 99839	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 99732	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 99625	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 99516	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 99393	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 99266	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 99156	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 99046	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 98938	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 98813	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 98703	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 98594	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 98469	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 98359	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 98250	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 98141	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 98031	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 97922	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 97812	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 97703	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 97594	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 97469	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 97357	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 97250	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 97141	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 97031	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 96922	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 96812	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 96703	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 96594	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 96484	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 96375	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 96266	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 96141	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 96016	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 95906	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 95797	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 95688	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 95563	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 95438	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 95324	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 95219	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 95094	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 94984	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 94875	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 94766	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 94656	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 94547	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Thread delayed: delay time: 94438	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 99890
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 99781
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 99659
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 99531
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 99421
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 99312
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 99203
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 99084
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 98847
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 98718
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 98608
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 98499
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 98390
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 98281
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 98171
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 98062
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 97952
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 97843
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 97733
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 97624
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 97515
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 97405
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 97296
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 97187
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 97075
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 96968
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 96858
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 96749
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 96640
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 96530
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 96421
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 96312
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 96202
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 96093
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 95984
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 95874
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 95765
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 95655
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 95546
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 95437
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 95328
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 95218
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 95109
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 94999
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 94890
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 94780
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 94671
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 94562
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Thread delayed: delay time: 94437

Source: GlIToApjgGEL.exe, 00000013.00000002.1407798826.00000000080C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Dev
Source: GlIToApjgGEL.exe, 00000013.00000002.1407798826.0000000008126000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: LisectAVT_2403002A_133.exe, 00000012.00000002.2527569170.0000000001711000.00000004.00000020.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2539536816.00000000063CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_133.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_133.exe"	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Memory written: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Memory written: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_133.exe"	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe"	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GlIToApjgGEL" /XML "C:\Users\user\AppData\Local\Temp\tmpCD6C.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Process created: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe "C:\Users\user\Desktop\LisectAVT_2403002A_133.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GlIToApjgGEL" /XML "C:\Users\user\AppData\Local\Temp\tmpE6EF.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process created: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe "C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Process created: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe "C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe"	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Queries volume information: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Queries volume information: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Queries volume information: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Queries volume information: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 19.2.GlIToApjgGEL.exe.3ae17c0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.LisectAVT_2403002A_133.exe.403afe8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.GlIToApjgGEL.exe.3b1c1e0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.GlIToApjgGEL.exe.3b1c1e0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.LisectAVT_2403002A_133.exe.40005c8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.GlIToApjgGEL.exe.3ae17c0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.LisectAVT_2403002A_133.exe.403afe8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.LisectAVT_2403002A_133.exe.40005c8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.2528847260.000000000307C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2527987214.00000000031AC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2527987214.0000000003181000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2528847260.0000000003051000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1344574120.0000000004921000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2522255682.0000000000415000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1344574120.0000000004000000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1403560028.0000000003AE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_133.exe PID: 1088, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_133.exe PID: 7320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: GlIToApjgGEL.exe PID: 7472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: GlIToApjgGEL.exe PID: 7736, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_133.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 19.2.GlIToApjgGEL.exe.3ae17c0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.LisectAVT_2403002A_133.exe.403afe8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.GlIToApjgGEL.exe.3b1c1e0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.GlIToApjgGEL.exe.3b1c1e0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.LisectAVT_2403002A_133.exe.40005c8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.GlIToApjgGEL.exe.3ae17c0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.LisectAVT_2403002A_133.exe.403afe8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.LisectAVT_2403002A_133.exe.40005c8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.2527987214.0000000003181000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2528847260.0000000003051000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1344574120.0000000004921000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2522255682.0000000000415000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1344574120.0000000004000000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1403560028.0000000003AE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_133.exe PID: 1088, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_133.exe PID: 7320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: GlIToApjgGEL.exe PID: 7472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: GlIToApjgGEL.exe PID: 7736, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 19.2.GlIToApjgGEL.exe.3ae17c0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.LisectAVT_2403002A_133.exe.403afe8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.GlIToApjgGEL.exe.3b1c1e0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.GlIToApjgGEL.exe.3b1c1e0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.LisectAVT_2403002A_133.exe.40005c8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.GlIToApjgGEL.exe.3ae17c0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.LisectAVT_2403002A_133.exe.403afe8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.LisectAVT_2403002A_133.exe.40005c8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.2528847260.000000000307C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2527987214.00000000031AC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2527987214.0000000003181000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2528847260.0000000003051000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1344574120.0000000004921000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2522255682.0000000000415000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1344574120.0000000004000000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1403560028.0000000003AE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_133.exe PID: 1088, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_133.exe PID: 7320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: GlIToApjgGEL.exe PID: 7472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: GlIToApjgGEL.exe PID: 7736, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	111 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	3 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	111 Security Software Discovery	Distributed Component Object Model	1 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
LisectAVT_2403002A_133.exe	100%	Avira	HEUR/AGEN.1323752
LisectAVT_2403002A_133.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	100%	Avira	HEUR/AGEN.1323752
C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
https://api.ipify.org/t	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://kabeercommodities.com	0%	Avira URL Cloud	safe
http://r10.i.lencr.org/09	0%	Avira URL Cloud	safe
http://mail.kabeercommodities.com	0%	Avira URL Cloud	safe
http://r10.o.lencr.org0#	0%	Avira URL Cloud	safe
http://crl.micros;	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
kabeercommodities.com	45.91.139.1	true	true	unknown
api.ipify.org	172.67.74.152	true	false	unknown
mail.kabeercommodities.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	LisectAVT_2403002A_133.exe, 00000004.00000002.1344574120.0000000004000000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_133.exe, 00000004.00000002.1344574120.0000000004921000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_133.exe, 00000012.00000002.2527987214.0000000003131000.00000004.00000800.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000013.00000002.1403560028.0000000003AE1000.00000004.00000800.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2528847260.0000000003001000.00000004.00000800.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2522255682.0000000000415000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://r10.o.lencr.org0#	LisectAVT_2403002A_133.exe, 00000012.00000002.2526645083.0000000001676000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_133.exe, 00000012.00000002.2527987214.00000000031B4000.00000004.00000800.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2526896258.0000000001249000.00000004.00000020.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2528847260.0000000003084000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.dyn.com/	LisectAVT_2403002A_133.exe, 00000004.00000002.1344574120.0000000004000000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_133.exe, 00000004.00000002.1344574120.0000000004921000.00000004.00000800.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000013.00000002.1403560028.0000000003AE1000.00000004.00000800.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2522255682.0000000000415000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org/t	LisectAVT_2403002A_133.exe, 00000012.00000002.2527987214.0000000003131000.00000004.00000800.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2528847260.0000000003001000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://kabeercommodities.com	LisectAVT_2403002A_133.exe, 00000012.00000002.2527987214.00000000031AC000.00000004.00000800.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2528847260.000000000307C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mail.kabeercommodities.com	LisectAVT_2403002A_133.exe, 00000012.00000002.2527987214.00000000031AC000.00000004.00000800.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2528847260.000000000307C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	LisectAVT_2403002A_133.exe, 00000004.00000002.1343518581.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_133.exe, 00000012.00000002.2527987214.0000000003131000.00000004.00000800.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000013.00000002.1402251524.0000000002810000.00000004.00000800.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2528847260.0000000003001000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.c.lencr.org/0	LisectAVT_2403002A_133.exe, 00000012.00000002.2526645083.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_133.exe, 00000012.00000002.2527987214.00000000031B4000.00000004.00000800.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2526896258.0000000001214000.00000004.00000020.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2528847260.0000000003084000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	LisectAVT_2403002A_133.exe, 00000012.00000002.2526645083.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_133.exe, 00000012.00000002.2527987214.00000000031B4000.00000004.00000800.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2526896258.0000000001214000.00000004.00000020.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2539536816.00000000063CB000.00000004.00000020.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2528847260.0000000003084000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.micros;	LisectAVT_2403002A_133.exe, 00000012.00000002.2539654353.0000000006927000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://r10.i.lencr.org/09	LisectAVT_2403002A_133.exe, 00000012.00000002.2526645083.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_133.exe, 00000012.00000002.2526645083.0000000001676000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_133.exe, 00000012.00000002.2527987214.00000000031B4000.00000004.00000800.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2526896258.0000000001249000.00000004.00000020.00020000.00000000.sdmp, GlIToApjgGEL.exe, 00000018.00000002.2528847260.0000000003084000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.91.139.1	kabeercommodities.com	Lithuania		34549	MEER-ASmeerfarbigGmbHCoKGDE	true
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1482509
Start date and time:	2024-07-25 23:57:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LisectAVT_2403002A_133.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@21/15@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 170 Number of non-executed functions: 22
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: LisectAVT_2403002A_133.exe

Simulations

Behavior and APIs

Time	Type	Description
17:58:02	API Interceptor	107x Sleep call for process: LisectAVT_2403002A_133.exe modified
17:58:06	API Interceptor	36x Sleep call for process: powershell.exe modified
17:58:09	API Interceptor	88x Sleep call for process: GlIToApjgGEL.exe modified
23:58:06	Task Scheduler	Run new task: GlIToApjgGEL path: C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
45.91.139.1	P3DuNLpu72.exe	Get hash	malicious	AgentTesla	Browse
	PO#241001759.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.PWSX-gen.29051.4919.exe	Get hash	malicious	AgentTesla	Browse
	6WMFyWEJ9J.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	gKqp0d6IXP.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	qxwhJXhPtC.exe	Get hash	malicious	AgentTesla	Browse
	conhost.exe	Get hash	malicious	AgentTesla	Browse
	PO#_231001759.exe	Get hash	malicious	AgentTesla	Browse
172.67.74.152	golang-modules.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	SecuriteInfo.com.Trojan.Win64.Agent.14415.19839.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	242764.exe	Get hash	malicious	Ficker Stealer, Rusty Stealer	Browse	api.ipify.org/?format=wef
	K8mzlntJVN.msi	Get hash	malicious	Unknown	Browse	api.ipify.org/
	stub.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	stub.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	LisectAVT_2403002A_2.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	LisectAVT_2403002A_460.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	LisectAVT_2403002A_481.exe	Get hash	malicious	Luna Grabber, Luna Logger	Browse	104.26.12.205
	LisectAVT_2403002A_63.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	LisectAVT_2403002A_59.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	LisectAVT_2403002A_74.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	SWIFT COPY.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Re_ Q22689 - 07.24.2024_Conduit Construction Network Ltd_Today.eml	Get hash	malicious	Unknown	Browse	172.67.74.152
	LisectAVT_2403002B_385.exe	Get hash	malicious	AgentTesla, Bdaejec	Browse	104.26.12.205
	LisectAVT_2403002B_390.exe	Get hash	malicious	AgentTesla, Bdaejec	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MEER-ASmeerfarbigGmbHCoKGDE	LisectAVT_2403002A_165.exe	Get hash	malicious	Socks5Systemz	Browse	45.155.250.89
	LisectAVT_2403002A_168.exe	Get hash	malicious	Socks5Systemz	Browse	45.155.250.89
	LisectAVT_2403002A_164.exe	Get hash	malicious	Socks5Systemz	Browse	45.155.250.89
	LisectAVT_2403002A_165.exe	Get hash	malicious	Socks5Systemz	Browse	45.155.250.89
	LisectAVT_2403002A_168.exe	Get hash	malicious	Socks5Systemz	Browse	45.155.250.89
	LisectAVT_2403002A_171.exe	Get hash	malicious	Socks5Systemz	Browse	45.155.250.89
	LisectAVT_2403002A_184.exe	Get hash	malicious	Socks5Systemz	Browse	45.155.250.89
	LisectAVT_2403002A_189.exe	Get hash	malicious	Socks5Systemz	Browse	45.155.250.89
	LisectAVT_2403002A_221.exe	Get hash	malicious	Socks5Systemz	Browse	45.155.250.89
	LisectAVT_2403002A_221.exe	Get hash	malicious	Socks5Systemz	Browse	45.155.250.89
CLOUDFLARENETUS	LisectAVT_2403002A_147.exe	Get hash	malicious	Blank Grabber	Browse	162.159.138.232
	LisectAVT_2403002A_155.exe	Get hash	malicious	Unknown	Browse	172.67.202.72
	LisectAVT_2403002A_161.exe	Get hash	malicious	Luna Grabber, Luna Logger	Browse	162.159.133.233
	LisectAVT_2403002A_162.exe	Get hash	malicious	Unknown	Browse	104.21.85.44
	https://aecoa.racipens.su/ievqefkwtdjogsyjfdbfnprzYkzLoDtSZBZFTQIDNBMGDEMRMWVOLGXOOCCPHOBAHWORBTIQHFOUAGEIrstXEZnKMUIf12KAT7V5Wwx35	Get hash	malicious	Unknown	Browse	172.67.170.95
	LisectAVT_2403002A_2.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://taf7.rphortan.com/xV5YqZuT/#Xjeffrey.laws@99restaurants.com	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.17.25.14
	LisectAVT_2403002A_210.exe	Get hash	malicious	Python Stealer, Empyrean, Discord Token Stealer	Browse	104.16.123.96
	Jeffrey.laws Replay VM (01m27sec).docx	Get hash	malicious	HTMLPhisher	Browse	172.64.151.101
	LisectAVT_2403002A_220.exe	Get hash	malicious	Unknown	Browse	104.21.6.108

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	LisectAVT_2403002A_14.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	LisectAVT_2403002A_14.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	LisectAVT_2403002A_155.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	LisectAVT_2403002A_162.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	LisectAVT_2403002A_2.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	LisectAVT_2403002A_220.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	LisectAVT_2403002A_308.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	LisectAVT_2403002A_308.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	LisectAVT_2403002A_333.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	LisectAVT_2403002A_333.exe	Get hash	malicious	Unknown	Browse	172.67.74.152

Process:	C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	5.352427679901606
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPE4KMRuAE4KzecKIE4oKNzKorE4x84j:MIHK5HKH1qHiYHKh3oPHKMRuAHKzectP
MD5:	3978978DE913FD1C068312697D6E5917
SHA1:	1DABBE7FB8F38F6EBF474CE5F0ECAA89F48E2538
SHA-256:	33B7B1668DDD3AB39711F9F93B667F6F2F674348A79228BFA163BA625B37F120
SHA-512:	78694B97F5D03758F503155E5CE5B85AABDF9690F0DFBC51FCE9926BE2D86BCF99E008659420F1E8489A7F6EA125F2776D4C6DC4B151566B529454512352953D
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data\1b8c564fd69668e6e62d136259980d9e\System.Data.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll"

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\LisectAVT_2403002A_133.exe.log

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_133.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	5.352427679901606
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPE4KMRuAE4KzecKIE4oKNzKorE4x84j:MIHK5HKH1qHiYHKh3oPHKMRuAHKzectP
MD5:	3978978DE913FD1C068312697D6E5917
SHA1:	1DABBE7FB8F38F6EBF474CE5F0ECAA89F48E2538
SHA-256:	33B7B1668DDD3AB39711F9F93B667F6F2F674348A79228BFA163BA625B37F120
SHA-512:	78694B97F5D03758F503155E5CE5B85AABDF9690F0DFBC51FCE9926BE2D86BCF99E008659420F1E8489A7F6EA125F2776D4C6DC4B151566B529454512352953D
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data\1b8c564fd69668e6e62d136259980d9e\System.Data.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll"

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379540626579189
Encrypted:	false
SSDEEP:	48:BWSU4xymI4RfoUeW+gZ9tK8NPZHUxL7u1iMugeC/ZPUyus:BLHxvIIwLgZ2KRHWLOug8s
MD5:	3604448ACFFDEA4C8F0E1157944DF8AA
SHA1:	25B24FBF7F874AF9F77EDC1002698A1823563C96
SHA-256:	03D975643485A13BCA08BB7801689F354193782332E13C1D3D157782C4A90829
SHA-512:	B4F4024BA4D71451E9CA4150A4E8D9347E276E8FA7C7D6DEC6E6D5BA6EA9E8A69F735A9021DFFF911C82B74D238EE6EB3E1F17A57F976207EF9B476D0BEB2C50
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bolbem2p.ywk.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_edkdearx.j4a.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gzobwmys.b1z.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j5qnhrc5.din.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_keacwpii.npm.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mfvtdh0q.nwy.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sou4er2x.uuf.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xwftd0m5.fpn.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmpCD6C.tmp

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_133.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1606
Entropy (8bit):	5.12492380587016
Encrypted:	false
SSDEEP:	24:2di4+S2qhH1jy1m4UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtdcxvn:cgeHgYrFdOFzOzN33ODOiDdKrsuTdcv
MD5:	BAD85834F5E70184B4C17B9B17B360A3
SHA1:	380B80F2F5860BD154BEFB2E4351172013F22AF4
SHA-256:	3AC8CFB8C4C6A9D6BF525C31AA323FCB1CC182002AB0B271BB251CFA9431FB20
SHA-512:	F4A161169DA61FD1C05F16AF5B52725478E1171C1A771729025DE39FD6D47E53C37E51CB780F51FBFA3584F0B020FEEF17D3C5E916C1E38E98C253D101145162
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>.

C:\Users\user\AppData\Local\Temp\tmpE6EF.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1606
Entropy (8bit):	5.12492380587016
Encrypted:	false
SSDEEP:	24:2di4+S2qhH1jy1m4UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtdcxvn:cgeHgYrFdOFzOzN33ODOiDdKrsuTdcv
MD5:	BAD85834F5E70184B4C17B9B17B360A3
SHA1:	380B80F2F5860BD154BEFB2E4351172013F22AF4
SHA-256:	3AC8CFB8C4C6A9D6BF525C31AA323FCB1CC182002AB0B271BB251CFA9431FB20
SHA-512:	F4A161169DA61FD1C05F16AF5B52725478E1171C1A771729025DE39FD6D47E53C37E51CB780F51FBFA3584F0B020FEEF17D3C5E916C1E38E98C253D101145162
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>.

C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_133.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	747018
Entropy (8bit):	7.9512885595946825
Encrypted:	false
SSDEEP:	12288:INeOQx3TdpCmdIdL2/2gHecoI/v0b24w135wltCE5UrMkpOTOudkdRsoBiQ:kixjdpfId65Jn/r4m5wfCMop6OeoR/EQ
MD5:	56808E1595200230CAE4AE17B5DBB869
SHA1:	CE0935FEFED25268069331BA6277B4D14C385E28
SHA-256:	1A38E29DFF73F042B8ABB0ED1398A37EEFA8FE3F6030E27A9A22B8964263B146
SHA-512:	28D5F6D36E206004A8A60F7BB66AEAE9F1965C548DA0BABEBDAE9AAB6098794985AE5E55C483CF0C99EF33396CB6ABD3E2B2CF07D4F6734ECF9E6A5861503F98
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...nW.f.................B...".......a... ........@.. ....................................@.................................da..W.................................................................................... ............... ..H............text....A... ...B.................. ..`.rsrc............ ...D..............@..@.reloc...............d..............@..B.................a......H.......$..@7............`w..........................................z.(......}.....(....o....}......0...........{............3.....(.......................0...........{......,....f.........}......}......}.......s....o....}.......}....8......{....o....}......{....}......}.............}.....{........Y}.....{....-...+H.{........{....X.{....X .;.\|.{....Xa}......}.....{....oC...:q....(....+..(........}.........(......................n..}.....{....,..{....o@.....{....*.s..

C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_133.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.9512885595946825
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	LisectAVT_2403002A_133.exe
File size:	747'018 bytes
MD5:	56808e1595200230cae4ae17b5dbb869
SHA1:	ce0935fefed25268069331ba6277b4d14c385e28
SHA256:	1a38e29dff73f042b8abb0ed1398a37eefa8fe3f6030e27a9a22b8964263b146
SHA512:	28d5f6d36e206004a8a60f7bb66aeae9f1965c548da0babebdae9aab6098794985ae5e55c483cf0c99ef33396cb6abd3e2b2cf07d4f6734ecf9e6a5861503f98
SSDEEP:	12288:INeOQx3TdpCmdIdL2/2gHecoI/v0b24w135wltCE5UrMkpOTOudkdRsoBiQ:kixjdpfId65Jn/r4m5wfCMop6OeoR/EQ
TLSH:	5DF401D6A1B71853EBDB45F042A3398E1775A22C31AAC6890F603DC875D2FC5FD8C686
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...nW.f.................B...".......a... ........@.. ....................................@................................

File Icon


Icon Hash:	4d0e3168cec67117

Static PE Info

General

Entrypoint:	0x4b61be
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6603576E [Tue Mar 26 23:17:02 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb6164	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb8000	0x1fe0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xba000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xb41c4	0xb4200	7cdca010b865bbbe689afc4bcc51977b	False	0.9443420367800138	data	7.956613403047499	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xb8000	0x1fe0	0x2000	e042f5b29124f5c6b66cdfbc34f77106	False	0.899658203125	data	7.56122725112233	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xba000	0xc	0x200	0fd341ed5982e299679a6a6e8e4b0dcd	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xb80e8	0x1c2e	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9579983365677849
RT_GROUP_ICON	0xb9d18	0x14	data	1.05
RT_VERSION	0xb9d2c	0x2b4	data	0.4754335260115607

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-25T23:58:21.889521+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49709	13.85.23.86	192.168.2.7
2024-07-25T23:59:00.566677+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49714	13.85.23.86	192.168.2.7

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 23:58:07.521459103 CEST	49704	443	192.168.2.7	172.67.74.152
Jul 25, 2024 23:58:07.521495104 CEST	443	49704	172.67.74.152	192.168.2.7
Jul 25, 2024 23:58:07.521636009 CEST	49704	443	192.168.2.7	172.67.74.152
Jul 25, 2024 23:58:07.529664993 CEST	49704	443	192.168.2.7	172.67.74.152
Jul 25, 2024 23:58:07.529678106 CEST	443	49704	172.67.74.152	192.168.2.7
Jul 25, 2024 23:58:08.040087938 CEST	443	49704	172.67.74.152	192.168.2.7
Jul 25, 2024 23:58:08.040215015 CEST	49704	443	192.168.2.7	172.67.74.152
Jul 25, 2024 23:58:08.044384003 CEST	49704	443	192.168.2.7	172.67.74.152
Jul 25, 2024 23:58:08.044390917 CEST	443	49704	172.67.74.152	192.168.2.7
Jul 25, 2024 23:58:08.044764996 CEST	443	49704	172.67.74.152	192.168.2.7
Jul 25, 2024 23:58:08.086911917 CEST	49704	443	192.168.2.7	172.67.74.152
Jul 25, 2024 23:58:08.223231077 CEST	49704	443	192.168.2.7	172.67.74.152
Jul 25, 2024 23:58:08.264503002 CEST	443	49704	172.67.74.152	192.168.2.7
Jul 25, 2024 23:58:08.342072010 CEST	443	49704	172.67.74.152	192.168.2.7
Jul 25, 2024 23:58:08.342150927 CEST	443	49704	172.67.74.152	192.168.2.7
Jul 25, 2024 23:58:08.342422962 CEST	49704	443	192.168.2.7	172.67.74.152
Jul 25, 2024 23:58:08.348218918 CEST	49704	443	192.168.2.7	172.67.74.152
Jul 25, 2024 23:58:09.738147974 CEST	49706	587	192.168.2.7	45.91.139.1
Jul 25, 2024 23:58:09.743474960 CEST	587	49706	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:09.743541002 CEST	49706	587	192.168.2.7	45.91.139.1
Jul 25, 2024 23:58:10.618215084 CEST	587	49706	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:10.618669033 CEST	49706	587	192.168.2.7	45.91.139.1
Jul 25, 2024 23:58:10.623533010 CEST	587	49706	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:11.628674030 CEST	587	49706	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:11.628850937 CEST	49706	587	192.168.2.7	45.91.139.1
Jul 25, 2024 23:58:11.633852005 CEST	587	49706	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:12.013339043 CEST	587	49706	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:12.013751984 CEST	49706	587	192.168.2.7	45.91.139.1
Jul 25, 2024 23:58:12.018596888 CEST	587	49706	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:12.354206085 CEST	587	49706	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:12.354302883 CEST	587	49706	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:12.354310989 CEST	587	49706	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:12.354355097 CEST	49706	587	192.168.2.7	45.91.139.1
Jul 25, 2024 23:58:12.486927032 CEST	49706	587	192.168.2.7	45.91.139.1
Jul 25, 2024 23:58:12.688620090 CEST	587	49706	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:13.023251057 CEST	587	49706	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:13.026391983 CEST	49706	587	192.168.2.7	45.91.139.1
Jul 25, 2024 23:58:13.033154964 CEST	587	49706	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:13.307681084 CEST	49707	443	192.168.2.7	172.67.74.152
Jul 25, 2024 23:58:13.307723045 CEST	443	49707	172.67.74.152	192.168.2.7
Jul 25, 2024 23:58:13.307842016 CEST	49707	443	192.168.2.7	172.67.74.152
Jul 25, 2024 23:58:13.310898066 CEST	49707	443	192.168.2.7	172.67.74.152
Jul 25, 2024 23:58:13.310911894 CEST	443	49707	172.67.74.152	192.168.2.7
Jul 25, 2024 23:58:13.422207117 CEST	587	49706	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:13.444046974 CEST	49706	587	192.168.2.7	45.91.139.1
Jul 25, 2024 23:58:13.449642897 CEST	587	49706	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:13.780288935 CEST	443	49707	172.67.74.152	192.168.2.7
Jul 25, 2024 23:58:13.780359030 CEST	49707	443	192.168.2.7	172.67.74.152
Jul 25, 2024 23:58:13.782784939 CEST	49707	443	192.168.2.7	172.67.74.152
Jul 25, 2024 23:58:13.782799006 CEST	443	49707	172.67.74.152	192.168.2.7
Jul 25, 2024 23:58:13.783036947 CEST	443	49707	172.67.74.152	192.168.2.7
Jul 25, 2024 23:58:13.836894989 CEST	49707	443	192.168.2.7	172.67.74.152
Jul 25, 2024 23:58:13.866127968 CEST	49707	443	192.168.2.7	172.67.74.152
Jul 25, 2024 23:58:13.912493944 CEST	443	49707	172.67.74.152	192.168.2.7
Jul 25, 2024 23:58:13.971733093 CEST	443	49707	172.67.74.152	192.168.2.7
Jul 25, 2024 23:58:13.971898079 CEST	443	49707	172.67.74.152	192.168.2.7
Jul 25, 2024 23:58:13.971950054 CEST	49707	443	192.168.2.7	172.67.74.152
Jul 25, 2024 23:58:13.974822044 CEST	49707	443	192.168.2.7	172.67.74.152
Jul 25, 2024 23:58:14.517879963 CEST	49708	587	192.168.2.7	45.91.139.1
Jul 25, 2024 23:58:14.522838116 CEST	587	49708	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:14.523555994 CEST	49708	587	192.168.2.7	45.91.139.1
Jul 25, 2024 23:58:15.400527000 CEST	587	49708	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:15.400880098 CEST	49708	587	192.168.2.7	45.91.139.1
Jul 25, 2024 23:58:15.406362057 CEST	587	49708	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:15.793982983 CEST	587	49708	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:15.794353962 CEST	49708	587	192.168.2.7	45.91.139.1
Jul 25, 2024 23:58:15.799369097 CEST	587	49708	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:16.360730886 CEST	587	49708	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:16.361253023 CEST	49708	587	192.168.2.7	45.91.139.1
Jul 25, 2024 23:58:16.366089106 CEST	587	49708	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:16.704211950 CEST	587	49708	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:16.704314947 CEST	587	49708	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:16.704324961 CEST	587	49708	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:16.704631090 CEST	49708	587	192.168.2.7	45.91.139.1
Jul 25, 2024 23:58:16.704679966 CEST	587	49708	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:16.704852104 CEST	49708	587	192.168.2.7	45.91.139.1
Jul 25, 2024 23:58:16.705821037 CEST	49708	587	192.168.2.7	45.91.139.1
Jul 25, 2024 23:58:16.710949898 CEST	587	49708	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:17.036034107 CEST	587	49708	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:17.039397955 CEST	49708	587	192.168.2.7	45.91.139.1
Jul 25, 2024 23:58:17.044378996 CEST	587	49708	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:17.421159983 CEST	587	49708	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:17.421575069 CEST	49708	587	192.168.2.7	45.91.139.1
Jul 25, 2024 23:58:17.426594019 CEST	587	49708	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:17.818284035 CEST	587	49706	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:17.844285011 CEST	49706	587	192.168.2.7	45.91.139.1
Jul 25, 2024 23:58:17.849086046 CEST	587	49706	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:20.230443001 CEST	587	49706	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:20.230869055 CEST	49706	587	192.168.2.7	45.91.139.1
Jul 25, 2024 23:58:20.235727072 CEST	587	49706	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:20.664413929 CEST	587	49706	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:20.664669991 CEST	49706	587	192.168.2.7	45.91.139.1
Jul 25, 2024 23:58:20.669589996 CEST	587	49706	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:21.076829910 CEST	587	49706	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:21.112683058 CEST	49706	587	192.168.2.7	45.91.139.1
Jul 25, 2024 23:58:21.118457079 CEST	587	49706	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:21.118715048 CEST	49706	587	192.168.2.7	45.91.139.1
Jul 25, 2024 23:58:21.788300991 CEST	587	49708	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:21.788857937 CEST	49708	587	192.168.2.7	45.91.139.1
Jul 25, 2024 23:58:21.794126034 CEST	587	49708	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:23.661278009 CEST	587	49708	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:23.662590981 CEST	49708	587	192.168.2.7	45.91.139.1
Jul 25, 2024 23:58:23.668607950 CEST	587	49708	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:24.105195045 CEST	587	49708	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:24.105433941 CEST	49708	587	192.168.2.7	45.91.139.1
Jul 25, 2024 23:58:24.110435009 CEST	587	49708	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:24.487520933 CEST	587	49708	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:24.504914045 CEST	49708	587	192.168.2.7	45.91.139.1
Jul 25, 2024 23:58:24.515522003 CEST	587	49708	45.91.139.1	192.168.2.7
Jul 25, 2024 23:58:24.515579939 CEST	49708	587	192.168.2.7	45.91.139.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 23:58:07.451101065 CEST	62926	53	192.168.2.7	1.1.1.1
Jul 25, 2024 23:58:07.458317041 CEST	53	62926	1.1.1.1	192.168.2.7
Jul 25, 2024 23:58:09.145893097 CEST	63428	53	192.168.2.7	1.1.1.1
Jul 25, 2024 23:58:09.736495972 CEST	53	63428	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 25, 2024 23:58:07.451101065 CEST	192.168.2.7	1.1.1.1	0x8c8	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Jul 25, 2024 23:58:09.145893097 CEST	192.168.2.7	1.1.1.1	0xbf90	Standard query (0)	mail.kabeercommodities.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 25, 2024 23:58:07.458317041 CEST	1.1.1.1	192.168.2.7	0x8c8	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Jul 25, 2024 23:58:07.458317041 CEST	1.1.1.1	192.168.2.7	0x8c8	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Jul 25, 2024 23:58:07.458317041 CEST	1.1.1.1	192.168.2.7	0x8c8	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Jul 25, 2024 23:58:09.736495972 CEST	1.1.1.1	192.168.2.7	0xbf90	No error (0)	mail.kabeercommodities.com	kabeercommodities.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 23:58:09.736495972 CEST	1.1.1.1	192.168.2.7	0xbf90	No error (0)	kabeercommodities.com		45.91.139.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49704	172.67.74.152	443	7320	C:\Users\user\Desktop\LisectAVT_2403002A_133.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 21:58:08 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-07-25 21:58:08 UTC	211	IN	HTTP/1.1 200 OK Date: Thu, 25 Jul 2024 21:58:08 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8a8f68ddb8ac7d08-EWR
2024-07-25 21:58:08 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49707	172.67.74.152	443	7736	C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 21:58:13 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-07-25 21:58:13 UTC	211	IN	HTTP/1.1 200 OK Date: Thu, 25 Jul 2024 21:58:13 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8a8f6900ff7d41c6-EWR
2024-07-25 21:58:13 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jul 25, 2024 23:58:10.618215084 CEST	587	49706	45.91.139.1	192.168.2.7	220-cloud313.corpservers.net ESMTP Exim 4.97.1 #2 Fri, 26 Jul 2024 02:58:10 +0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 25, 2024 23:58:10.618669033 CEST	49706	587	192.168.2.7	45.91.139.1	EHLO 784794
Jul 25, 2024 23:58:11.628674030 CEST	587	49706	45.91.139.1	192.168.2.7	250-cloud313.corpservers.net Hello localhost [127.0.0.1] 250-STARTTLS 250-SIZE 52428800 250-8BITMIME 250-AUTH PLAIN LOGIN 250 HELP
Jul 25, 2024 23:58:11.628850937 CEST	49706	587	192.168.2.7	45.91.139.1	STARTTLS
Jul 25, 2024 23:58:12.013339043 CEST	587	49706	45.91.139.1	192.168.2.7	220 TLS go ahead
Jul 25, 2024 23:58:15.400527000 CEST	587	49708	45.91.139.1	192.168.2.7	220-cloud313.corpservers.net ESMTP Exim 4.97.1 #2 Fri, 26 Jul 2024 02:58:15 +0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 25, 2024 23:58:15.400880098 CEST	49708	587	192.168.2.7	45.91.139.1	EHLO 784794
Jul 25, 2024 23:58:15.793982983 CEST	587	49708	45.91.139.1	192.168.2.7	250-cloud313.corpservers.net Hello localhost [127.0.0.1] 250-STARTTLS 250-SIZE 52428800 250-8BITMIME 250-AUTH PLAIN LOGIN 250 HELP
Jul 25, 2024 23:58:15.794353962 CEST	49708	587	192.168.2.7	45.91.139.1	STARTTLS
Jul 25, 2024 23:58:16.360730886 CEST	587	49708	45.91.139.1	192.168.2.7	220 TLS go ahead

Target ID:	4
Start time:	17:58:01
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\LisectAVT_2403002A_133.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LisectAVT_2403002A_133.exe"
Imagebase:	0x810000
File size:	747'018 bytes
MD5 hash:	56808E1595200230CAE4AE17B5DBB869
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.1344574120.0000000004921000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.1344574120.0000000004921000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.1344574120.0000000004000000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.1344574120.0000000004000000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	17:58:05
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_133.exe"
Imagebase:	0x530000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	17:58:05
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:58:05
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe"
Imagebase:	0x530000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	17:58:05
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	17:58:05
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GlIToApjgGEL" /XML "C:\Users\user\AppData\Local\Temp\tmpCD6C.tmp"
Imagebase:	0xc30000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	17:58:05
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	17:58:05
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\LisectAVT_2403002A_133.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LisectAVT_2403002A_133.exe"
Imagebase:	0xdd0000
File size:	747'018 bytes
MD5 hash:	56808E1595200230CAE4AE17B5DBB869
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000012.00000002.2527987214.00000000031AC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000012.00000002.2527987214.0000000003181000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000012.00000002.2527987214.0000000003181000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	17:58:06
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe
Imagebase:	0x360000
File size:	747'018 bytes
MD5 hash:	56808E1595200230CAE4AE17B5DBB869
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000002.1403560028.0000000003AE1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000013.00000002.1403560028.0000000003AE1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	17:58:08
Start date:	25/07/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff7fb730000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	17:58:12
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GlIToApjgGEL" /XML "C:\Users\user\AppData\Local\Temp\tmpE6EF.tmp"
Imagebase:	0xc30000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	17:58:12
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	17:58:12
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe"
Imagebase:	0x2d0000
File size:	747'018 bytes
MD5 hash:	56808E1595200230CAE4AE17B5DBB869
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	17:58:12
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GlIToApjgGEL.exe"
Imagebase:	0xa90000
File size:	747'018 bytes
MD5 hash:	56808E1595200230CAE4AE17B5DBB869
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000018.00000002.2528847260.000000000307C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000018.00000002.2528847260.0000000003051000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000018.00000002.2528847260.0000000003051000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000018.00000002.2522255682.0000000000415000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000018.00000002.2522255682.0000000000415000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	204
Total number of Limit Nodes:	13

Executed Functions

Function 085AB668 Relevance: 18.3, Strings: 12, Instructions: 3314
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

7, xrefs: 085AE8EB
(, xrefs: 085AE77D
$Iq, xrefs: 085AB689
-, xrefs: 085ABE22
7, xrefs: 085AC355
, xrefs: 085ABD36
., xrefs: 085AEBBF
., xrefs: 085AECB3
-, xrefs: 085AEA0D
(, xrefs: 085AE773
k, xrefs: 085AEA03
., xrefs: 085AEACB

Memory Dump Source

Source File: 00000004.00000002.1347765290.00000000085A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_85a0000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID: $($($-$-$.$.$.$7$7$k$$Iq
API String ID: 0-124126898
Opcode ID: 805fd1893793c30de891b1fe01e4a71abc1f12d7312572cbf8e1abe55fcdf728
Instruction ID: f87bc9ffd588b9f41c08f17e077a6fee3bbb4c0a13d97862ba2efbdf138a1ed6
Opcode Fuzzy Hash: 805fd1893793c30de891b1fe01e4a71abc1f12d7312572cbf8e1abe55fcdf728
Instruction Fuzzy Hash: 24730534A107198FDB64EF28C894B9AB7B2FF89300F5045E9E549AB351DB71AE81CF41

Function 085AB658 Relevance: 18.3, Strings: 12, Instructions: 3288
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

7, xrefs: 085AE8EB
(, xrefs: 085AE77D
$Iq, xrefs: 085AB689
-, xrefs: 085ABE22
7, xrefs: 085AC355
, xrefs: 085ABD36
., xrefs: 085AEBBF
., xrefs: 085AECB3
-, xrefs: 085AEA0D
(, xrefs: 085AE773
k, xrefs: 085AEA03
., xrefs: 085AEACB

Memory Dump Source

Source File: 00000004.00000002.1347765290.00000000085A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_85a0000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID: $($($-$-$.$.$.$7$7$k$$Iq
API String ID: 0-124126898
Opcode ID: d7a2cbceca3ab3be2c85a11ae5cdd1631b5be3cbd8d183329c812e5359ec40ac
Instruction ID: a0082df26633bf40d83c2388310e956985f3e55391ffb02b95cba52aa1a4759b
Opcode Fuzzy Hash: d7a2cbceca3ab3be2c85a11ae5cdd1631b5be3cbd8d183329c812e5359ec40ac
Instruction Fuzzy Hash: 6E730534A107198FDB64EF28C894B9AB7B2FF89300F5045E9E449AB351DB71AE81CF41

Function 00F274C3 Relevance: 4.7, Strings: 3, Instructions: 944
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\sq, xrefs: 00F27726
LRq, xrefs: 00F28006
LRq, xrefs: 00F2755B

Memory Dump Source

Source File: 00000004.00000002.1339365444.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f20000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID: LRq$LRq$\sq
API String ID: 0-3677092283
Opcode ID: 623037530593fc054c7a81a9a441110ec1a4f0521629b021e929fdc77bcb8b57
Instruction ID: e97617e84f94f8622d9ae43b8e99b0ec26a43e00922bd2500fc70e0634f8c646
Opcode Fuzzy Hash: 623037530593fc054c7a81a9a441110ec1a4f0521629b021e929fdc77bcb8b57
Instruction Fuzzy Hash: 62827B75E042298FCB14DF69E884AAEBBF2FF88310F14C569D405EB255DB34AD45CB90

Function 00F2750A Relevance: 2.8, Strings: 2, Instructions: 313
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\sq, xrefs: 00F27726
LRq, xrefs: 00F2755B

Memory Dump Source

Source File: 00000004.00000002.1339365444.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f20000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID: LRq$\sq
API String ID: 0-576302416
Opcode ID: cafc0b5a1d4f65734c0fff7b9ab88e4fe9633108d5c5089e06aae40e96a9566a
Instruction ID: 29271aff1538264dc8f3fb3b0d7afe0d23c84fbf14b87dcf3ea62d34975579b4
Opcode Fuzzy Hash: cafc0b5a1d4f65734c0fff7b9ab88e4fe9633108d5c5089e06aae40e96a9566a
Instruction Fuzzy Hash: A0C16D35E143299FDB14DF79E885AAEBBF2BF88300F158629D405EB354DB34AD018B91

Function 00F28C52 Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

, xrefs: 00F28D7E

Memory Dump Source

Source File: 00000004.00000002.1339365444.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f20000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: f05c2a3e3ca22225ce75800851b814213b4340275b1debe41f5ce82a4815872e
Instruction ID: 88f8f29b358d266d96414aae4ad89cbd4d8ad2400e6d9dd49b2d60ac372bd658
Opcode Fuzzy Hash: f05c2a3e3ca22225ce75800851b814213b4340275b1debe41f5ce82a4815872e
Instruction Fuzzy Hash: 34518D71F001258FCB14DFA9E8846AEBBE2FBC8255B1486B9D519CB345DB30EC568B90

Function 00F28940 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1339365444.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f20000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 185c288b416da8a42a369a0efc8fcc6febf6a271ed2f24745628e4f37f37a3c9
Instruction ID: d752d60c80bd35e7f24f3cbbf1a277229a7f4e608492ae39697ad39b83d3bca5
Opcode Fuzzy Hash: 185c288b416da8a42a369a0efc8fcc6febf6a271ed2f24745628e4f37f37a3c9
Instruction Fuzzy Hash: 26818F32F112258FD714DB69D880B5EB7E3AFC8750F1A8165E409EB35ADE34EC429B90

Function 00F289E1 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1339365444.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f20000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bec4d42127897b7d44cfe66deff90b7ffc962fc6ab542fd763cb17a8f39be9ac
Instruction ID: 0d1c2dd460bfa0b719a71093b3a33d601ccc56a92e6bc0b02b207e9511efc423
Opcode Fuzzy Hash: bec4d42127897b7d44cfe66deff90b7ffc962fc6ab542fd763cb17a8f39be9ac
Instruction Fuzzy Hash: BC614C32F116248FD714DB69D880B9EB7E3AFC8710F1A8165E409AB359DE34EC429B90

Function 02A5696C Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1342597580.0000000002A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2a50000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6057a6bd13fa9b136cdadf49b544373bcbd74e25c110853a5091b4c9caff83ad
Instruction ID: e0ed121e3fc316096a4cd9f647e3900198988655e15a8bfd6e17319b78ce76b7
Opcode Fuzzy Hash: 6057a6bd13fa9b136cdadf49b544373bcbd74e25c110853a5091b4c9caff83ad
Instruction Fuzzy Hash: 4CA001668CE039A0944198106A140BBC1BD625B140A8570409C0B3202B9C308418890C

Function 00F2F9B3 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00F2FA3E
GetCurrentThread.KERNEL32 ref: 00F2FA7B
GetCurrentProcess.KERNEL32 ref: 00F2FAB8
GetCurrentThreadId.KERNEL32 ref: 00F2FB11

Memory Dump Source

Source File: 00000004.00000002.1339365444.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f20000_LisectAVT_2403002A_133.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 88d7df1690381a8350e5604bb180aee9c9fce226eac12c84c10ba8fb396b1f4c
Instruction ID: a57fe28151adf7db3731b319870b2f863e06ccfa8d519f4674263ec3d7f1f232
Opcode Fuzzy Hash: 88d7df1690381a8350e5604bb180aee9c9fce226eac12c84c10ba8fb396b1f4c
Instruction Fuzzy Hash: DB5153B1D107498FEB14CFA9D548BDEBBF1EF88304F2084A9E408AB2A1D7745948CF65

Function 00F2F9C0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00F2FA3E
GetCurrentThread.KERNEL32 ref: 00F2FA7B
GetCurrentProcess.KERNEL32 ref: 00F2FAB8
GetCurrentThreadId.KERNEL32 ref: 00F2FB11

Memory Dump Source

Source File: 00000004.00000002.1339365444.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f20000_LisectAVT_2403002A_133.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 74fdcf8ea7b9275fba0c0f94c9b5cca94571390694d6dcaa9c8a2797a5eaccc7
Instruction ID: 1c980220e5fe2395bf53f71df12ebfdc900119883ea2deb1b918921b9b23ec2c
Opcode Fuzzy Hash: 74fdcf8ea7b9275fba0c0f94c9b5cca94571390694d6dcaa9c8a2797a5eaccc7
Instruction Fuzzy Hash: 305143B1D107198FEB14CFA9D548B9EBBF1EF88314F208469E408AB391D7749984CF65

Function 085A1A28 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 253
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

|O, xrefs: 085A1CAA
|O, xrefs: 085A1CDD

Memory Dump Source

Source File: 00000004.00000002.1347765290.00000000085A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_85a0000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID: |O$|O
API String ID: 0-1286496762
Opcode ID: c4dfdb9b3306ccfd21c7e99398b4ea844cfc6ef800da059e6690e41774249c5f
Instruction ID: 8a3baa6a941382778d6a581ff02648866ff89f251bc199dc03ffd97d554ecb7f
Opcode Fuzzy Hash: c4dfdb9b3306ccfd21c7e99398b4ea844cfc6ef800da059e6690e41774249c5f
Instruction Fuzzy Hash: 81A16D35A40618CFCB14DFA8D594AADBBF1FF88311F2444A9D406AB391CB35AD41CFA1

Function 00F2D717 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 229
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00F2D97E

Strings

|O, xrefs: 00F2D8B6
|O, xrefs: 00F2D8DB

Memory Dump Source

Source File: 00000004.00000002.1339365444.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f20000_LisectAVT_2403002A_133.jbxd

Similarity

API ID: HandleModule
String ID: |O$|O
API String ID: 4139908857-1286496762
Opcode ID: 4df2a0993881d5aafb33ada6748fb90a4d1dd43bb8119ec3696b82fe984033b2
Instruction ID: 4a03260458d177083b6e4d716a3b2160a1edaaf0e2f24f4ce11180658e891b91
Opcode Fuzzy Hash: 4df2a0993881d5aafb33ada6748fb90a4d1dd43bb8119ec3696b82fe984033b2
Instruction Fuzzy Hash: B2917B70A00B148FD725CF29E44579ABBF1FF88310F04892EE486DBA51D739E846CB91

Function 02A53464 Relevance: 1.8, APIs: 1, Instructions: 270
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 02A536A6

Memory Dump Source

Source File: 00000004.00000002.1342597580.0000000002A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2a50000_LisectAVT_2403002A_133.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 2e2aeb4dd2ca3a949eec68230dc54d9b77a1e3814371d418ccc49d633c100f3f
Instruction ID: 45d914f628e9ebcee8db06ca8f90b1b03bf4987b1f66241325e6822d397bead1
Opcode Fuzzy Hash: 2e2aeb4dd2ca3a949eec68230dc54d9b77a1e3814371d418ccc49d633c100f3f
Instruction Fuzzy Hash: 32A15C71D00269DFEF14CF69C881BEEBBB2BF84354F1485AAE805A7240DB749985CF91

Function 02A53470 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 02A536A6

Memory Dump Source

Source File: 00000004.00000002.1342597580.0000000002A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2a50000_LisectAVT_2403002A_133.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 08b8d06d91fd898a7aa00b0ac8573e3e3228895e81c450a0008e8e4f24f935ca
Instruction ID: b550c62163b1ef55357facc476d2d0e26f9a917df584de61b0ffd5630a02cbe6
Opcode Fuzzy Hash: 08b8d06d91fd898a7aa00b0ac8573e3e3228895e81c450a0008e8e4f24f935ca
Instruction Fuzzy Hash: 58914C71D00269DFEF14CF69C881BEEBBB2BF44354F1485A9E809A7240DB749985CF91

Function 00F2FCC8 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00F2FC8F

Memory Dump Source

Source File: 00000004.00000002.1339365444.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f20000_LisectAVT_2403002A_133.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ac08c9002b6a2405983b226daf2da7b6e85c320249a5d636059c776d675d414d
Instruction ID: d7dc7002b8ef244d443c1884dabf5d5bdea964fcbcc8ffd224177e938d0b0c2f
Opcode Fuzzy Hash: ac08c9002b6a2405983b226daf2da7b6e85c320249a5d636059c776d675d414d
Instruction Fuzzy Hash: 3641AB74A903889FEB01DF71E844BA97BB9FB89351F108829E951DB3D5CB744902EF21

Function 00F258EC Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00F259A9

Memory Dump Source

Source File: 00000004.00000002.1339365444.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f20000_LisectAVT_2403002A_133.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 948a3cdf4fca7b001d37b94e1883e19c78aefc719c0fa8bf8b4dfa6da85acab8
Instruction ID: 27b901e0ee4cc86b2867c5704ee6c9968b5a5ed0793e721fbc571df56362845a
Opcode Fuzzy Hash: 948a3cdf4fca7b001d37b94e1883e19c78aefc719c0fa8bf8b4dfa6da85acab8
Instruction Fuzzy Hash: FD41F4B1C00729CFEB25CFA9C885B8EBBB5BF49704F20805AD408AB251D7756945CF50

Function 00F2FB90 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1339365444.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f20000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d496876c4faf3f8c4145beacffc6252a618fc1d8d040e38da0c6a40ed3a55ce
Instruction ID: efcbde33284e511fd14cb625079dfc14c7d544a4050c2754aa3ebc7e0888a5e6
Opcode Fuzzy Hash: 2d496876c4faf3f8c4145beacffc6252a618fc1d8d040e38da0c6a40ed3a55ce
Instruction Fuzzy Hash: A131B175A002199FCB05CF58D844EDEBBF5FF89310F2481A9E905AB362D6319845CFA1

Function 00F244B4 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00F259A9

Memory Dump Source

Source File: 00000004.00000002.1339365444.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f20000_LisectAVT_2403002A_133.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 7e99bd4bbf091c86a341ddaf8bc6720226063406eabdb3cda47d44d37f28090f
Instruction ID: ab6d86664014c0fcd3ef9c6bf73ef17da60ea9e41de72f7240fefa3c2defab9d
Opcode Fuzzy Hash: 7e99bd4bbf091c86a341ddaf8bc6720226063406eabdb3cda47d44d37f28090f
Instruction Fuzzy Hash: 3141E271C0072DCFEB24DFA9C884B9EBBB5BF49704F60816AD408AB251DB756946CF90

Function 02A531E0 Relevance: 1.6, APIs: 1, Instructions: 75injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 02A53278

Memory Dump Source

Source File: 00000004.00000002.1342597580.0000000002A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2a50000_LisectAVT_2403002A_133.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 2ac40bfab17799347ccf8cc4a3a3308fc1f777a6422f0c388cd94b2788d34659
Instruction ID: 03244eaf471e2aa95cf3027f86b7d53de2c94c351f6f178e12fe04dec1670c4b
Opcode Fuzzy Hash: 2ac40bfab17799347ccf8cc4a3a3308fc1f777a6422f0c388cd94b2788d34659
Instruction Fuzzy Hash: A92106769003599FDB10CFA9C985BEEBBF5FF48310F10842AE958A7640CB789944CBA5

Function 02A531E8 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 02A53278

Memory Dump Source

Source File: 00000004.00000002.1342597580.0000000002A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2a50000_LisectAVT_2403002A_133.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: d16b68232de165369c83654519bb2ac09d9229b62c6d4fb9a9e5343593674070
Instruction ID: 1ea16bb4499c0db71645ad7e611d21ea9ec53c47d9993709cc5cd537ee038900
Opcode Fuzzy Hash: d16b68232de165369c83654519bb2ac09d9229b62c6d4fb9a9e5343593674070
Instruction Fuzzy Hash: D02126759003599FDF10CFAAC984BEEBBF5FF48310F10842AE918A7240CB789944CBA5

Function 02A532D1 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 02A53358

Memory Dump Source

Source File: 00000004.00000002.1342597580.0000000002A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2a50000_LisectAVT_2403002A_133.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 1e7deb6d050b2fab4303ea2af39201174723431953e1219f0f840317a1dc8ece
Instruction ID: 33ec7efd94705493f2162955fe0713027262c383a1f77229994e34a363d12ea7
Opcode Fuzzy Hash: 1e7deb6d050b2fab4303ea2af39201174723431953e1219f0f840317a1dc8ece
Instruction Fuzzy Hash: F4213971C003599FDB10CFAAC940BEEBBF5FF48320F10842AE918A7640CB389504DBA5

Function 02A527D8 Relevance: 1.6, APIs: 1, Instructions: 66threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 02A5285E

Memory Dump Source

Source File: 00000004.00000002.1342597580.0000000002A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2a50000_LisectAVT_2403002A_133.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 16cb6b884f4b4a7f8fe4801402c618ed1d44fb27649ac1c2f9b12062c2dd8693
Instruction ID: 3667f4bf53a4142ab727021cdf83762cfe168c0eb017b4eeb297b1229aabd9b6
Opcode Fuzzy Hash: 16cb6b884f4b4a7f8fe4801402c618ed1d44fb27649ac1c2f9b12062c2dd8693
Instruction Fuzzy Hash: 5E214571D003088FDB14CFAAC5857EEBBF4EF48224F14842AD959A7640CB78A945CBA5

Function 00F2FC00 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00F2FC8F

Memory Dump Source

Source File: 00000004.00000002.1339365444.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f20000_LisectAVT_2403002A_133.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 28e19cf4558eb2030bf40479a3e8eeb56fe862116ca32ac2c3955cb41ac1a8c9
Instruction ID: b403abb66d8c57cdac5299efe5b85cdc0a0468db805131f15cd3f1a723a2d2fb
Opcode Fuzzy Hash: 28e19cf4558eb2030bf40479a3e8eeb56fe862116ca32ac2c3955cb41ac1a8c9
Instruction Fuzzy Hash: 362103B5D00248EFDB10CFAAD984ADEBBF5FB48310F14841AE958A7750C378AA44CF60

Function 02A532D8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 02A53358

Memory Dump Source

Source File: 00000004.00000002.1342597580.0000000002A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2a50000_LisectAVT_2403002A_133.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: d740ab1ef1ef4326b9b7f63a3315b54e421b80fc472ba7511e6e4fa3a675215b
Instruction ID: 1766102464e91f3eb2df0e37bdb8d4f8bf3feebd24706c7a800eb05ce2829de2
Opcode Fuzzy Hash: d740ab1ef1ef4326b9b7f63a3315b54e421b80fc472ba7511e6e4fa3a675215b
Instruction Fuzzy Hash: BC212871D003599FDB10CFAAC984BEEBBF5FF48310F10842AE918A7640CB399904DBA5

Function 02A527E0 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 02A5285E

Memory Dump Source

Source File: 00000004.00000002.1342597580.0000000002A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2a50000_LisectAVT_2403002A_133.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: c32384cc4933467dc763ea10386d0af04edf1a507257da34eda496e6c154b36b
Instruction ID: b5e78b38fa60e5a5e1a32c16b96bfa91336995db0b1dab2fdf80872e5bba2288
Opcode Fuzzy Hash: c32384cc4933467dc763ea10386d0af04edf1a507257da34eda496e6c154b36b
Instruction Fuzzy Hash: B3213471D003088FDB14CFAAC584BEEBBF4EF48214F14842AD959A7640CB78A945CBA5

Function 00F2FC08 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00F2FC8F

Memory Dump Source

Source File: 00000004.00000002.1339365444.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f20000_LisectAVT_2403002A_133.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 688c1d0fcf71789fb264ae0703c5f77c5d810e6d63e97c0bd5a02d670c72eaa9
Instruction ID: d592ce7beef0735eca6e4e6f0864fc128587c1d950906351793456f0dbfef310
Opcode Fuzzy Hash: 688c1d0fcf71789fb264ae0703c5f77c5d810e6d63e97c0bd5a02d670c72eaa9
Instruction Fuzzy Hash: D221E4B5D00248EFDB10CF9AD984ADEBBF4FB48310F14842AE954A7350D378AA44CF65

Function 02A53120 Relevance: 1.6, APIs: 1, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 02A53196

Memory Dump Source

Source File: 00000004.00000002.1342597580.0000000002A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2a50000_LisectAVT_2403002A_133.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bb1cf797caaeabb344b0725ef5a0915cc18421fcbac4c9d1426a982844e0cc5b
Instruction ID: 27d700b1f2dbbeb709ef98c1c7a5d2d2aa53a4ca2cd182573ee724ec95b95082
Opcode Fuzzy Hash: bb1cf797caaeabb344b0725ef5a0915cc18421fcbac4c9d1426a982844e0cc5b
Instruction Fuzzy Hash: E71156769002089FDF20CFAAC845BEFBBF5FB88320F10841AE915A7A50CB359540CBA1

Function 00F2D128 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,00F2D9F9,00000800,00000000,00000000), ref: 00F2DC0A

Memory Dump Source

Source File: 00000004.00000002.1339365444.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f20000_LisectAVT_2403002A_133.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 763861cad2f9c723887f6006e6035dc506416879dce5fd9d5e4eaec6bfe03735
Instruction ID: ee08d9d2a7759658ed9d177de84bf793ac66aa8f7e1b41b2c0507ed5395b88ec
Opcode Fuzzy Hash: 763861cad2f9c723887f6006e6035dc506416879dce5fd9d5e4eaec6bfe03735
Instruction Fuzzy Hash: 991117B6D003189FDB20CF9AD544BDEFBF4EB88310F10841AE519A7600C375A945CFA5

Function 02A52728 Relevance: 1.6, APIs: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 02A52792

Memory Dump Source

Source File: 00000004.00000002.1342597580.0000000002A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2a50000_LisectAVT_2403002A_133.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 90ba0d06f217e51611b59473674567065ee4af9c47c65e8fd1383c19b9927230
Instruction ID: 7b848aecbf7d7da5765d4b6f04d8db096ab4b8d03dd6c91121bb524bd732b05b
Opcode Fuzzy Hash: 90ba0d06f217e51611b59473674567065ee4af9c47c65e8fd1383c19b9927230
Instruction Fuzzy Hash: 03113775900348CFDB24DFAAD4457EFFBF4EF48224F20841AD555A7A40CB39A940CB95

Function 00F2DB9B Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,00F2D9F9,00000800,00000000,00000000), ref: 00F2DC0A

Memory Dump Source

Source File: 00000004.00000002.1339365444.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f20000_LisectAVT_2403002A_133.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3e2928e8fc5fe2a4dc43d8004a6ec0a274cbe33eb6e217752f7c44f8505de5dd
Instruction ID: 7ccc9336c44b990e77ec417c813c3d26d831e38fdefeb8a642c23a7964fc0517
Opcode Fuzzy Hash: 3e2928e8fc5fe2a4dc43d8004a6ec0a274cbe33eb6e217752f7c44f8505de5dd
Instruction Fuzzy Hash: 801103B6D002088FDB14CF9AD544ADEFBF4EB88310F14841AD419A7600C375A945CFA4

Function 02A53128 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 02A53196

Memory Dump Source

Source File: 00000004.00000002.1342597580.0000000002A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2a50000_LisectAVT_2403002A_133.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c34b05d07665c23e79e4e8d15ba77ab061af58995964c167d5d21534ecd3ab50
Instruction ID: 735021b6a1a1755c903e72238dd0d3fa4916109c6f07fa9f2526e51dd4a5ed7e
Opcode Fuzzy Hash: c34b05d07665c23e79e4e8d15ba77ab061af58995964c167d5d21534ecd3ab50
Instruction Fuzzy Hash: AB1144729002489FDF20DFAAC844BDFBBF5FB88310F148419E915A7650CB359904CBA0

Function 02A52730 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 02A52792

Memory Dump Source

Source File: 00000004.00000002.1342597580.0000000002A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2a50000_LisectAVT_2403002A_133.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: dc176c18a8a35355ae633e6b8ae4120ed8233d5631f0df3b5dab1fe3fbee50ad
Instruction ID: 86e97760ccae399315764a7a39783d869df366448ce0bdba6bb8dd9852248e9d
Opcode Fuzzy Hash: dc176c18a8a35355ae633e6b8ae4120ed8233d5631f0df3b5dab1fe3fbee50ad
Instruction Fuzzy Hash: B9112875D003488FDB24DFAAC5447DFFBF4EF48224F248419D519A7640CB79A944CB95

Function 00F2D918 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00F2D97E

Memory Dump Source

Source File: 00000004.00000002.1339365444.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f20000_LisectAVT_2403002A_133.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d55f81a50032857457d120d5933be07f456f8627212517110d2f306c4f3405ce
Instruction ID: d70a79ebe29d87d2082b224ad9fc95940d055f54ae549df209631c463d0913c1
Opcode Fuzzy Hash: d55f81a50032857457d120d5933be07f456f8627212517110d2f306c4f3405ce
Instruction Fuzzy Hash: 75110FB6C002498FDB20CF9AD444ADEFBF4EB88324F10841AE458A7600C379A545CFA5

Function 02A547F8 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 02A57815

Memory Dump Source

Source File: 00000004.00000002.1342597580.0000000002A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2a50000_LisectAVT_2403002A_133.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 8e8808f8c84182e22c4283b9220dffc9148d2bc38f5c172326de74171d347cd9
Instruction ID: 08d8e084b74653715e3e0623acfb607abfee635ac5a21068d0b7aa79d07b1553
Opcode Fuzzy Hash: 8e8808f8c84182e22c4283b9220dffc9148d2bc38f5c172326de74171d347cd9
Instruction Fuzzy Hash: 1D11E3B5800258DFDB20DF9AD984BDFFBF8EB48314F108459E958A7610D375A944CFA1

Function 02A577B1 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 02A57815

Memory Dump Source

Source File: 00000004.00000002.1342597580.0000000002A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2a50000_LisectAVT_2403002A_133.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 710841e903293e3d5d2b616b0a7d2bffff06a6537d79f6d5f967ba8ec22d9940
Instruction ID: a7e5be89c35e58861bc69417112ffa6cc54dd8f03dcf58278e599d9c627a5896
Opcode Fuzzy Hash: 710841e903293e3d5d2b616b0a7d2bffff06a6537d79f6d5f967ba8ec22d9940
Instruction Fuzzy Hash: 8311E3B58002499FDB20CF9AD985BDEFBF8EB48324F10845AE954A7610D375A984CFA1

Function 00E2D528 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1338088003.0000000000E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e2d000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f67e9dcdd445103e9e4c6c8930cde1891ec1ee6f6a79ef27758335acfaea09b
Instruction ID: dc0478e665e55040c25941be4808106f40ac86bcb4a9ce1c19165e1ec9f8b8d9
Opcode Fuzzy Hash: 1f67e9dcdd445103e9e4c6c8930cde1891ec1ee6f6a79ef27758335acfaea09b
Instruction Fuzzy Hash: 6E214872548240DFDB15DF14EDC0B26BF65FB94318F20856DEA0A1F256C376D846CAA2

Function 00E3D294 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1338268340.0000000000E3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e3d000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29536fca373fc8937c3a2ee4122e8e0ee7f27f06f93113b72a364eb6e0df1c47
Instruction ID: e2700f5efa0ad2b2611b03ef263632e13b779a60cd094ecc5e42668da40f41e5
Opcode Fuzzy Hash: 29536fca373fc8937c3a2ee4122e8e0ee7f27f06f93113b72a364eb6e0df1c47
Instruction Fuzzy Hash: 2A21F571508204EFDB15DF24E9C8B26BFA5FB84318F24C56DE8095B292C33ADC46CA62

Function 00E3D0DC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1338268340.0000000000E3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e3d000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2716643b0db1b1511c224178eb1d512c15fc9bc8bc5903e19581fba6539cec31
Instruction ID: 60e250aabb29dda061c3125e6ff1ea15ee1d48f3ef8f1b3c7d2ed4bbcebe68a8
Opcode Fuzzy Hash: 2716643b0db1b1511c224178eb1d512c15fc9bc8bc5903e19581fba6539cec31
Instruction Fuzzy Hash: 5221D3B1508304EFDB14DF14E988B26BF65FB84318F20C56DE9095B296C336D846CA62

Function 00E2D523 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1338088003.0000000000E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e2d000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d9143a8ff6c40554208124bd87d7ebbaad978752f52efe449982275cc027c51
Instruction ID: 688d621927336ae003a47e5c64798332487f4175933d70ffbed0723f3b81d0f1
Opcode Fuzzy Hash: 0d9143a8ff6c40554208124bd87d7ebbaad978752f52efe449982275cc027c51
Instruction Fuzzy Hash: 1211D376508280DFCB16CF10E9C4B16BF71FB94318F24C5A9D9090B656C336D856CBA2

Function 00E3D28F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1338268340.0000000000E3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e3d000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e088ad8a07711d9d3566a887b1f888bc4d4e2f61ff705deeaaa2a632ac83149
Instruction ID: 63f345318f409008b9452085355864717a113cf42739b31093ce0adc36116e74
Opcode Fuzzy Hash: 9e088ad8a07711d9d3566a887b1f888bc4d4e2f61ff705deeaaa2a632ac83149
Instruction Fuzzy Hash: C5119D75508280DFDB16CF10E9C4B15FFB1FB84318F24C6A9D8494B696C33AD84ACB62

Non-executed Functions

Function 00F271A0 Relevance: 1.5, Strings: 1, Instructions: 204COMMON

Download Yara Rule

Strings

\sq, xrefs: 00F2731E

Memory Dump Source

Source File: 00000004.00000002.1339365444.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f20000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID: \sq
API String ID: 0-1116441132
Opcode ID: f436ebf513e40a5d08d378c25d68880b99aaeb792a01509db65d24fbffa9c9e1
Instruction ID: aea2d0ede771468999cfb963989323e7645d06ecff89cf3b05dfcb2127d5d5f1
Opcode Fuzzy Hash: f436ebf513e40a5d08d378c25d68880b99aaeb792a01509db65d24fbffa9c9e1
Instruction Fuzzy Hash: A5710778D4021ADFDF14DFAAE484AADBBB1FF48310F10A659D406EB291DB31AA41CF50

Function 02A58C18 Relevance: .4, Instructions: 366COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1342597580.0000000002A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2a50000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d94e7bece75328f8e4a1166925027fa51bc0f276d1141570b71f9e9f291c6a6
Instruction ID: 8089a51053be30385ebcae20cdde81899b57be88ad22469dfe74c42b130c0890
Opcode Fuzzy Hash: 2d94e7bece75328f8e4a1166925027fa51bc0f276d1141570b71f9e9f291c6a6
Instruction Fuzzy Hash: 1AD188317017208FDB29DB65D8507AFB6F7AF88704F14446EE9468B295CF38E845CB92

Function 02A51F08 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1342597580.0000000002A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2a50000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 267751bba518a406aa9b8ae32f142aa2a4605cfcc9e8030733c5d46c228c87b9
Instruction ID: 5fbf24fec581c0f7a0c7554da13e2f798e99f372307aa9065bc77dd51a0a6b8a
Opcode Fuzzy Hash: 267751bba518a406aa9b8ae32f142aa2a4605cfcc9e8030733c5d46c228c87b9
Instruction Fuzzy Hash: CEE1DA74E002198FDB14DFA9C580AAEFBB2FF89305F248169D815AB356DB719D41CFA0

Function 02A528B8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1342597580.0000000002A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2a50000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a63a422855b9d9a689440d4ea91923d73ed814cf193fced4d908ae58c2037f18
Instruction ID: 868122324227866b4ccd81e9613308dfbe0da8908272e4130036da5388c16028
Opcode Fuzzy Hash: a63a422855b9d9a689440d4ea91923d73ed814cf193fced4d908ae58c2037f18
Instruction Fuzzy Hash: CEE1EB74E002198FDB14DFA9C580AAEFBB2FF89305F248169D915AB356DB319D41CFA0

Function 02A52CF0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1342597580.0000000002A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2a50000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 448c49d32f474ace8dbb0c018696439fca0f2a734bc1c0a1a3b486e285b08a06
Instruction ID: 141fe15cf0fa7481c7b0da33fee31a636feaad3edf9dd9f5f89bdfd69ec22731
Opcode Fuzzy Hash: 448c49d32f474ace8dbb0c018696439fca0f2a734bc1c0a1a3b486e285b08a06
Instruction Fuzzy Hash: 2EE1EA74E102198FDB14DFA9C580AAEFBB2FF89305F24816AD815AB356DB319D41CF60

Function 02A50830 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1342597580.0000000002A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2a50000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18b2221e517db0148dbe70ae30bdad8c180dd4fe856c3bbd552f59d15f9b5e25
Instruction ID: fd0c53857353a8077c0ed2f971a290ba66fc03274639b851392e8ce877e1637e
Opcode Fuzzy Hash: 18b2221e517db0148dbe70ae30bdad8c180dd4fe856c3bbd552f59d15f9b5e25
Instruction Fuzzy Hash: C7E1FB74E002198FDB14DFA9C580AAEFBB2FF89305F248169D815AB356DB31AD41CF60

Function 02A50C68 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1342597580.0000000002A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2a50000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 850c54da4723eb7fb59b9c4f124d45ebd013324f0cb01231c2fdede6e29ee33c
Instruction ID: ec67fa8d8c64a15f758645b4aee8fb019b783408c0db923db544e9f8278978ea
Opcode Fuzzy Hash: 850c54da4723eb7fb59b9c4f124d45ebd013324f0cb01231c2fdede6e29ee33c
Instruction Fuzzy Hash: F4E1FD74E102198FDB14DFA9C580AAEFBB2FF89305F248159D815AB356DB31AD41CFA0

Function 02A51EF7 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1342597580.0000000002A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2a50000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bea8e576e3f5a8207a112c356520b136259745eef53982f2ab51c6ac0d88426
Instruction ID: 1a96fbfd1205b0fd5670bf3052949ae3530635d5e240336717c8a065a4d8e7a8
Opcode Fuzzy Hash: 1bea8e576e3f5a8207a112c356520b136259745eef53982f2ab51c6ac0d88426
Instruction Fuzzy Hash: 98510E74E042198FDB14DFA9C5806AEFBF2BF89304F24816AD858A7356DB319D41CFA1

Function 02A528A7 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1342597580.0000000002A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2a50000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31bcf5cf20d160271ac5625792aca7813f74a01af85ea8a642f0603d773098df
Instruction ID: f3a099f20871b2bea1ce6e611cf04a281dc5c3673795b5dd5a08db411763190c
Opcode Fuzzy Hash: 31bcf5cf20d160271ac5625792aca7813f74a01af85ea8a642f0603d773098df
Instruction Fuzzy Hash: BF510E74E042198FDB14DFA9C5806AFFBF2BF89304F24816AD818A7356DB319941CFA1

Function 02A52CE1 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1342597580.0000000002A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2a50000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 076d5620f447d857a9a3d3f970e32dca9d9c32fa0e39e3897e0089d73162cd8f
Instruction ID: 5d843951b4dcca9bb33984c3ecb50e57462db8eb2a3e32c87720a0ad70496a66
Opcode Fuzzy Hash: 076d5620f447d857a9a3d3f970e32dca9d9c32fa0e39e3897e0089d73162cd8f
Instruction Fuzzy Hash: E9510D75E002198FDB14DFA9C5806AEFBF2BF89305F24816AD818A7356DB319D41CFA1

Function 00F27989 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1339365444.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f20000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4753feaf8d9d5300fccd81252c24e6e4fb228acc0bdc6ce006651e3652b2a1cf
Instruction ID: d4240e385e380e327d12137caf45e56d50757cd53513827a996c954d9f824e55
Opcode Fuzzy Hash: 4753feaf8d9d5300fccd81252c24e6e4fb228acc0bdc6ce006651e3652b2a1cf
Instruction Fuzzy Hash: 50413679E5121E9FCF14CFA9E885AAEB7F2BF48310B14E215D006EB255DB39A905CB40

Analysis Process: LisectAVT_2403002A_133.exePID: 7320, Parent PID: 1088COMMON

Execution Graph

Execution Coverage:	12.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	17
Total number of Limit Nodes:	4

Executed Functions

Function 06E43038 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06E4370E
$q, xrefs: 06E4375B
$q, xrefs: 06E43743
$q, xrefs: 06E43767
$q, xrefs: 06E43737
$q, xrefs: 06E4371A

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q
API String ID: 0-2069967915
Opcode ID: d2db46c55d96b47cfed1f96e8c7808b3eaa191217563b3ae50c14d5be8265b5d
Instruction ID: 514ecfbf81f644c0c9b50125ce7b09254367f295ea8f985cdb31296e1a1190af
Opcode Fuzzy Hash: d2db46c55d96b47cfed1f96e8c7808b3eaa191217563b3ae50c14d5be8265b5d
Instruction Fuzzy Hash: C6322D30E10719CBDB14EF79D85469DF7B2FF99300F2096AAD449AB254EB30AD85CB80

Function 06E47D78 Relevance: 3.0, Strings: 2, Instructions: 475
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06E4831F
$q, xrefs: 06E48313

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: 41e3421815b240f80ee7fed8e69bea5a129cb37d09b745ac05c43fdb5e9b5852
Instruction ID: 33a91e43cbef6939994bb115dfcc423fdb3a163ef2b2c198423b65ac52c2fba0
Opcode Fuzzy Hash: 41e3421815b240f80ee7fed8e69bea5a129cb37d09b745ac05c43fdb5e9b5852
Instruction Fuzzy Hash: 85028C30B003058FDB58EB79E454BAEB7A2FF88314F149929D9059B354EB35EC82CB90

Function 06E45580 Relevance: 1.9, Strings: 1, Instructions: 605COMMON

Download Yara Rule

Strings

$, xrefs: 06E45C82

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: f382595259513ab33fd841c151a0828a4d275bca45e1445a1a019d8cb69742bd
Instruction ID: 3eb11d9e725e6878dd0fcb121eb53018828068e72b44340ebf8a554f8796e15b
Opcode Fuzzy Hash: f382595259513ab33fd841c151a0828a4d275bca45e1445a1a019d8cb69742bd
Instruction Fuzzy Hash: E622A135E003148FDF64EB75E4907AEBBB2EF89324F24856AD815AB354DA35DC41CB90

Function 06E42340 Relevance: 1.0, Instructions: 998COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04da6e8f9627ddc491ae305dd91f570871ea9188bc5f77a156490023df5935dc
Instruction ID: b3598f7073b6a345ea74e50c28733e97ee1dbd42cd398b17d9bf0f2e62266966
Opcode Fuzzy Hash: 04da6e8f9627ddc491ae305dd91f570871ea9188bc5f77a156490023df5935dc
Instruction Fuzzy Hash: B2926630E003048FDB64EF68D584A5DBBF2EF89318F5494A9E509AB365DB35ED81CB80

Function 06E465E0 Relevance: .8, Instructions: 818COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 762036a8f27c763dd328083a9b5c74d15f7c4dbc32c76ca9ad7da2a8812bd725
Instruction ID: 084e3c4970d37ac7de4aeac1c9c8ee6ed0f61ef94296ae3354ef25eaad3c5780
Opcode Fuzzy Hash: 762036a8f27c763dd328083a9b5c74d15f7c4dbc32c76ca9ad7da2a8812bd725
Instruction Fuzzy Hash: 61626C34A003048FDB64EF79E594AADB7F2EF89314F249469E5069B394DB35EC85CB80

Function 06E4C178 Relevance: .6, Instructions: 642COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e60fbd17133a18fc508a76e85619976e9f7f4dc1bf8dd0addb68ee6492bbfec
Instruction ID: 5bdc848073fa8fa5dafa0a6ebde0d5161ac7a7d4275d1ea2fa6680693a3d4c19
Opcode Fuzzy Hash: 0e60fbd17133a18fc508a76e85619976e9f7f4dc1bf8dd0addb68ee6492bbfec
Instruction Fuzzy Hash: 72329F34A012048FDB54EF79E884BADB7B2FB88714F209525E405DB395DB35EC86CB91

Function 06E4B21F Relevance: .6, Instructions: 575COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa09540ec96cf7cdaeeea3c45b4a0820752ade6e6645b1f41802dfe069e10c93
Instruction ID: 9e9c6646bec917d1bf81f457dd5d6afc49f3d15596641c9effdf75ea320b792c
Opcode Fuzzy Hash: aa09540ec96cf7cdaeeea3c45b4a0820752ade6e6645b1f41802dfe069e10c93
Instruction Fuzzy Hash: 89226130E103098BEF64EF69E4847AEB7B6FB49314F249826E405DB395DA39DC81CB51

Function 06E4B638 Relevance: 8.0, Strings: 6, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06E4BC05
$q, xrefs: 06E4BBC5
$q, xrefs: 06E4BBF9
$q, xrefs: 06E4BB9D
$q, xrefs: 06E4BB91
$q, xrefs: 06E4BBD1

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q
API String ID: 0-2069967915
Opcode ID: 5c6a7cd139b0c9058abcfa5cc91bca51aa47aec33a8076857bdd1c02aaa9302f
Instruction ID: c6f667c661c7c37c9e1c953637e4451f02caf0cde8638f34b630b4213014e615
Opcode Fuzzy Hash: 5c6a7cd139b0c9058abcfa5cc91bca51aa47aec33a8076857bdd1c02aaa9302f
Instruction Fuzzy Hash: 01026930E103098FDBA4EF69E4847ADB7B2FB89314F24996AE405DB255DB35DC81CB81

Function 06E49148 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06E491FF
$q, xrefs: 06E491C4
$q, xrefs: 06E491F3
$q, xrefs: 06E491B8

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: f2d1e439329666a13d96b266d50d418f2f53f1f4fd8e1b1e4172be5078045ed2
Instruction ID: 5a96ee965f32db07e3857a9b7c724c375708dad774ccc3b758e0de370edaae35
Opcode Fuzzy Hash: f2d1e439329666a13d96b266d50d418f2f53f1f4fd8e1b1e4172be5078045ed2
Instruction Fuzzy Hash: 50916C30B003198BDB94DF79D9507AEB7B2FF89340F108569D909AB349EE34DD868B91

Function 06E4CF40 Relevance: 4.6, Strings: 3, Instructions: 800
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06E4D33F
$q, xrefs: 06E4D337
$q, xrefs: 06E4D34B

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID: $q$$q$$q
API String ID: 0-3067366958
Opcode ID: 65490b597917f43dd76b853ac941a469f043ea664c624b127a56beb629585da8
Instruction ID: 08dc32b40fe5588fd1dca61ab04aaaea72c0957c5932e9ff3300ab124be4a740
Opcode Fuzzy Hash: 65490b597917f43dd76b853ac941a469f043ea664c624b127a56beb629585da8
Instruction Fuzzy Hash: D4626034A003058FDB55EF79E990A9DB7B2FF88304B248A69D0059F359DB75EC86CB81

Function 0159EB40 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

V, xrefs: 0159EB14

Memory Dump Source

Source File: 00000012.00000002.2525930435.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1590000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID: V
API String ID: 0-1342839628
Opcode ID: a1f1d2399e0416073a3146593e7b56ab425e847cc38d47e96b3bbb8de63318fd
Instruction ID: faadfc3fb5d0873c5cd82863fc0831ca11cdee6d2859a8146185e6e690fba639
Opcode Fuzzy Hash: a1f1d2399e0416073a3146593e7b56ab425e847cc38d47e96b3bbb8de63318fd
Instruction Fuzzy Hash: E4512172E043998FDB14DFA9D8043DEBBF2FF89210F15856BD449AB241DB389845CBA1

Function 06E49137 Relevance: 2.7, Strings: 2, Instructions: 178
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06E491F3
$q, xrefs: 06E491B8

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: 00a100e97f2347455c1221a67f9cb3f7be222c8bb7aa08fcd5eeb3fd78018a9e
Instruction ID: 4dbfcea7e09124e6bf7ccd1dbeadb78063923cb5a42499341eb45047a2373c9d
Opcode Fuzzy Hash: 00a100e97f2347455c1221a67f9cb3f7be222c8bb7aa08fcd5eeb3fd78018a9e
Instruction Fuzzy Hash: 80518F30B003049FDB94DF79E990B6EB7E2EF89340F109469D909AB349EE34DD428B91

Function 0159EC28 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0159EC8F

Memory Dump Source

Source File: 00000012.00000002.2525930435.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1590000_LisectAVT_2403002A_133.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 1b4bb35dd78f5a710075584379bce26a2f65a860bee41d9273fd133bd89e4ce6
Instruction ID: 082609d85c478e6be853cd3bc47f649712b4cefa3d2913a460236106efa26d3a
Opcode Fuzzy Hash: 1b4bb35dd78f5a710075584379bce26a2f65a860bee41d9273fd133bd89e4ce6
Instruction Fuzzy Hash: 87111FB2C006599FDB10CF9AC445BDEFBF4FB48320F11812AE858A7240D378A940CFA5

Function 06E4DAB5 Relevance: 1.4, Strings: 1, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 06E4DC11

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID: PHq
API String ID: 0-3820536768
Opcode ID: 2dee82e9a944c3b2cd31bf7022eacb2fdb728128362257b80446d8d80622e6f8
Instruction ID: 0f9bfa004e9b3e41081dd435d7b470030b78a6b5f12dfdab22aba0400a9ae672
Opcode Fuzzy Hash: 2dee82e9a944c3b2cd31bf7022eacb2fdb728128362257b80446d8d80622e6f8
Instruction Fuzzy Hash: F7416E70E003099FDB64EF75E85469EBBB2FF85304F20492AE406EB244DB75E846CB91

Function 06E421C8 Relevance: 1.4, Strings: 1, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 06E42303

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID: PHq
API String ID: 0-3820536768
Opcode ID: 1accab90d8f5a82525148fb0bb24917179f56a557e91f67d20d270d64c4037a1
Instruction ID: e39a28798f4aa66ec780aafbacd59697d84401e430af443dee42880afcf4738e
Opcode Fuzzy Hash: 1accab90d8f5a82525148fb0bb24917179f56a557e91f67d20d270d64c4037a1
Instruction Fuzzy Hash: BE31C130B003058FDB54AB75E4147AE7BA3AF89604B248528E502DB398DF35DD46CB99

Function 06E482EE Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

$q, xrefs: 06E48313

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID: $q
API String ID: 0-1301096350
Opcode ID: abe81315a4f615dab3e1a6e72a60736476b4cd8836a43bc348aedcb30effc413
Instruction ID: b6ec5b02772841d49a0e4be55f7207e7286a4a94983fb9cc0c8e60ddd5f4c9e0
Opcode Fuzzy Hash: abe81315a4f615dab3e1a6e72a60736476b4cd8836a43bc348aedcb30effc413
Instruction Fuzzy Hash: A6F0E535F04301CFEF686966F9483BA7364EB40258F1460A2CD00C7100D775ED44C691

Function 06E461D8 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0ea6d8b3a099cc8482675b621ed459b842af3bd2965cb2dd189752e1f881661
Instruction ID: 635cc2df9d6d53ab6e6cb52d2c83c7e207f09cf0e73e1591e41845d62aa93609
Opcode Fuzzy Hash: f0ea6d8b3a099cc8482675b621ed459b842af3bd2965cb2dd189752e1f881661
Instruction Fuzzy Hash: FC61E171F002214BDF54AA7ED8806AEBBE7AFC5220B154439D80EDB324DE75DD0287D5

Function 06E44278 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b3a32a777b1f76f22dcbc0903968da8ff3091085abcdeb8403df90176c1b101
Instruction ID: bcfebc323cbf765de5196907abe10c553b14d34210585476bbc8b78fdda8975f
Opcode Fuzzy Hash: 2b3a32a777b1f76f22dcbc0903968da8ff3091085abcdeb8403df90176c1b101
Instruction Fuzzy Hash: 9B811C74B003098BDF54EFB9D4547AEBBE2EF89304F149529D409EB398EA35DC428791

Function 06E44598 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8c7c1e64611d62d6c3b2e8d28cca2bf6e5ee46fd6e9e8dd0f989789054d5485
Instruction ID: 3bffe98fce5ce42927ed80fbf80287bab996fe9bea1ed70c6c0e403f994a2562
Opcode Fuzzy Hash: b8c7c1e64611d62d6c3b2e8d28cca2bf6e5ee46fd6e9e8dd0f989789054d5485
Instruction Fuzzy Hash: 1B914D30E10319CBDF60DF68C890B9DB7B1FF89314F208699D549AB295DB70AA85CF91

Function 06E4AF18 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63f3eed302c8b570038cc787c1dcec4c903f981b43c258fd735f50fb6d7cb941
Instruction ID: 25ecc1d3580fe73fbcbee132ecce342022eaa040d5fd0b14b351c8fba04a6de7
Opcode Fuzzy Hash: 63f3eed302c8b570038cc787c1dcec4c903f981b43c258fd735f50fb6d7cb941
Instruction Fuzzy Hash: 5D715E30E003198BDB54EFB9D4506AEB7B2FFC9304F508529D505AB358EB74D94ACB81

Function 06E445B0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bca5c061aa3da855a7929588f19adf4c58b8cee3ff48d8baa4008ec7bc74052
Instruction ID: 50f07a672d84c01e0d61e41877d79ef3f0eb4d937c28d9d5383f013cca29249a
Opcode Fuzzy Hash: 2bca5c061aa3da855a7929588f19adf4c58b8cee3ff48d8baa4008ec7bc74052
Instruction Fuzzy Hash: D0912B34E10719CBDF60DF68C890B9DB7B1FF89314F208699D549AB294DB70AA85CF90

Function 06E4EF10 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69f2d89642305e9ef213d52eddc1a9d588a8cbed37bce7c29506c73feef6ee92
Instruction ID: 9b0683868413d3d634e461a4567daeae6fbe8412e1538e2ed6f2e60333734136
Opcode Fuzzy Hash: 69f2d89642305e9ef213d52eddc1a9d588a8cbed37bce7c29506c73feef6ee92
Instruction Fuzzy Hash: BA714B70E012099FDB54EFA9E980A9DBBF6FF88304F249569E005AB355DB34EC46CB50

Function 06E4EF20 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9dd2ee1690db37ed8a41d1b4771d84d86bfccfffa893332bd98f58c9ee5ef8f
Instruction ID: be9573ed9b3b2b9bd46df269c9ad5c19475b712a3c2fded21ad981143b3ca259
Opcode Fuzzy Hash: e9dd2ee1690db37ed8a41d1b4771d84d86bfccfffa893332bd98f58c9ee5ef8f
Instruction Fuzzy Hash: CF712B70E002099FDB54EFA9D980A9EBBF6FF88304F249469E405AB355DB34EC46CB51

Function 06E44B48 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c11c2c5db1569d6fd867e922e0b2a96d4424a21caa18a89edc1482c6bafbc582
Instruction ID: 1dd22efc78372db73c48fff4f514426f3e1b5c1388f47848c2b700d84f5afef3
Opcode Fuzzy Hash: c11c2c5db1569d6fd867e922e0b2a96d4424a21caa18a89edc1482c6bafbc582
Instruction Fuzzy Hash: B6614170F00219DFEB549BB9D8547AEBBF6FF88300F20852AD505AB395DE754C458B90

Function 06E4FC78 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c6fd087564be8dd7862718784951b180e6263c991e59ffc4a397b138b12e537
Instruction ID: 5776e08a1dab17e48176685559a932c9b5fed9d565ea40789886786d62608b98
Opcode Fuzzy Hash: 8c6fd087564be8dd7862718784951b180e6263c991e59ffc4a397b138b12e537
Instruction Fuzzy Hash: CF51EE31E00205DFDB24AFB8E4846ADBBB2EF88325F10886AE106DB254DB358855CB80

Function 06E4FA28 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d126396ebdb958f2ebba26c08eb77ff4603586ed1eddc5bd1279846a8ec7f8a
Instruction ID: 897d99f33f9526fc9ff743bbf4691a3a38b148cd5e3fea7823328631492954ad
Opcode Fuzzy Hash: 0d126396ebdb958f2ebba26c08eb77ff4603586ed1eddc5bd1279846a8ec7f8a
Instruction Fuzzy Hash: 4151C970F203149BFF70667DE85476F265AEBCA715F20542AE50BD7394C978CC8287A2

Function 06E4FA38 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0429f93ad3966d61e763755864c64323f780c195f0b3a6b61b00f97e9982b0f9
Instruction ID: 16e760ddbffa31809d56f983465ac195e3f4234ff9eef7fec83dca9264fcd0ea
Opcode Fuzzy Hash: 0429f93ad3966d61e763755864c64323f780c195f0b3a6b61b00f97e9982b0f9
Instruction Fuzzy Hash: CF51B570F203149BFF60667DE854B6F265BE7CA715F20542AE50BD7394C978CC8287A2

Function 06E44B39 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3f30925e61d1fe9cdbf185418ac39cc19afc21e8686391da6da8b65d4347743
Instruction ID: c1b9494c67efa7e17d2dbb1725c44a376a806635817b3dd62a75f10f5febc1bd
Opcode Fuzzy Hash: d3f30925e61d1fe9cdbf185418ac39cc19afc21e8686391da6da8b65d4347743
Instruction Fuzzy Hash: B8515E70F002189FDB549FA9D854BAEBBF6FF89700F20852ED505AB399DE758C418B90

Function 06E453F0 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edfcd76707e6f2715966f1dee30f9c4f3bb94f0a9802db5dd7aa48f088c93c44
Instruction ID: acd9abfb24d9d26038a12799e04e2c9008a3cfc9e08730d634c83212cb69824c
Opcode Fuzzy Hash: edfcd76707e6f2715966f1dee30f9c4f3bb94f0a9802db5dd7aa48f088c93c44
Instruction Fuzzy Hash: 2741B031E007098FDF70DFA9E880BBFF7B2EB85214F10592AE11AD7650D234A956CB91

Function 06E4D968 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e484d721c215d6ed38cb63b2c07d61950c9d2b16103cd49a477987e4dac271
Instruction ID: 18dd00c6d5eee51df6474bd011bd4242bbe509b648f98d3e9f24ae024abe4996
Opcode Fuzzy Hash: 61e484d721c215d6ed38cb63b2c07d61950c9d2b16103cd49a477987e4dac271
Instruction Fuzzy Hash: 82316170E1071A8BDB25DF79E84069EB7B2FF88304F109929E405EB344EB71E9468B81

Function 06E42078 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dd901b7b5db79056a6b2c9e639100617ca776d6a3472e589b1b759f866909f7
Instruction ID: 8f8298b0ef6c701c58952caa44a617ee76420a343db87f75c2f453f27a477f8c
Opcode Fuzzy Hash: 0dd901b7b5db79056a6b2c9e639100617ca776d6a3472e589b1b759f866909f7
Instruction Fuzzy Hash: ED318B31E00209DFCB58DF65D85069EB7B2EF88300F109529E906EB354EB71ED46CB50

Function 06E42088 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a6c91c1ff394770584c2bfe6a63bb868e7680c67fd0cba6eef1056b76b4b14c
Instruction ID: 199647d1601e901591f03e1c09126889132979f9a819c8d80a942e768dc4ab2f
Opcode Fuzzy Hash: 6a6c91c1ff394770584c2bfe6a63bb868e7680c67fd0cba6eef1056b76b4b14c
Instruction Fuzzy Hash: 6E316731E10209DFCB58DF65D894AAEB7B2EF89300F108529E906EB354EB71AD46CB50

Function 0143D006 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2524198925.000000000143D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0143D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_143d000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dfd38bf848e978ccd9a751e4b24cf8688a677f0f5ab8c544c760382a3856aeb
Instruction ID: dd2ec8542bb00b8f2c5b10fdb2f59672a8172286840913002edd962da1811346
Opcode Fuzzy Hash: 9dfd38bf848e978ccd9a751e4b24cf8688a677f0f5ab8c544c760382a3856aeb
Instruction Fuzzy Hash: DD312A7550E3C09FDB178F64C9A4711BF71AF47214F1985DBD8898F2A7C23A980ACB62

Function 06E43A78 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70fe246f4cba950ae06d4e56c38714bd75e3b7da1498e772729bddd16a6ea93a
Instruction ID: c37cf28fe9606b61c9652df7b30a1d8bfb881b68c3c83554c6c5cd2b092b39d8
Opcode Fuzzy Hash: 70fe246f4cba950ae06d4e56c38714bd75e3b7da1498e772729bddd16a6ea93a
Instruction Fuzzy Hash: 95212875A003599FDB40DF6AE940BAEBBF5EB48350F108025E905E7354EB34DD858B94

Function 06E43A88 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90fde8792178c7296900299f0b3b7cb3db136308718ce047ab8e12276a207157
Instruction ID: 4f6aa94604dbdb0e61363b72f68f6ca95d3c77bb1b2138b0b6c1013e828276e0
Opcode Fuzzy Hash: 90fde8792178c7296900299f0b3b7cb3db136308718ce047ab8e12276a207157
Instruction Fuzzy Hash: 47214675E003559FDB40DF6AE980BAEBBF5EB48350F148029E905E7394EB34DD808B90

Function 06E46D00 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0be2a3f43c56f64561584fb19e7e55af376090fa912689e2bf27017bf0187381
Instruction ID: f80d6552c864fec06b766c49c865bbd2a7b2b79e59f5ae8a9a16e663d8bd4071
Opcode Fuzzy Hash: 0be2a3f43c56f64561584fb19e7e55af376090fa912689e2bf27017bf0187381
Instruction Fuzzy Hash: 9E218030B112189BDF54FF69F4546ADBBB6EF89314F249429E505D7344EB36AC418BC0

Function 0143D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2524198925.000000000143D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0143D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_143d000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cb1d2498187d054fc910646a6811eb6ae09713cd4447bba5305211718a3da25
Instruction ID: fbdc990a537dfa8387c29bd32a04854d6f8cb385f7e7853b46f04e8b2bef1e3d
Opcode Fuzzy Hash: 6cb1d2498187d054fc910646a6811eb6ae09713cd4447bba5305211718a3da25
Instruction Fuzzy Hash: 6221F1B1904204EFDB15DF64C980B26FB65EB88718F60C56EE9090B3A2C736D447CA62

Function 06E43B98 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce33c87e4634d88104eac5b2dc19e431656aebd6b1a0eb6e662d90f85f3a7a21
Instruction ID: 2d032094940978e127b872d5fa46f01299f60b69ee1c0d29589a3982003faa8d
Opcode Fuzzy Hash: ce33c87e4634d88104eac5b2dc19e431656aebd6b1a0eb6e662d90f85f3a7a21
Instruction Fuzzy Hash: 27116131B106288FDB98AA7AD8146EE77AAEBC8310F108539D506EB348DE35DC4587D1

Function 06E441D8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b584fc3d85cdfcea4e819a356a062bbd6675400811dcdbc2961dcf1f89a1690
Instruction ID: e2d4a786bd28343742c801789cc00ecf1d870c0116681d8f6564427fda5ff09f
Opcode Fuzzy Hash: 6b584fc3d85cdfcea4e819a356a062bbd6675400811dcdbc2961dcf1f89a1690
Instruction Fuzzy Hash: 2A01B131B042209FDB60AABDA814B2BB7D6EBC9714F20883AE509C7389DD65DC028395

Function 06E4F191 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82bb285e1f86284dd96b5651e60c5b7e0b162018ff8c105db109c81225df55c1
Instruction ID: d9cdd40a9cc38d9d02807ae991b22e7ddbf3e4d76ba129ea823c5cf7e4bac38d
Opcode Fuzzy Hash: 82bb285e1f86284dd96b5651e60c5b7e0b162018ff8c105db109c81225df55c1
Instruction Fuzzy Hash: 26014C30B003504BCB61A97DE890F2B7BE6EBCAB14F14883AF40AC7345DD25DC064395

Function 06E4A300 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dd7f97a3ba3f7e31cd654556292c81cda42a997d4439dbbe822a20e7115e04b
Instruction ID: ae5428e6d2b788b268fa24fe7036554b8240080422dae897cd57c46702e0dd0e
Opcode Fuzzy Hash: 1dd7f97a3ba3f7e31cd654556292c81cda42a997d4439dbbe822a20e7115e04b
Instruction Fuzzy Hash: 1801D270F002105BC761EA7DE824B1E77E5EB8A724F10987EE40AC7355FA25DC018391

Function 06E43850 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8257eb139b19600b33ffb2a93e40f7cfc2864a5ecf7cdf38ab22868ecd5af85e
Instruction ID: 9a10c02ed7c9d22c7179e0afb686a51e67f0e62f0c7db4511fd1ad47c2cb6f4c
Opcode Fuzzy Hash: 8257eb139b19600b33ffb2a93e40f7cfc2864a5ecf7cdf38ab22868ecd5af85e
Instruction Fuzzy Hash: 5121D3B5D01219EFDB10DF9AD885ACEFBF8FB48314F10812AE918A7240D3756954CFA5

Function 06E43B88 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f220d0ff631c4e853759779d9d334dda925b2e190a60d1c29caaddf9b61a39e
Instruction ID: 8a21105f37f6d2520d8dd88d0bbd057c83044a63abfdcd4c440f1b7ffc77ce3d
Opcode Fuzzy Hash: 1f220d0ff631c4e853759779d9d334dda925b2e190a60d1c29caaddf9b61a39e
Instruction Fuzzy Hash: DB018F36B101288BEB949A7AE8107EF77EBEBC8311F10853AD505E7388DE24CC0687D1

Function 06E43858 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d354439290b21664cc2b38820db5c79f56c7c3b3a9ba1b57bc263bf07d768677
Instruction ID: 1b355366e633cb67963944c198136868a0d91a5044416af8b2a22f8a33f2f472
Opcode Fuzzy Hash: d354439290b21664cc2b38820db5c79f56c7c3b3a9ba1b57bc263bf07d768677
Instruction Fuzzy Hash: 4311DDB5D01219AFDB10DF9AD884ACEFBF8FB48310F10812AE918A7240D375A944CFA5

Function 06E441E8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd975a3c4f7ab5b25211f86ccc01203a8384cbd775ff635f1ceb70b8dc97709c
Instruction ID: d58353925a5846f6a7434af9f0ce44d818d2527d7466dbece63d1a5bae167b74
Opcode Fuzzy Hash: fd975a3c4f7ab5b25211f86ccc01203a8384cbd775ff635f1ceb70b8dc97709c
Instruction Fuzzy Hash: 34018635F002108BDB64A9BDA41471FA3DBEBC9714F20C43AE50AC7788DD65DC024395

Function 06E4F1A0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccea364f269eacb4ee35c9a8d634d1f60066b5668427b5d1320127be6c08739a
Instruction ID: d1476d0e0714ae2790441a7ef968fd392816a0578fb828cc7e960d64909f18d6
Opcode Fuzzy Hash: ccea364f269eacb4ee35c9a8d634d1f60066b5668427b5d1320127be6c08739a
Instruction Fuzzy Hash: DD01A475B102104BDB64A97DE894B2F73DAEBC9B14F149839F50AC7344ED25DC024395

Function 06E4A310 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c43aecd9ac6717289eb1ce83e6d83138976a3b2d16941270246967bdc0349689
Instruction ID: 8eb6f1eaec7f6601bf9bb0a1fc4e4a30e435c74bc063f8fd071533c15943536b
Opcode Fuzzy Hash: c43aecd9ac6717289eb1ce83e6d83138976a3b2d16941270246967bdc0349689
Instruction Fuzzy Hash: 2601A470F002205FDB60EA7DE854B1E73D6EB89B24F509839E40AC7348ED25EC428791

Function 06E46461 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0df61a4e12a792955956c1cef52938b9cd65fd3b76d1cdd988bfc99a4e73352c
Instruction ID: 5ea37e169f6b20479d5957b5dc88a644943e2d3204f1d4e3d192d69d5764a75f
Opcode Fuzzy Hash: 0df61a4e12a792955956c1cef52938b9cd65fd3b76d1cdd988bfc99a4e73352c
Instruction Fuzzy Hash: 71E092B1E613086BEF60EE74E96568A7BAEE743358F2048A5D444CB101E633D9168391

Non-executed Functions

Function 06E47698 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$q, xrefs: 06E477AF
$q, xrefs: 06E47C0B
$q, xrefs: 06E47C15
$q, xrefs: 06E477D4
$q, xrefs: 06E477A3
$q, xrefs: 06E47C21
$q, xrefs: 06E477E0
$q, xrefs: 06E47B6C
$q, xrefs: 06E47B60
$q, xrefs: 06E47BFF

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-1298971921
Opcode ID: bb33213fcd30e052889d2a5a08ad194cbbdc20231250232b22a262a34529b640
Instruction ID: ce1fb1fe38cc675a365394bd0bfda0217a55975dbc578f6049279e0942e4a6b7
Opcode Fuzzy Hash: bb33213fcd30e052889d2a5a08ad194cbbdc20231250232b22a262a34529b640
Instruction Fuzzy Hash: 6A120830E003198FDF64EF79D954A9EB7B2BF88304F2495A9D40AAB254DB349D85CB81

Function 06E4A930 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$q, xrefs: 06E4AAEE
$q, xrefs: 06E4AA32
$q, xrefs: 06E4AAAC
$q, xrefs: 06E4AA26
$q, xrefs: 06E4AAB8
$q, xrefs: 06E4AA8D
$q, xrefs: 06E4AA81
$q, xrefs: 06E4AAE2

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-3886557441
Opcode ID: ec04c9e8aa0395329bd0be48501bb0214697877a9e9d133e2fdfb3523cd341b5
Instruction ID: 29c3eead8e7e0aec15f7fdb846f653f3041ababcb5ce7481e7d8e3573ef3f5c1
Opcode Fuzzy Hash: ec04c9e8aa0395329bd0be48501bb0214697877a9e9d133e2fdfb3523cd341b5
Instruction Fuzzy Hash: 2C916B30A403099FEB64EF79EA447AEB7B2FF84314F149539E4029B298DB749C45CB91

Function 06E47098 Relevance: 7.9, Strings: 6, Instructions: 405COMMON

Download Yara Rule

Strings

$q, xrefs: 06E475A0
$q, xrefs: 06E473E0
$q, xrefs: 06E475AC
$q, xrefs: 06E473D4
$q, xrefs: 06E47534
$q, xrefs: 06E4737A

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q
API String ID: 0-2069967915
Opcode ID: bbd897f909ad41c6cea8f026ab2f97f55ceceb2aeceb83a2676f27525ddd9929
Instruction ID: 4c0c2f049936604e6b12628e4d02a104ece1f522fd256b472d6c4d5f0f5895e0
Opcode Fuzzy Hash: bbd897f909ad41c6cea8f026ab2f97f55ceceb2aeceb83a2676f27525ddd9929
Instruction Fuzzy Hash: 44F12930B013058FDB58EF69D554A6EB7B6FF84344F248569E4069B3A4DB39EC82CB81

Function 06E483D0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$q, xrefs: 06E4862A
$q, xrefs: 06E4868F
$q, xrefs: 06E48636
$q, xrefs: 06E4869B

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: 72e2eb0b31d6cba636e71b89b21b638f8de299cb97e93797ccd03101128dd190
Instruction ID: eb3d902a89a78636c8de874584a239ac00979c2286b9085c59952a9cb0f5ead3
Opcode Fuzzy Hash: 72e2eb0b31d6cba636e71b89b21b638f8de299cb97e93797ccd03101128dd190
Instruction Fuzzy Hash: C9B13A30A103198BDB64EF79E5546AEB7B2FF88304F249969D406DB394DB34DC82CB81

Function 06E487E8 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$q, xrefs: 06E48867
$q, xrefs: 06E48873
LRq, xrefs: 06E488DB
LRq, xrefs: 06E4892A

Memory Dump Source

Source File: 00000012.00000002.2542277011.0000000006E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6e40000_LisectAVT_2403002A_133.jbxd

Similarity

API ID:
String ID: LRq$LRq$$q$$q
API String ID: 0-2204215535
Opcode ID: 083ce48b2920151f6c9c97fce088a040eae37c920cd7753bef35496928141d29
Instruction ID: d2cf085d1e1c7d1fb1a5d7902ea5bff466bd34c37816ecaf59544ee07339b552
Opcode Fuzzy Hash: 083ce48b2920151f6c9c97fce088a040eae37c920cd7753bef35496928141d29
Instruction Fuzzy Hash: F351B230B003019FDB58EF39E940A6AB7F2FF88704F149569E5069B3A4DA35EC81CB95

Analysis Process: GlIToApjgGEL.exePID: 7472, Parent PID: 932COMMON

Execution Graph

Execution Coverage:	11.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	177
Total number of Limit Nodes:	7

Executed Functions

Function 0256F9B3 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0256FA3E
GetCurrentThread.KERNEL32 ref: 0256FA7B
GetCurrentProcess.KERNEL32 ref: 0256FAB8
GetCurrentThreadId.KERNEL32 ref: 0256FB11

Memory Dump Source

Source File: 00000013.00000002.1401629332.0000000002560000.00000040.00000800.00020000.00000000.sdmp, Offset: 02560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2560000_GlIToApjgGEL.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 01d1465451d3f60341c74af2bc41b57a41bb539c06e85ea527a7ed06b2e65b6e
Instruction ID: f441cb9eeb8936c8d30a5d3b22609e5f0690d226587759a7361fbaa668f2dc3f
Opcode Fuzzy Hash: 01d1465451d3f60341c74af2bc41b57a41bb539c06e85ea527a7ed06b2e65b6e
Instruction Fuzzy Hash: 345156B1D00249CFEB14DFA9D648BEEBBF1FF48304F208459E409A7261D7359944CB66

Function 0256F9C0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0256FA3E
GetCurrentThread.KERNEL32 ref: 0256FA7B
GetCurrentProcess.KERNEL32 ref: 0256FAB8
GetCurrentThreadId.KERNEL32 ref: 0256FB11

Memory Dump Source

Source File: 00000013.00000002.1401629332.0000000002560000.00000040.00000800.00020000.00000000.sdmp, Offset: 02560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2560000_GlIToApjgGEL.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: e6f2ff3442bb387307165b11f0ef39d3424dcd88c856818628ce130ad861367b
Instruction ID: c8cb06fb41523f38737fc3649a89ae2da78bfeb06d1c17ca4db2936b46e4e772
Opcode Fuzzy Hash: e6f2ff3442bb387307165b11f0ef39d3424dcd88c856818628ce130ad861367b
Instruction Fuzzy Hash: F25144B1D00209CFEB14DFAAD648BEEBBF1FB88314F208459E409A7360D7759944CB66

Function 02713464 Relevance: 1.8, APIs: 1, Instructions: 266
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 027136A6

Memory Dump Source

Source File: 00000013.00000002.1401969741.0000000002710000.00000040.00000800.00020000.00000000.sdmp, Offset: 02710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2710000_GlIToApjgGEL.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 9753b2771175b5948af0230002aa13fe2414e6826b1907f7b0deb207faabf613
Instruction ID: 1a920579c650df3026f6ad71046ee9bca32a28ba7cf9025e6bdf07597800bdf2
Opcode Fuzzy Hash: 9753b2771175b5948af0230002aa13fe2414e6826b1907f7b0deb207faabf613
Instruction Fuzzy Hash: 0BA14B71D00229DFEF24CFA8C841BEDBBB2BF48314F1485AAD819A7240DB749985CF91

Function 0256D717 Relevance: 1.8, APIs: 1, Instructions: 263
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.1401629332.0000000002560000.00000040.00000800.00020000.00000000.sdmp, Offset: 02560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2560000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8b382ed75b7577a2357fcc32953f2d8c00f602d73abaf55e6d267eda5c5db94
Instruction ID: d2c3e4b45a6a9e89b4051e7d94c68205512ce8e6e0b28e6f65b5207eb9e9addd
Opcode Fuzzy Hash: c8b382ed75b7577a2357fcc32953f2d8c00f602d73abaf55e6d267eda5c5db94
Instruction Fuzzy Hash: 33A16970A01B418FE725CF29D4587AABBF2FF88314F048A2ED086CB651D775E44ACB95

Function 02713470 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 027136A6

Memory Dump Source

Source File: 00000013.00000002.1401969741.0000000002710000.00000040.00000800.00020000.00000000.sdmp, Offset: 02710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2710000_GlIToApjgGEL.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: caa33b333976ae8f31089a077d24588fb9caa98059248fe658d89b45f0ff11e5
Instruction ID: 1ace79dfe441670189a2d0738dd15d7266061ec357d17344c5a16594ec06e03f
Opcode Fuzzy Hash: caa33b333976ae8f31089a077d24588fb9caa98059248fe658d89b45f0ff11e5
Instruction Fuzzy Hash: DF914A71D00369DFEF24CF68C881BADBBB2BF48314F1485A9E808A7240DB749985CF91

Function 025658EC Relevance: 1.6, APIs: 1, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 025659A9

Memory Dump Source

Source File: 00000013.00000002.1401629332.0000000002560000.00000040.00000800.00020000.00000000.sdmp, Offset: 02560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2560000_GlIToApjgGEL.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 7342bc9bd9046fbd6499027c5837c9fe9fffbcf2356f16bb51a52b4ca8278909
Instruction ID: f944f67d056c1fda6e9919a29fffefc4c5eeba2158c5665e5d975590e1b8b647
Opcode Fuzzy Hash: 7342bc9bd9046fbd6499027c5837c9fe9fffbcf2356f16bb51a52b4ca8278909
Instruction Fuzzy Hash: 2A4105B0C00719CFEB24CFA9C884B9EBBB5BF48304F60815AE409AB251D7756945CF54

Function 0256FB90 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.1401629332.0000000002560000.00000040.00000800.00020000.00000000.sdmp, Offset: 02560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2560000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e77758b5f51deb60ee32092f1fb3f1bf348fa563fb2be342bff0acb47a64196f
Instruction ID: 8a5ae596f406f9ba00be6a5fafd9bea010f2654e6cd599cf14618bd61d731cce
Opcode Fuzzy Hash: e77758b5f51deb60ee32092f1fb3f1bf348fa563fb2be342bff0acb47a64196f
Instruction Fuzzy Hash: 83415776900249DFDB11CF99E844AEEBFF5FB48310F14805AE915A7321D3359914DFA4

Function 025644B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 025659A9

Memory Dump Source

Source File: 00000013.00000002.1401629332.0000000002560000.00000040.00000800.00020000.00000000.sdmp, Offset: 02560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2560000_GlIToApjgGEL.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 96645d95ad75933e7fa5321d4e0fd9641554ed444f3f15be4ba583c6d3ab1a88
Instruction ID: c3b6504d2dc194b2146865658aa1dc8c6cec4f738bf2a9b0efa1db71ab333552
Opcode Fuzzy Hash: 96645d95ad75933e7fa5321d4e0fd9641554ed444f3f15be4ba583c6d3ab1a88
Instruction Fuzzy Hash: B841D270C00719CFEF24DFAAC88479EBBB5BF49304F60806AD409AB255DB756945CF94

Function 02565A64 Relevance: 1.6, APIs: 1, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.1401629332.0000000002560000.00000040.00000800.00020000.00000000.sdmp, Offset: 02560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2560000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d0d6e60831157cb5a9b755a6a968b031e0264ddf595cf04b4788fabcb8380b2
Instruction ID: c2ac7e3a9f5bb2d3348958a676cb4efab70e07bd6f478e97bfd634557038a2b8
Opcode Fuzzy Hash: 9d0d6e60831157cb5a9b755a6a968b031e0264ddf595cf04b4788fabcb8380b2
Instruction Fuzzy Hash: 0F31DA70804789CFEF11CFA4C9587EEBBF1BF46308F944089C051AB255E7B6A90ACB14

Function 027131E0 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 02713278

Memory Dump Source

Source File: 00000013.00000002.1401969741.0000000002710000.00000040.00000800.00020000.00000000.sdmp, Offset: 02710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2710000_GlIToApjgGEL.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 0d97eef2dc66aa4714d5a4148f1be45b53846ec4abc70bf2fd07aa868a83a346
Instruction ID: 988d4fe10ff9a432bdb381a3b6e0a72367896879703cc2f61288d30a3c065c52
Opcode Fuzzy Hash: 0d97eef2dc66aa4714d5a4148f1be45b53846ec4abc70bf2fd07aa868a83a346
Instruction Fuzzy Hash: 222113B6900349DFDB14DFA9C981BEEBBF1FF48310F14842AE918A7250D7789950CBA5

Function 027131E8 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 02713278

Memory Dump Source

Source File: 00000013.00000002.1401969741.0000000002710000.00000040.00000800.00020000.00000000.sdmp, Offset: 02710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2710000_GlIToApjgGEL.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 22a5f73b5e9ff2807fa879761eabe62dacd7fce52029a5be9744d10f2046e2dc
Instruction ID: b2e197b92f63ef093c43d92a83791058e799c863ab803fd7778b3091c078742c
Opcode Fuzzy Hash: 22a5f73b5e9ff2807fa879761eabe62dacd7fce52029a5be9744d10f2046e2dc
Instruction Fuzzy Hash: 9C212471900349DFDB14DFAAC981BEEBBF5FF48310F10842AE918A7240C7789940CBA5

Function 0256FC00 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0256FC8F

Memory Dump Source

Source File: 00000013.00000002.1401629332.0000000002560000.00000040.00000800.00020000.00000000.sdmp, Offset: 02560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2560000_GlIToApjgGEL.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 808c2a3257623abb07938995897b9f472304ff362473dae64e1237bbe371361a
Instruction ID: 8c40b175bcbec6bfcda45efd18b60403da304614a584465dea3ed79b1b9f0121
Opcode Fuzzy Hash: 808c2a3257623abb07938995897b9f472304ff362473dae64e1237bbe371361a
Instruction Fuzzy Hash: 9F2126B5D00248DFEB10CF9AD584ADEBFF5FB48310F14801AE914A3210C3349941CF65

Function 027132D1 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 02713358

Memory Dump Source

Source File: 00000013.00000002.1401969741.0000000002710000.00000040.00000800.00020000.00000000.sdmp, Offset: 02710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2710000_GlIToApjgGEL.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: c00b9e173e421ac1bdbcf7fff38af2dd5fe1db3f684f0ab5b347df94631bc2cf
Instruction ID: 678dc3c31b9d757f833128c8aef90d5ae32ab1b35190cd13a98b29c6d01fccb4
Opcode Fuzzy Hash: c00b9e173e421ac1bdbcf7fff38af2dd5fe1db3f684f0ab5b347df94631bc2cf
Instruction Fuzzy Hash: 352107B2D003499FDB14CF99C9817EEBBF5FF48310F14842AE518A7240C73995459B65

Function 027132D8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 02713358

Memory Dump Source

Source File: 00000013.00000002.1401969741.0000000002710000.00000040.00000800.00020000.00000000.sdmp, Offset: 02710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2710000_GlIToApjgGEL.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: ca9fec5140ea523bf289865f49cb989fa78d86d5574debf908557dc812aee22c
Instruction ID: e271bb1137bcb8ce3f20eac25cec277332252e5277ec7048e371b620852a8fff
Opcode Fuzzy Hash: ca9fec5140ea523bf289865f49cb989fa78d86d5574debf908557dc812aee22c
Instruction Fuzzy Hash: 12211671C003499FDB14CFAAC980BEEBBF5FF48310F10842AE918A7240CB399541DBA5

Function 027127E0 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0271285E

Memory Dump Source

Source File: 00000013.00000002.1401969741.0000000002710000.00000040.00000800.00020000.00000000.sdmp, Offset: 02710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2710000_GlIToApjgGEL.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 6abc7da7f20fe8cb94cb9d0c46d0b119c23fe50319f241986eed46fad2113e74
Instruction ID: e4efbfdfd23c2a6ce0a7bc4ac0d2e16f075384f45fe85b9cceca848e99ed8369
Opcode Fuzzy Hash: 6abc7da7f20fe8cb94cb9d0c46d0b119c23fe50319f241986eed46fad2113e74
Instruction Fuzzy Hash: 8C213571D003088FDB14DFAAC485BEEBBF4EF48314F14842AD919A7241DB789945CFA5

Function 027127D8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0271285E

Memory Dump Source

Source File: 00000013.00000002.1401969741.0000000002710000.00000040.00000800.00020000.00000000.sdmp, Offset: 02710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2710000_GlIToApjgGEL.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: c41c7f89671b05cd8309c0c4bfd3ae3f17c0edea169bf6563c3ff20b12861732
Instruction ID: 93895e7c79aa5993874f858416a866a574f6bbe8a62966e56d2ad22416dc71ce
Opcode Fuzzy Hash: c41c7f89671b05cd8309c0c4bfd3ae3f17c0edea169bf6563c3ff20b12861732
Instruction Fuzzy Hash: 0F2143B1D00308CFDB14CFAAC5817AEBBF4EF48214F14842AD959A7241DB389A45CBA4

Function 0256FC08 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0256FC8F

Memory Dump Source

Source File: 00000013.00000002.1401629332.0000000002560000.00000040.00000800.00020000.00000000.sdmp, Offset: 02560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2560000_GlIToApjgGEL.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5d2f6a415ca8096a41c496b8258e111c3a61b60d5941c40cdd1b4e8437880f05
Instruction ID: 7ca7eafc389e9ddfe5d5e489b0d08861002953de72ccc6c6e447a8107c775447
Opcode Fuzzy Hash: 5d2f6a415ca8096a41c496b8258e111c3a61b60d5941c40cdd1b4e8437880f05
Instruction Fuzzy Hash: 3921E4B5D00248DFDB10CF9AD584ADEBBF9FB48310F14841AE914A7350D378A940CF65

Function 02713120 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 02713196

Memory Dump Source

Source File: 00000013.00000002.1401969741.0000000002710000.00000040.00000800.00020000.00000000.sdmp, Offset: 02710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2710000_GlIToApjgGEL.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4a89f5bfa77d2963e7064c5d9b1d87c56d1866d4b2b48ba96d2afc074a8c8728
Instruction ID: 7ed3d4c7c0832ec647c55d6a3fb6333f87fb5163ab7f4cd27618d0f90afa102c
Opcode Fuzzy Hash: 4a89f5bfa77d2963e7064c5d9b1d87c56d1866d4b2b48ba96d2afc074a8c8728
Instruction Fuzzy Hash: 9F116472C00248DFDB24CFA9C944BEEBBF5AF48310F24881AE915A7650C7399510CBA0

Function 0256D128 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0256D9F9,00000800,00000000,00000000), ref: 0256DC0A

Memory Dump Source

Source File: 00000013.00000002.1401629332.0000000002560000.00000040.00000800.00020000.00000000.sdmp, Offset: 02560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2560000_GlIToApjgGEL.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ee5ebe273b900f74b564bcc61e00a51956b8af67e4b095678fa97924c69e9fbe
Instruction ID: 26e4f152a2d83c1dca5e60c08b55d118e806f369449f0880d93e425cda5c5633
Opcode Fuzzy Hash: ee5ebe273b900f74b564bcc61e00a51956b8af67e4b095678fa97924c69e9fbe
Instruction Fuzzy Hash: C811F4B69002499FDB20CF9AD544BAEFBF4EB48210F10842AE819A7210C375A545CFA9

Function 02713128 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 02713196

Memory Dump Source

Source File: 00000013.00000002.1401969741.0000000002710000.00000040.00000800.00020000.00000000.sdmp, Offset: 02710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2710000_GlIToApjgGEL.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a89ba3e9488c356dcea21ad4babe21afcec46cda57f28340888ec33cf0195191
Instruction ID: 7f04f3726798193f2548f1db98c8c4a9ec42775d47e851dbaaedb332ee45ba6a
Opcode Fuzzy Hash: a89ba3e9488c356dcea21ad4babe21afcec46cda57f28340888ec33cf0195191
Instruction Fuzzy Hash: 78112672900349DFDB24DFAAC844BDFBBF5EF48310F14841AE915A7250CB759540DBA5

Function 0256DB9B Relevance: 1.6, APIs: 1, Instructions: 51libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0256D9F9,00000800,00000000,00000000), ref: 0256DC0A

Memory Dump Source

Source File: 00000013.00000002.1401629332.0000000002560000.00000040.00000800.00020000.00000000.sdmp, Offset: 02560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2560000_GlIToApjgGEL.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: fdba9163b41dd49d3c0c5cef2a0b8ec2995400604c7da9de6265a1fb53df58d3
Instruction ID: c0fdec012042f19dbc625878ae4d883ac0379f893f3f85a64c1a0da225089eaf
Opcode Fuzzy Hash: fdba9163b41dd49d3c0c5cef2a0b8ec2995400604c7da9de6265a1fb53df58d3
Instruction Fuzzy Hash: 6E1100BAD00209CFEB14CF9AD584BDEFBF5AB88350F14852AD819A7210C379A545CFA4

Function 02712730 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 02712792

Memory Dump Source

Source File: 00000013.00000002.1401969741.0000000002710000.00000040.00000800.00020000.00000000.sdmp, Offset: 02710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2710000_GlIToApjgGEL.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: a2cf8b07c6e19533f8bf1eaf98cdd3f19cd340c6eb568d58535403dfb08e5b48
Instruction ID: dbb74fcfce32e0f5240ead91fed932926a3d7246403f16a68999b69bf7fa553c
Opcode Fuzzy Hash: a2cf8b07c6e19533f8bf1eaf98cdd3f19cd340c6eb568d58535403dfb08e5b48
Instruction Fuzzy Hash: D2112571D003498FDB24DFAAC4447EFFBF4EF88224F24842AD519A7240CB79A940CBA5

Function 02712728 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 02712792

Memory Dump Source

Source File: 00000013.00000002.1401969741.0000000002710000.00000040.00000800.00020000.00000000.sdmp, Offset: 02710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2710000_GlIToApjgGEL.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: ab37a08a5a90b17a2374450dfede50badd83fbe1111765b08d88f00cdcbbdb91
Instruction ID: ec549bcb053d4498e3f3616301b0b3581b9a6c2f91a0c2244b3d0135823bc15a
Opcode Fuzzy Hash: ab37a08a5a90b17a2374450dfede50badd83fbe1111765b08d88f00cdcbbdb91
Instruction Fuzzy Hash: 6E1146B5D00348CFDB24CFAAC5447AEBBF4AF48224F24841AD519A7640CB39A940CBA4

Function 02714CAC Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 02716B25

Memory Dump Source

Source File: 00000013.00000002.1401969741.0000000002710000.00000040.00000800.00020000.00000000.sdmp, Offset: 02710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2710000_GlIToApjgGEL.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: a6545a27d83d3fad4f693a2f7c98dbc9ca85c95485e835b0657814cacd5e485d
Instruction ID: 9873dfdf55da3480f3e7d1b280d0c0d8e9ce5914e422e935fc18172d66d4d5ef
Opcode Fuzzy Hash: a6545a27d83d3fad4f693a2f7c98dbc9ca85c95485e835b0657814cacd5e485d
Instruction Fuzzy Hash: 1E11F2B5800348DFDB20CF9AD584BDEBBF8EB48320F20841AE918A7740C375A944CFA5

Function 0256D918 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0256D97E

Memory Dump Source

Source File: 00000013.00000002.1401629332.0000000002560000.00000040.00000800.00020000.00000000.sdmp, Offset: 02560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2560000_GlIToApjgGEL.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 877abc71101dd508491d2c991923d23d1a852a038038ca8741eee672b5694b9b
Instruction ID: b4eeedd2a02c677533bcdc55cb51b9698eed0cda7313316c7f5c115c8f36c103
Opcode Fuzzy Hash: 877abc71101dd508491d2c991923d23d1a852a038038ca8741eee672b5694b9b
Instruction Fuzzy Hash: 77110FB6D01249CFDB20CF9AD444BDEFBF4EB88214F10841AD868A7210C379A545CFA5

Function 02716AC1 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 02716B25

Memory Dump Source

Source File: 00000013.00000002.1401969741.0000000002710000.00000040.00000800.00020000.00000000.sdmp, Offset: 02710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2710000_GlIToApjgGEL.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: b168cef9da791e566ce06cc81129ec5eb1c8953019d2e30cabd042e6d26ab3eb
Instruction ID: f1db6bd4b012b7941ceb2cc5d422c5876c75888ceedf8aaf26528a001f6b5fdd
Opcode Fuzzy Hash: b168cef9da791e566ce06cc81129ec5eb1c8953019d2e30cabd042e6d26ab3eb
Instruction Fuzzy Hash: 741100B6900249DFDB20CF9AD585BDEFBF8EF48314F20841AE558A7610C375A944CFA1

Function 00ADD0DC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1401298200.0000000000ADD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ADD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_add000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f36f2f590048ec1d6ca72224d8a00e6a872078c1f9a91daaf133e7c6d22b936f
Instruction ID: 1e2b139af33577ba825b29a27c259090a065b8aa72d658a1294c0afaaaa021f9
Opcode Fuzzy Hash: f36f2f590048ec1d6ca72224d8a00e6a872078c1f9a91daaf133e7c6d22b936f
Instruction Fuzzy Hash: 1321A475504344EFDB14DF24D9C4B26BB65FB84314F24C66EE90A4F396C33AD846CA62

Function 00ADD294 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1401298200.0000000000ADD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ADD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_add000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b68096bcb00bb98c75f64d98462dc1be1cd7b33a9dae0d8ab9dfde3b178bf88e
Instruction ID: 58c10a57db79ffbf1f7d3619fc8e34661e808dc14b589181ac5715af62bae7fd
Opcode Fuzzy Hash: b68096bcb00bb98c75f64d98462dc1be1cd7b33a9dae0d8ab9dfde3b178bf88e
Instruction Fuzzy Hash: 7821D475604304EFDB14DF24D9C0B26BBA5FB84314F24C56EE84A4F392C33AD846CA62

Function 00ADD28F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1401298200.0000000000ADD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ADD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_add000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e088ad8a07711d9d3566a887b1f888bc4d4e2f61ff705deeaaa2a632ac83149
Instruction ID: a90d3edc617aa034d6fcc02b8098aa50f0545fdec098e099f2671c82a23c9b89
Opcode Fuzzy Hash: 9e088ad8a07711d9d3566a887b1f888bc4d4e2f61ff705deeaaa2a632ac83149
Instruction Fuzzy Hash: B6118B75504280DFDB15CF10D5C4B15BFA1FB84314F24C6AAD84A4F796C33AD84ACB62

Analysis Process: GlIToApjgGEL.exePID: 7736, Parent PID: 7472COMMON

Execution Graph

Execution Coverage:	11.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	19
Total number of Limit Nodes:	5

Executed Functions

Function 06B22350 Relevance: 9.0, Strings: 6, Instructions: 1476COMMON

Download Yara Rule

Strings

$q, xrefs: 06B2370E
$q, xrefs: 06B2371A
$q, xrefs: 06B2375B
$q, xrefs: 06B23737
$q, xrefs: 06B23767
$q, xrefs: 06B23743

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q
API String ID: 0-2069967915
Opcode ID: 890fc076f6be809bad0998954a7530c04cde1f39492d77432dafa0b6caeebde0
Instruction ID: 81edf01e060bb17bb81c75595491624f9eaef52c014739d792037ad9753d1322
Opcode Fuzzy Hash: 890fc076f6be809bad0998954a7530c04cde1f39492d77432dafa0b6caeebde0
Instruction Fuzzy Hash: 49D25974E00215CFDB64DF68C584A9DB7F2FF89310F5485A9E40AAB265DB34ED85CB80

Function 06B2B230 Relevance: 8.3, Strings: 6, Instructions: 763COMMON

Download Yara Rule

Strings

$q, xrefs: 06B2BB9D
$q, xrefs: 06B2BBD1
$q, xrefs: 06B2BBC5
$q, xrefs: 06B2BC05
$q, xrefs: 06B2BBF9
$q, xrefs: 06B2BB91

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q
API String ID: 0-2069967915
Opcode ID: 1aa82b55a31e0b55ba3afafe1a2edb6875da82fd9a9bd8e6d63386cb0e419b08
Instruction ID: 64937d3ad3aa0912d3e19cc26a8457c66d3c38885620a59a295b63166dadd15e
Opcode Fuzzy Hash: 1aa82b55a31e0b55ba3afafe1a2edb6875da82fd9a9bd8e6d63386cb0e419b08
Instruction Fuzzy Hash: 1E528EB0E1021A8BEF64CB68D4947ADB7F2FB45314F2494A9E409EB355DE34DC81CB91

Function 06B27D78 Relevance: 3.0, Strings: 2, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06B28313
$q, xrefs: 06B2831F

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: f577b6d9f634f24f2611a1d4905d24475acedfd2615450d9d6af17dbdba2901b
Instruction ID: 84fa8d1b6e8fb33f2d4ad47db43214b44b7e7314bbf7b526c87520bfa1f123bc
Opcode Fuzzy Hash: f577b6d9f634f24f2611a1d4905d24475acedfd2615450d9d6af17dbdba2901b
Instruction Fuzzy Hash: 18027F70B002168FDB54DF68D854BAEB7E2FF84310F248569E9099B794DB35EC46CB90

Function 06B25580 Relevance: 1.8, Strings: 1, Instructions: 595
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06B25C82

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: a3183c506a0c1959382c6b5cc8ff21ee9a1d79a06a435356b5dd30f5bb736fbf
Instruction ID: 7c944c089ee1f082c76efd38249d75ababddd4c2a3652176e370caabd58cbd99
Opcode Fuzzy Hash: a3183c506a0c1959382c6b5cc8ff21ee9a1d79a06a435356b5dd30f5bb736fbf
Instruction Fuzzy Hash: E322C4B6E102158FDF74DBA4C4807AEBBF2EF85320F2485A9D519AB354DA35DC41CB90

Function 06B265E0 Relevance: .8, Instructions: 810COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d169031a3ff1d2d8078eb8b43cc6f0964e2967e06a79b8255e8fe04abb281533
Instruction ID: 6c5dcf2807e19abefe785a6f1c2ea6da1f6b1823e5841fbbdf17f172b4d365c0
Opcode Fuzzy Hash: d169031a3ff1d2d8078eb8b43cc6f0964e2967e06a79b8255e8fe04abb281533
Instruction Fuzzy Hash: 1A627074A102158FDB54DF68D594BADB7F2EF88310F1485A9E40AEB394EB35EC46CB80

Function 06B2C178 Relevance: .6, Instructions: 633COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d072a4b16c06b97e2b6ee07382ec192bdb5d7993bfe0431bffcd5d8535b95ab
Instruction ID: bc65843f95524d5042fdd46da5212835f429946b71a4bc122ecab76f01b2c59d
Opcode Fuzzy Hash: 9d072a4b16c06b97e2b6ee07382ec192bdb5d7993bfe0431bffcd5d8535b95ab
Instruction Fuzzy Hash: CE3262B4A002158FDB94DF68D490BADBBF2FB88310F108569E509EB395DB35DC41CB91

Function 06B2ACC8 Relevance: 10.4, Strings: 8, Instructions: 390
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06B2AE48
$q, xrefs: 06B2ADF5
$q, xrefs: 06B2AEA0
$q, xrefs: 06B2AE3C
$q, xrefs: 06B2ADE9
$q, xrefs: 06B2AE6B
$q, xrefs: 06B2AE77
$q, xrefs: 06B2AE94

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-3886557441
Opcode ID: 8ec099cf9d5a32cabbcfb52c92aeca45bf6e4d58ecd0441018ff7d87374a411d
Instruction ID: fa73784fcb624bde08bec44a16d7be25c25fe248841a3ca094533569e04f6380
Opcode Fuzzy Hash: 8ec099cf9d5a32cabbcfb52c92aeca45bf6e4d58ecd0441018ff7d87374a411d
Instruction Fuzzy Hash: 9AE15E70E1032A8BDF64DF68D8906AEB7F2FF84300F248569E409AB254DB74DC46CB81

Function 06B29148 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06B291FF
$q, xrefs: 06B291F3
$q, xrefs: 06B291B8
$q, xrefs: 06B291C4

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: 40f5f6e08a862b34e5de044d5196668c7ea3a449d3baaad1799b8e7e98293a22
Instruction ID: 503b5ae4b15e6f155e64f9ceb98a005426dd5404b7bf423200bae68b0c3730a7
Opcode Fuzzy Hash: 40f5f6e08a862b34e5de044d5196668c7ea3a449d3baaad1799b8e7e98293a22
Instruction Fuzzy Hash: A7915270B0031A8BDB54DF69C8507AEB7E6FF89300F109569D90EAB748EA34DD42CB91

Function 06B2CF40 Relevance: 4.6, Strings: 3, Instructions: 803
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06B2D33F
$q, xrefs: 06B2D337
$q, xrefs: 06B2D34B

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID: $q$$q$$q
API String ID: 0-3067366958
Opcode ID: 93efbdd4b4e65bb9eff47b498e37c0a4992e8308daae57e3339b0916d92f8179
Instruction ID: a72013ff249560487f6988d793e30d9fcb94a063b07eca1b8f94f0f586d428c8
Opcode Fuzzy Hash: 93efbdd4b4e65bb9eff47b498e37c0a4992e8308daae57e3339b0916d92f8179
Instruction Fuzzy Hash: 0C622C74A002168FDB65EF68D590A9DB7E2FF84300F248A78E4099F355DB75EC86CB81

Function 06B29137 Relevance: 2.7, Strings: 2, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06B291F3
$q, xrefs: 06B291B8

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: 98838362571f8254ca0c05699919589791a5f48a800b1d100024e4b358250107
Instruction ID: 1497f2bd2291c1128394a9cf6a4f9b7a60496b668305a4c0d11dadf68283b07e
Opcode Fuzzy Hash: 98838362571f8254ca0c05699919589791a5f48a800b1d100024e4b358250107
Instruction Fuzzy Hash: 64516370B002168FDB54DF69D850BAEB7E6EB89340F109579D90EEB748EA34DC42CB91

Function 013EEB50 Relevance: 1.6, APIs: 1, Instructions: 127
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000018.00000002.2527380341.00000000013E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13e0000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7aeb626580dc991cb2f0eecd3e404f494da59c23220998d24ccf01ffdca9e353
Instruction ID: 733b833de1fa6b587fffc33ec4757092952bde997240ca050dfaf114562308c2
Opcode Fuzzy Hash: 7aeb626580dc991cb2f0eecd3e404f494da59c23220998d24ccf01ffdca9e353
Instruction Fuzzy Hash: 49411372D007598FDB14DFAAD8043DEBBF1EF89210F19856AD508A7381EB38A845CBD0

Function 06B2DAC8 Relevance: 1.4, Strings: 1, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 06B2DC11

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID: PHq
API String ID: 0-3820536768
Opcode ID: 75d7d7dc1cb8b8ebd15c46702d5c24c50d4ee1eb44af0cf171d5c90805d4f313
Instruction ID: 04b954c896601dd0b8f7c2c3a20c0d4528364d64a890ad19abb7370fedc4da50
Opcode Fuzzy Hash: 75d7d7dc1cb8b8ebd15c46702d5c24c50d4ee1eb44af0cf171d5c90805d4f313
Instruction Fuzzy Hash: B0414170E1071A9FDB64DF65C45469EBBF2FF89340F204569E51ADB240DB70E982CB81

Function 06B2DAB5 Relevance: 1.4, Strings: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 06B2DC11

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID: PHq
API String ID: 0-3820536768
Opcode ID: 056242103620dff65091e3a479cea0a8263da409f41bb7e5a6a3f91863c12afc
Instruction ID: 4be942404846efa5a460f04fd51661db6a3edd53c08338bf05ef3a603d201585
Opcode Fuzzy Hash: 056242103620dff65091e3a479cea0a8263da409f41bb7e5a6a3f91863c12afc
Instruction Fuzzy Hash: 9E41A2B0E0071ADFDB64DF64C45469EBBB2FF85340F10466AE416EB244DB70D982CB41

Function 06B221B5 Relevance: 1.4, Strings: 1, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 06B22303

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID: PHq
API String ID: 0-3820536768
Opcode ID: 179cfc019c7970103df9ae18d52b693611a09b61a53a7b5aae25cc6656b8355e
Instruction ID: 98678962a6fbe26471d84bb677c6a183fb6dc5ac01e808e495943f96e90c98fa
Opcode Fuzzy Hash: 179cfc019c7970103df9ae18d52b693611a09b61a53a7b5aae25cc6656b8355e
Instruction Fuzzy Hash: 29311370B002168FDB689F74C5106AE7BE3FF89240B1445B8D406DB385DE3ACD86CB90

Function 06B221C8 Relevance: 1.4, Strings: 1, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 06B22303

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID: PHq
API String ID: 0-3820536768
Opcode ID: 2741471fd344db02ae8de00c6d4cb2eb24a03ad757c86ea314a6774fab3d291a
Instruction ID: d78eb21fb8fed60434201353a2d44d01ecec887d7a9a0c55433941492af425dc
Opcode Fuzzy Hash: 2741471fd344db02ae8de00c6d4cb2eb24a03ad757c86ea314a6774fab3d291a
Instruction Fuzzy Hash: 0031C170B002168FDB689F74D5146AE7BE3FB88250B204578D40BDB384DE35DD46CB95

Function 06B282EE Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

$q, xrefs: 06B28313

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID: $q
API String ID: 0-1301096350
Opcode ID: 76fd807abde45a9607b1858560bfc0e5412d841940f5f3bff2b518a94a05c304
Instruction ID: d0895362a4962da3ad6b7412297856c0aa5097f46cd240b90ba1ae3f532b955c
Opcode Fuzzy Hash: 76fd807abde45a9607b1858560bfc0e5412d841940f5f3bff2b518a94a05c304
Instruction Fuzzy Hash: 8EF0A0B2B04222CBEF744D45A9402A873E4F740211F1810F2EE0DDB140C279EE08CA91

Function 06B2B21F Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f196929f05c9334993569130db6864cb8f1f5792df22aaaafa545bcd1cd0a831
Instruction ID: b692349f1a17dd98a3afe11ff2ac6530807e67b51164905caa9fe960f20fed86
Opcode Fuzzy Hash: f196929f05c9334993569130db6864cb8f1f5792df22aaaafa545bcd1cd0a831
Instruction Fuzzy Hash: A3B167B0F1021A8BEF64CA9CD4907AEB7E6FB85314F245469E50DEB395CE38DC818B51

Function 06B261D8 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d973a5b2a222d35621f0b6f7d2124c7b64b828070f796f75e40222ba010dc1e
Instruction ID: 4aa2962d674ee66be4cb8af9d661e219ddda9458a3788ab6e834233ca8fe3b33
Opcode Fuzzy Hash: 2d973a5b2a222d35621f0b6f7d2124c7b64b828070f796f75e40222ba010dc1e
Instruction Fuzzy Hash: 026192B1F001214BDB549A7EC8906AEBAD7EFC4220B154479D90EDB364EE75DD028791

Function 06B24278 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56253b0ae7427b23a990ccb028246056dafc0f7f6e1845cb6845c7ecd644da09
Instruction ID: ee4b176f4b7cd2871da0b3b0a43774b6edd64ff65034c2376eab35eddcb90c9d
Opcode Fuzzy Hash: 56253b0ae7427b23a990ccb028246056dafc0f7f6e1845cb6845c7ecd644da09
Instruction Fuzzy Hash: 3C812E70B102158BDB54DFA8C4547AEBBF2EF89300F249579D50AEB748EB35EC428B91

Function 06B24288 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ecb6081b2912ab6f82d12e48398fd0cda7010daea1c51c5ca66eb28d4559173
Instruction ID: 9e4ab91c5135f45017bbb02ba88dce2a8d0121ca7a827ff43ad59f4e65be0eb4
Opcode Fuzzy Hash: 5ecb6081b2912ab6f82d12e48398fd0cda7010daea1c51c5ca66eb28d4559173
Instruction Fuzzy Hash: 86813F70B102158BDB54DFA8C4547AEBBF2EF89300F249579D50AEB748EE35EC428B51

Function 06B24598 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc0c1a1f597e807c35bc2e87480db04ecd7b3011c37cbd80023864296ef47d24
Instruction ID: 6bdfac0ce640c8ba37f4aefa7fa31f5bd5f1f5341ba1baf5acefd83112e8908a
Opcode Fuzzy Hash: dc0c1a1f597e807c35bc2e87480db04ecd7b3011c37cbd80023864296ef47d24
Instruction Fuzzy Hash: B6915C74E1021A8BDF60CF68C890B9DB7B1FF89310F208699D54DAB695DB70A985CF90

Function 06B245B0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6beb2a2091c41961846c8f70daac78aa8308c4194338236405681a53ac1500c9
Instruction ID: 9cd65bc30d51c2a3e3b73528737e25d177fb99687336713bf0663d5f3cb7383c
Opcode Fuzzy Hash: 6beb2a2091c41961846c8f70daac78aa8308c4194338236405681a53ac1500c9
Instruction Fuzzy Hash: 34912A74E1021A8BDF60DF68C890B9DB7B1FF89310F208699D54DAB654DB70AA85CF90

Function 06B2EF10 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcb9e135ee9adfeed931d5c6b22e6598101f6c9bf3b47f42ca50db4e119536e3
Instruction ID: a81d2d6a881e7825568431fd9aadba39bb893a0aa2a4c507cfa9cb43821de090
Opcode Fuzzy Hash: fcb9e135ee9adfeed931d5c6b22e6598101f6c9bf3b47f42ca50db4e119536e3
Instruction Fuzzy Hash: 7C715EB0E002199FDB54DFA9D980AAEB7F6FF88310F148569E109AB354DB34EC46CB40

Function 06B2EF20 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 716bc1f01435f854e6c42fcdf123cd5d92dcef1490b9d9b872271748461edafd
Instruction ID: 7756251f34bcd1ae7c41de1d439eaa26e15a22082964a9c85c2bf2351756e45e
Opcode Fuzzy Hash: 716bc1f01435f854e6c42fcdf123cd5d92dcef1490b9d9b872271748461edafd
Instruction Fuzzy Hash: B6713F70A002199FDB54DFA9D980AAEB7F6FF84310F148569E509AB354DB34EC46CB50

Function 06B24B48 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7586e9b8358ee3755a7741a7c5587795dbf8ce5acb7141b97ec544ba3200159
Instruction ID: 851e2f1011f5f0847543ecdc800d740073047c50fbbf1828bc5878e9d8a9466f
Opcode Fuzzy Hash: c7586e9b8358ee3755a7741a7c5587795dbf8ce5acb7141b97ec544ba3200159
Instruction Fuzzy Hash: 9B619570F002199FEB549FA8C8157AEBBF6FF88350F208569E109AB794DE755C41CB90

Function 06B2FA28 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a820a806f4ac3a56599b193af93642ba7b7ca93408cf48b1b331d37c40c373d7
Instruction ID: 55ba6cb39e2fe8068ba8cddaaf6dbe07e1ee970f9317ba2bc2bf90a0881b4392
Opcode Fuzzy Hash: a820a806f4ac3a56599b193af93642ba7b7ca93408cf48b1b331d37c40c373d7
Instruction Fuzzy Hash: 5E51C4B0F202259BEF645ABCD85477F66AED78A710F104576E40FE7395C92CCC8287A2

Function 06B2FC88 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 000ec54cabe1fb9969d3dbd7ed5da10d874b040fae1779f6a7523c562f2c1427
Instruction ID: 5a477c4ba41e314a76c79afa7047c9b8092feb76bea7db030789f8d2356e207a
Opcode Fuzzy Hash: 000ec54cabe1fb9969d3dbd7ed5da10d874b040fae1779f6a7523c562f2c1427
Instruction Fuzzy Hash: E251F171E50226CFDB24AF78E4446BDBBF6FB88350F1089B9E10AD7250DB359845CB80

Function 06B2FA38 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a4ea8cb4b84d4a2c1d32157042ba2f9072a97777c1b35929ce3b1ca61afe0fe
Instruction ID: 0416372d40104a267931dcd3c242433bffb73be210af971ac0b5cd5469c3f736
Opcode Fuzzy Hash: 7a4ea8cb4b84d4a2c1d32157042ba2f9072a97777c1b35929ce3b1ca61afe0fe
Instruction Fuzzy Hash: 735193B0F202259BEF645ABCD85477F66AED78A710F20443AE50FD7395C96CCC828792

Function 06B24B39 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71518ef0c94c33dc4e0845921c9489f871bc6d04d52a2cba16671860e8c85063
Instruction ID: 00bbc91dbce4617304c6c8f4647ab981d8c458fbf63dd2c7f7362512db928791
Opcode Fuzzy Hash: 71518ef0c94c33dc4e0845921c9489f871bc6d04d52a2cba16671860e8c85063
Instruction Fuzzy Hash: CA518070F002189BDB549BA8C815BAEBAF6FF88310F248569E105AF794DE759C01CB90

Function 06B25400 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ea62e193b59cd17764e3f9ffa385b6ab79d7217538f6a3b46f9b14c22f5e7a7
Instruction ID: a78adc4ac1b3966df5359f6fb14bf0e2be7916976cea041cd2080f53d87f2795
Opcode Fuzzy Hash: 7ea62e193b59cd17764e3f9ffa385b6ab79d7217538f6a3b46f9b14c22f5e7a7
Instruction Fuzzy Hash: 56418372E0061A8FDF70CFA9D881BAFF7F2FB44210F10496AD219D7604D630E9558B91

Function 06B24B70 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c318b1bd005ba201de44650f86e5d62ee5e57413f3f4026862d564257170345
Instruction ID: c80ed272531f2cbff1eeab34f207c4026417438b4f5ae64f6df4253ddedf2fb7
Opcode Fuzzy Hash: 6c318b1bd005ba201de44650f86e5d62ee5e57413f3f4026862d564257170345
Instruction Fuzzy Hash: 10414F74F002199FEB549FA8C455BAEBAF2FF88710F24852EE105AF794DA749C41CB90

Function 06B2D968 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a890262004dd8c33d9b19bf9afc5c2787bf831b9a545b31d0dfb4a975ec20ffb
Instruction ID: e2f8ea9ce92dadedc5b28bf58db271bff3ae1a6ed672993d165d861f664ff7ef
Opcode Fuzzy Hash: a890262004dd8c33d9b19bf9afc5c2787bf831b9a545b31d0dfb4a975ec20ffb
Instruction Fuzzy Hash: 7231C470E1071A9BDB24DF69C880ADEB7F2FF85300F104A29E505EB241EB70E9468B81

Function 06B22078 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d58c7537b0f53c5cf0e7282d888425f0979528d3f195578266aa55328b2f1961
Instruction ID: 80ebc64085d0a4b7103a0748be17b12253cec6aff48b2dabcb0298723c46f2af
Opcode Fuzzy Hash: d58c7537b0f53c5cf0e7282d888425f0979528d3f195578266aa55328b2f1961
Instruction Fuzzy Hash: ED31A374E106169BDB58CF64C894A9EB7F2FF89300F148569E806EB350DB71ED86CB40

Function 06B22088 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b9767438661c0a934ace9b2ae27926015528ccd2bc4ad9982e8943613e4a21
Instruction ID: 8ce3a3d8a2c8ebe5cad237884542ea31ce129c829bf2721468d7cc824f1c3245
Opcode Fuzzy Hash: 08b9767438661c0a934ace9b2ae27926015528ccd2bc4ad9982e8943613e4a21
Instruction Fuzzy Hash: 54316F74E106169BDB18CF64D854A9EB7F2FF89300F108569E806EB350DB71ED82CB40

Function 06B23A88 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 690c5e924eab8d6eb99504d777fb127710db49ce17ae175ea9db347f4e77abe9
Instruction ID: edb10963bd80471ab98800988e54a4c77c9b104a6b124ec5b8b287050d0a4593
Opcode Fuzzy Hash: 690c5e924eab8d6eb99504d777fb127710db49ce17ae175ea9db347f4e77abe9
Instruction Fuzzy Hash: 98213DB5E002259FDB50CF69D990BAEBBF5EB48310F148479E90AE7350E639DD40CB90

Function 06B23A78 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de44827c6d57ed43926daf7fa755a8d486c6962d633f966b019edc6916e2a712
Instruction ID: 6d8c31c4a318c8c1d165da3835e60cd34264befba2f433c40f932dc5c63f8a5b
Opcode Fuzzy Hash: de44827c6d57ed43926daf7fa755a8d486c6962d633f966b019edc6916e2a712
Instruction Fuzzy Hash: ED213BB6E102159FDB50CF68D990BAEBBF1EB48310F148466E90AE7390E739D9418B90

Function 06B26D00 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dd87baf32d2fa791ac1bb2c85cbad9344c137c96f44a627f807d7a46b4802ec
Instruction ID: 76e6ff292eeeecc12b66bac7b920d45e1f4dddff058b0a227ef291691ce6020f
Opcode Fuzzy Hash: 7dd87baf32d2fa791ac1bb2c85cbad9344c137c96f44a627f807d7a46b4802ec
Instruction Fuzzy Hash: 9221A171B101299BCF44DF69E8947AEB7E2EB84350F249579E409EB340EA35EC41CB80

Function 0110D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2524891471.000000000110D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0110D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_110d000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5467be066389e2c1ac31938cb11d8b706b54c6d3a397c3444bcead782592aac
Instruction ID: f873261ec91b40f45721bd12a2052587a69660eeaea9ce924a13a54beda3de89
Opcode Fuzzy Hash: c5467be066389e2c1ac31938cb11d8b706b54c6d3a397c3444bcead782592aac
Instruction Fuzzy Hash: F221F171904304EFDF1ADFA4E980B26BB61FB84314F20C5ADE80D0B296C7B6D446CA62

Function 06B23B98 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d34eef26dd2dc325e927c219056d5a59aed212de1b5f71a9e059466105add46c
Instruction ID: d23f3d27c62740dc384e61f21b3491731c2f0c27912674e8d98f551a0d2ed1ac
Opcode Fuzzy Hash: d34eef26dd2dc325e927c219056d5a59aed212de1b5f71a9e059466105add46c
Instruction Fuzzy Hash: AC118E71B102298FDB989A79C8147AE77E6EBC8710F004179D90AE7348EE78DC0287D0

Function 06B23038 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ac9e2bc05272f27199469c05e99034a6b890615f08b57ba2a776c0d4c8eb02b
Instruction ID: 029876828135d0d0ffeebe25a688250ef7863f366b3de8452dfea0468e02d7de
Opcode Fuzzy Hash: 2ac9e2bc05272f27199469c05e99034a6b890615f08b57ba2a776c0d4c8eb02b
Instruction Fuzzy Hash: 500184B1E002299BCB64DBB9D8506DEF7F5EB89310F1485A9E509E7340EA35D941CBE0

Function 06B241D8 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 335fd52f282d80add0c4327df25c07e576790063b3f033e775dc2eea6fffac6e
Instruction ID: 372ff2ea1ca2021a54bd5695f354338cd521ef6275482f97adc2ecb5c011475e
Opcode Fuzzy Hash: 335fd52f282d80add0c4327df25c07e576790063b3f033e775dc2eea6fffac6e
Instruction Fuzzy Hash: A001F7B5F101214FDB6195BDD81572AB7D6EBD9710F24887AE10ECBB89EDA4DC024381

Function 0110D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2524891471.000000000110D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0110D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_110d000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e088ad8a07711d9d3566a887b1f888bc4d4e2f61ff705deeaaa2a632ac83149
Instruction ID: 9e20c4551e19e1f623ab4e53d62bab010c1d81fdcf282d020080dd646f35c2d7
Opcode Fuzzy Hash: 9e088ad8a07711d9d3566a887b1f888bc4d4e2f61ff705deeaaa2a632ac83149
Instruction Fuzzy Hash: 3711EE75904240DFCB16CF54E9C0B15BF61FB44314F24C6A9D8494B696C33AD40ACF52

Function 06B2A300 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c464e64f615d2f9c4837802020aa74517f1814d514fcf82616a9693aedad67f0
Instruction ID: b03454625b6bc250018f517601a640b6adb7bb3cd561ac4f71b2e223462789c4
Opcode Fuzzy Hash: c464e64f615d2f9c4837802020aa74517f1814d514fcf82616a9693aedad67f0
Instruction Fuzzy Hash: 8B0184B1B001115FDBA1DA6CE864B6EB3D6FB8A754F11987AE40EC7384DA25DC028781

Function 06B23850 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bd3377871ffb533ae035c4af4e8e6d74bc32ab4ee6d06598d4bf0958d698857
Instruction ID: 24b3e331c9b8d86ed7fd70cb73ce31dc6f8898cb60db4348ead6a4e52be583ab
Opcode Fuzzy Hash: 3bd3377871ffb533ae035c4af4e8e6d74bc32ab4ee6d06598d4bf0958d698857
Instruction Fuzzy Hash: 5E2100B1D01259EFDB10CF9AD884ACEFBF4FB48314F10816AE918A7200C3796944CFA5

Function 06B23858 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1da3aab0c0be0a4a8bd088cd9f02b3b740b9f9253c8f7e859c0b31839129bb0
Instruction ID: a4ab0ed66027f5907ed6fbc6526b11fe3c162ffb3f9ecde6701314ab8daa9078
Opcode Fuzzy Hash: e1da3aab0c0be0a4a8bd088cd9f02b3b740b9f9253c8f7e859c0b31839129bb0
Instruction Fuzzy Hash: 1011D0B5D01219AFDB10CF9AD884ACEFBF4FB48314F10812AE918A7240C379A954CFA5

Function 06B2F191 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bec577c3ac7ba44335eb015a74f502b2e48ea1dcb72f2986a8e2ffe495b52228
Instruction ID: a836ed9815ec20ce2f0d585aab893dd8bd6beea68587fa368e509be7aac1f64e
Opcode Fuzzy Hash: bec577c3ac7ba44335eb015a74f502b2e48ea1dcb72f2986a8e2ffe495b52228
Instruction Fuzzy Hash: 5201D475B101610BDB65DA6C9894B7B77E6EBCA211F14887AF40ECB345E924DC028385

Function 06B23B88 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea8c970a6b2ad22c804ca47835127e7fe737a109aec66a97effec5e49277a17c
Instruction ID: fdb9d4c5bf1039b848fc9280e4d389f449425015609926c4bb82ceced2f022da
Opcode Fuzzy Hash: ea8c970a6b2ad22c804ca47835127e7fe737a109aec66a97effec5e49277a17c
Instruction Fuzzy Hash: AD01D4B6B101254BEB9499688C157FE67E7D7C8700F154076D90AD7388EE28CC024791

Function 06B241E8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9f5264c77b8d95f04ba5b422ee9972f19c7f03516032697e5b47589215a8cce
Instruction ID: 009a192133f8233ad00cabfe454fc3f9ef4323999d70cc88fdf1652f6ef7f5e6
Opcode Fuzzy Hash: c9f5264c77b8d95f04ba5b422ee9972f19c7f03516032697e5b47589215a8cce
Instruction Fuzzy Hash: 9301D1B0B201250BDB6499AED815B2BB6DAEBC9710F24C43AE50ECBB44EDA5DC024391

Function 06B2F1A0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca6e69662556f594a9f0cd6e1c3963dda731adbdbfc67ebe8dbea59b4b597981
Instruction ID: dd43d932bf332ea14754eb9deb4731846badc3e90d057f6c88db231a535d0d98
Opcode Fuzzy Hash: ca6e69662556f594a9f0cd6e1c3963dda731adbdbfc67ebe8dbea59b4b597981
Instruction Fuzzy Hash: 0E0181B5B101220BDB64D96C9894B3F76EAEBC9611F148879F50ECB340ED25DC424385

Function 06B2A310 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 351bd9bc60738ffd00204a8cdb1fcf74a2914c68476327e0b2a5742400f52c2f
Instruction ID: fcf65dad4fe2a3a15dae27c4c0e315b3bed239fd48793e761c8b93e38051d0d1
Opcode Fuzzy Hash: 351bd9bc60738ffd00204a8cdb1fcf74a2914c68476327e0b2a5742400f52c2f
Instruction Fuzzy Hash: E90181B0B001215BDB70DA6CE854B1EB3D5FB89B14F109879E50EC7344E925DC018781

Function 06B2C7C8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1044527b3b7ca8a4c796070c74e12d842d0edb63b60c4fb43a4b1640d204006
Instruction ID: 7035e68a703b5d7926b55bce951d004da291e69808716d623166018cbf421df3
Opcode Fuzzy Hash: f1044527b3b7ca8a4c796070c74e12d842d0edb63b60c4fb43a4b1640d204006
Instruction Fuzzy Hash: 88F0A772F202389BDB545A65D80559EB7BAE784354F004479E905BB244D776AC1087C0

Function 06B26461 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b48509bcbddd25c393097eaf3f15b8d35943710fd86bbb300c4ea63bb0e367f8
Instruction ID: 47f4a35175f07a54e22cf40f88eb5c89531a1f363998e7aed9b6dc3192691b89
Opcode Fuzzy Hash: b48509bcbddd25c393097eaf3f15b8d35943710fd86bbb300c4ea63bb0e367f8
Instruction Fuzzy Hash: DFE0D8F2D111155BDB90DE708A5535A77E5D741204F2059E1C05CDB141F236ED414340

Function 06B26470 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 105533289c672c70b77a2127566478a11c6e4a8ee0802eacdb3449de9dbea2de
Instruction ID: 5e2bd2139e7ec799f7f5314f3fdaf087e3b2defaaac1ce74d5752d6bb4fa5724
Opcode Fuzzy Hash: 105533289c672c70b77a2127566478a11c6e4a8ee0802eacdb3449de9dbea2de
Instruction Fuzzy Hash: 27E0C2F1E2111AABDF50DEB0C94575E77EDD701204F2088E4D45CDB201F136DE014380

Non-executed Functions

Function 06B27698 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$q, xrefs: 06B277A3
$q, xrefs: 06B277D4
$q, xrefs: 06B27BFF
$q, xrefs: 06B27B60
$q, xrefs: 06B27B6C
$q, xrefs: 06B277E0
$q, xrefs: 06B27C15
$q, xrefs: 06B27C21
$q, xrefs: 06B27C0B
$q, xrefs: 06B277AF

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-1298971921
Opcode ID: a805180f2806fa987473465824c0ef1383d7b7724fc5a4cae5fac8cb40172811
Instruction ID: 5e14b429bc91720325f54a3600560151887e7ba19e5513685c2cd5b207ef2acc
Opcode Fuzzy Hash: a805180f2806fa987473465824c0ef1383d7b7724fc5a4cae5fac8cb40172811
Instruction Fuzzy Hash: 3F12FA70E0022A8FDB64DF69C954A9DB7F2FF89704F2485B9D40AAB254DB349D81CB84

Function 06B2A930 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$q, xrefs: 06B2AAEE
$q, xrefs: 06B2AAB8
$q, xrefs: 06B2AAAC
$q, xrefs: 06B2AA26
$q, xrefs: 06B2AA81
$q, xrefs: 06B2AA32
$q, xrefs: 06B2AA8D
$q, xrefs: 06B2AAE2

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-3886557441
Opcode ID: 0eff9594f6ad222b4d5566db25e152c0c336cbad41f07c690f3bc6af491f3b13
Instruction ID: c0546cef43b9bcecbafa2bacca31fe4dd58c94f0689f96ff318bc2ce64799dc4
Opcode Fuzzy Hash: 0eff9594f6ad222b4d5566db25e152c0c336cbad41f07c690f3bc6af491f3b13
Instruction Fuzzy Hash: EE9173B0E0021ADFEB68DF65DA5476EB7F2FF44700F108569E406AB294DB789C41CB90

Function 06B27098 Relevance: 7.9, Strings: 6, Instructions: 405COMMON

Download Yara Rule

Strings

$q, xrefs: 06B273D4
$q, xrefs: 06B27534
$q, xrefs: 06B275AC
$q, xrefs: 06B2737A
$q, xrefs: 06B275A0
$q, xrefs: 06B273E0

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q
API String ID: 0-2069967915
Opcode ID: 5afff16dce9fa812b69c0b2abee5568aa1ca0ea1ddd63c796194adfe18ce8ac3
Instruction ID: 436aea1dc4018a2592ae84dca1702593f809713ab9f4233f9d3fe21b5ec8eb8a
Opcode Fuzzy Hash: 5afff16dce9fa812b69c0b2abee5568aa1ca0ea1ddd63c796194adfe18ce8ac3
Instruction Fuzzy Hash: 61F11A70A00216CFDB59DF68C594A6EB7F2FF84304F248569E406AB394DB79EC42CB85

Function 06B283D0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$q, xrefs: 06B28636
$q, xrefs: 06B2869B
$q, xrefs: 06B2862A
$q, xrefs: 06B2868F

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: 4352c6fa91c5ae4a56c32672f42868efc0c6ca4eedec22e4d87a65c76d6a9a38
Instruction ID: 986ae10852577d5b3c1574a30fb285d609147e1fdb6e95e1d941e38f0e2a55c9
Opcode Fuzzy Hash: 4352c6fa91c5ae4a56c32672f42868efc0c6ca4eedec22e4d87a65c76d6a9a38
Instruction Fuzzy Hash: BFB14970B0021A8BDB68DF68D5947AEB7F2FF84314F248569D40A9B394DA74DC86CB80

Function 06B287E8 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LRq, xrefs: 06B2892A
$q, xrefs: 06B28867
$q, xrefs: 06B28873
LRq, xrefs: 06B288DB

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID: LRq$LRq$$q$$q
API String ID: 0-2204215535
Opcode ID: 060e1cccbcfbcb5f39bb315b9699e9fb25e4d9d5180e079a4065184e7b44e82a
Instruction ID: 036f693b75a91b61013276555a78e9db47b4181bf17f9166f28e5a12389b9cc1
Opcode Fuzzy Hash: 060e1cccbcfbcb5f39bb315b9699e9fb25e4d9d5180e079a4065184e7b44e82a
Instruction Fuzzy Hash: 9951AE70B002128FDB58DF68C844A6AB7F2FF88310F1486A9E50A9F395DA34EC45CB91

Function 06B2ACB8 Relevance: 5.2, Strings: 4, Instructions: 160COMMON

Download Yara Rule

Strings

$q, xrefs: 06B2AE3C
$q, xrefs: 06B2ADE9
$q, xrefs: 06B2AE6B
$q, xrefs: 06B2AE94

Memory Dump Source

Source File: 00000018.00000002.2541943581.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6b20000_GlIToApjgGEL.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: 6aa42bdfba9d9637bbf9b608fa770f5bc1dc4976c0233e5b0e1c2d06526cc3fc
Instruction ID: 08dbd7706669d1afdd3d546d1f725c24f5ccb27ff48099a3082740f2ea660567
Opcode Fuzzy Hash: 6aa42bdfba9d9637bbf9b608fa770f5bc1dc4976c0233e5b0e1c2d06526cc3fc
Instruction Fuzzy Hash: E8516570E102168FDF65DF68D5806ADB3F2FB88211F2455A9D809EB254DB35DC42CB51

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LisectAVT_2403002A_133.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\GlIToApjgGEL.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\LisectAVT_2403002A_133.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bolbem2p.ywk.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_edkdearx.j4a.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gzobwmys.b1z.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j5qnhrc5.din.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_keacwpii.npm.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mfvtdh0q.nwy.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sou4er2x.uuf.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xwftd0m5.fpn.psm1

Windows Analysis Report
LisectAVT_2403002A_133.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre