Edit tour

Windows Analysis Report
Ke5ufWcgxp.exe

Overview

General Information

Sample name:	Ke5ufWcgxp.exe renamed because original name is a hash value
Original sample name:	85b0f825ec9f8661f2b1237a0e33ad06.exe
Analysis ID:	1461288
MD5:	85b0f825ec9f8661f2b1237a0e33ad06
SHA1:	16a3542ada51249be3b3a2939b79447b817b7a02
SHA256:	9ae617395ad5440f6774902b04f331a59282737d0f3c897d9f21ab73c19b691e
Tags:	32exetrojan
Infos:

Detection

RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RisePro Stealer

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Found stalling execution ending in API Sleep call

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Uses schtasks.exe or at.exe to add and modify task schedules

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Ke5ufWcgxp.exe (PID: 6172 cmdline: "C:\Users\user\Desktop\Ke5ufWcgxp.exe" MD5: 85B0F825EC9F8661F2B1237A0E33AD06)

schtasks.exe (PID: 4024 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 4408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 2504 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MPGPH131.exe (PID: 320 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 85B0F825EC9F8661F2B1237A0E33AD06)

MPGPH131.exe (PID: 6152 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 85B0F825EC9F8661F2B1237A0E33AD06)

RageMP131.exe (PID: 7356 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 85B0F825EC9F8661F2B1237A0E33AD06)

RageMP131.exe (PID: 7692 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 85B0F825EC9F8661F2B1237A0E33AD06)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: Ke5ufWcgxp.exe PID: 6172	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 320	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 6152	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 7356	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 7692	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Ke5ufWcgxp.exe, ProcessId: 6172, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131

Snort Signatures

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 77.91.77.66

Timestamp:	06/23/24-16:17:36.899727
SID:	2046269
Source Port:	49707
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 77.91.77.66

Timestamp:	06/23/24-16:17:38.200223
SID:	2046269
Source Port:	49716
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.5

Timestamp:	06/23/24-16:17:04.473158
SID:	2046267
Source Port:	58709
Destination Port:	49716
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.5

Timestamp:	06/23/24-16:15:23.534284
SID:	2046266
Source Port:	58709
Destination Port:	49716
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 77.91.77.66

Timestamp:	06/23/24-16:17:36.899737
SID:	2046269
Source Port:	49706
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 77.91.77.66

Timestamp:	06/23/24-16:17:37.415514
SID:	2046269
Source Port:	49708
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN RisePro TCP Heartbeat Packet - Source IP: 192.168.2.5 - Destination IP: 77.91.77.66

Timestamp:	06/23/24-16:15:00.772679
SID:	2049060
Source Port:	49705
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.5

Timestamp:	06/23/24-16:17:01.678127
SID:	2046267
Source Port:	58709
Destination Port:	49706
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 77.91.77.66

Timestamp:	06/23/24-16:17:36.603047
SID:	2046269
Source Port:	49705
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.5

Timestamp:	06/23/24-16:17:02.960524
SID:	2046267
Source Port:	58709
Destination Port:	49708
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.5

Timestamp:	06/23/24-16:15:15.298112
SID:	2046266
Source Port:	58709
Destination Port:	49708
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.5

Timestamp:	06/23/24-16:17:01.182074
SID:	2046267
Source Port:	58709
Destination Port:	49705
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.5

Timestamp:	06/23/24-16:17:01.624141
SID:	2046267
Source Port:	58709
Destination Port:	49707
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.5

Timestamp:	06/23/24-16:15:01.352624
SID:	2046266
Source Port:	58709
Destination Port:	49705
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.5

Timestamp:	06/23/24-16:15:05.509073
SID:	2046266
Source Port:	58709
Destination Port:	49707
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.5

Timestamp:	06/23/24-16:15:05.517411
SID:	2046266
Source Port:	58709
Destination Port:	49706
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	ReversingLabs: Detection: 44%
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Virustotal: Detection: 52%	Perma Link
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Virustotal: Detection: 52%	Perma Link

Multi AV Scanner detection for submitted file

Source: Ke5ufWcgxp.exe	ReversingLabs: Detection: 44%
Source: Ke5ufWcgxp.exe	Virustotal: Detection: 52%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Ke5ufWcgxp.exe

Joe Sandbox ML: detected

Source: Ke5ufWcgxp.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2049060 ET TROJAN RisePro TCP Heartbeat Packet 192.168.2.5:49705 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.5:49705
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49705 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.5:49707
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.5:49706
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49707 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49706 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.5:49708
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49708 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.5:49716
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49716 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 77.91.77.66:58709 -> 192.168.2.5:49705
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 77.91.77.66:58709 -> 192.168.2.5:49707
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 77.91.77.66:58709 -> 192.168.2.5:49706
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 77.91.77.66:58709 -> 192.168.2.5:49708
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 77.91.77.66:58709 -> 192.168.2.5:49716

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 77.91.77.66 ports 0,5,7,8,58709,9

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 77.91.77.66:58709

Source: Joe Sandbox View

IP Address: 77.91.77.66 77.91.77.66

Source: Joe Sandbox View

ASN Name: FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU

Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66

Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe

Code function: 0_2_00589280 recv,WSASend,

0_2_00589280

Source: Ke5ufWcgxp.exe, 00000000.00000003.2027583976.0000000005040000.00000004.00001000.00020000.00000000.sdmp, Ke5ufWcgxp.exe, 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000003.2056577894.0000000004B80000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3636595072.0000000000181000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000002.3636572214.0000000000181000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000003.2056606690.0000000004A70000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3637104339.0000000000701000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000008.00000003.2160020226.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.3636873038.0000000000701000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000003.2243205056.0000000004D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: RageMP131.exe, 0000000A.00000002.3647150748.000000000120C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: RageMP131.exe, 0000000A.00000002.3647150748.00000000011F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Namespace
Source: RageMP131.exe, 00000008.00000002.3646900740.000000000121E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/ameSpace/
Source: MPGPH131.exe, 00000006.00000002.3646874202.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/d0
Source: MPGPH131.exe, 00000007.00000002.3646701337.0000000000D5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/h
Source: Ke5ufWcgxp.exe, 00000000.00000003.2027583976.0000000005040000.00000004.00001000.00020000.00000000.sdmp, Ke5ufWcgxp.exe, 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000003.2056577894.0000000004B80000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3636595072.0000000000181000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000002.3636572214.0000000000181000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000003.2056606690.0000000004A70000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3637104339.0000000000701000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000008.00000003.2160020226.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.3636873038.0000000000701000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000003.2243205056.0000000004D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: RageMP131.exe, 00000008.00000002.3646900740.0000000001261000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/l
Source: Ke5ufWcgxp.exe, 00000000.00000002.3646592079.00000000011EC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3646874202.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3646701337.0000000000D4D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3646900740.000000000125C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.3647150748.00000000011FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33
Source: Ke5ufWcgxp.exe, 00000000.00000002.3646592079.00000000011EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33%Um
Source: MPGPH131.exe, 00000006.00000002.3646874202.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.330c
Source: RageMP131.exe, 00000008.00000002.3646900740.000000000121E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33t
Source: RageMP131.exe, 00000008.00000002.3646900740.000000000121E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33x
Source: Ke5ufWcgxp.exe, 00000000.00000002.3646592079.000000000117E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3646874202.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3646701337.0000000000D1A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3646900740.000000000121E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.3647150748.00000000011CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: MPGPH131.exe, 00000007.00000002.3646701337.0000000000D1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT(
Source: MPGPH131.exe, 00000006.00000002.3646874202.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTzn
Source: RageMP131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

System Summary

PE file contains section with special chars

Source: Ke5ufWcgxp.exe	Static PE information: section name:
Source: Ke5ufWcgxp.exe	Static PE information: section name: .idata
Source: Ke5ufWcgxp.exe	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name: .idata
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name: .idata
Source: MPGPH131.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Code function: 0_2_005BC960	0_2_005BC960
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Code function: 0_2_005BA928	0_2_005BA928
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Code function: 0_2_005B71A0	0_2_005B71A0
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Code function: 0_2_005CDA86	0_2_005CDA86
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Code function: 0_2_005C036F	0_2_005C036F
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Code function: 0_2_005D8BB0	0_2_005D8BB0
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Code function: 0_2_0066FC40	0_2_0066FC40
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Code function: 0_2_005AF580	0_2_005AF580
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Code function: 0_2_00672FD0	0_2_00672FD0
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Code function: 0_2_005D47BF	0_2_005D47BF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_001BA928	6_2_001BA928
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_001BC960	6_2_001BC960
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_001B71A0	6_2_001B71A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_001CDA86	6_2_001CDA86
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_001BAAEF	6_2_001BAAEF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_001C036F	6_2_001C036F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_001D8BB0	6_2_001D8BB0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0026FC40	6_2_0026FC40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_001AF580	6_2_001AF580
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_001D47BF	6_2_001D47BF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00272FD0	6_2_00272FD0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_001BA928	7_2_001BA928
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_001BC960	7_2_001BC960
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_001B71A0	7_2_001B71A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_001CDA86	7_2_001CDA86
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_001C036F	7_2_001C036F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_001D8BB0	7_2_001D8BB0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_0026FC40	7_2_0026FC40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_001AF580	7_2_001AF580
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_001D47BF	7_2_001D47BF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00272FD0	7_2_00272FD0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_0073C960	8_2_0073C960
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_0073A928	8_2_0073A928
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_007371A0	8_2_007371A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_0074DA86	8_2_0074DA86
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_0074036F	8_2_0074036F
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00758BB0	8_2_00758BB0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_007EFC40	8_2_007EFC40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_0072F580	8_2_0072F580
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00989680	8_2_00989680
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00752610	8_2_00752610
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_007F2FD0	8_2_007F2FD0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_007547BF	8_2_007547BF
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_0073C960	10_2_0073C960
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_0073A928	10_2_0073A928
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_007371A0	10_2_007371A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_0074DA86	10_2_0074DA86
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_0074036F	10_2_0074036F
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00758BB0	10_2_00758BB0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_007EFC40	10_2_007EFC40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_0072F580	10_2_0072F580
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00989680	10_2_00989680
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00752610	10_2_00752610
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_007F2FD0	10_2_007F2FD0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_007547BF	10_2_007547BF

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 001B4380 appears 48 times
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: String function: 00734380 appears 48 times

Source: Ke5ufWcgxp.exe, 00000000.00000000.2019508227.000000000070A000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedotnet.exe6 vs Ke5ufWcgxp.exe
Source: Ke5ufWcgxp.exe	Binary or memory string: OriginalFilenamedotnet.exe6 vs Ke5ufWcgxp.exe

Source: Ke5ufWcgxp.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Ke5ufWcgxp.exe	Static PE information: Section: ZLIB complexity 0.998762545620438
Source: Ke5ufWcgxp.exe	Static PE information: Section: kwsiocfo ZLIB complexity 0.9946779737285539
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.998762545620438
Source: RageMP131.exe.0.dr	Static PE information: Section: kwsiocfo ZLIB complexity 0.9946779737285539
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.998762545620438
Source: MPGPH131.exe.0.dr	Static PE information: Section: kwsiocfo ZLIB complexity 0.9946779737285539

Source: classification engine

Classification label: mal100.troj.evad.winEXE@11/5@0/1

Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe

File created: C:\Users\user\AppData\Local\RageMP131

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4408:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5440:120:WilError_03

Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe

File created: C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Jump to behavior

Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Ke5ufWcgxp.exe, 00000000.00000003.2027583976.0000000005040000.00000004.00001000.00020000.00000000.sdmp, Ke5ufWcgxp.exe, 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000003.2056577894.0000000004B80000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3636595072.0000000000181000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000002.3636572214.0000000000181000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000003.2056606690.0000000004A70000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3637104339.0000000000701000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000008.00000003.2160020226.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.3636873038.0000000000701000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000003.2243205056.0000000004D30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: Ke5ufWcgxp.exe, 00000000.00000003.2027583976.0000000005040000.00000004.00001000.00020000.00000000.sdmp, Ke5ufWcgxp.exe, 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000003.2056577894.0000000004B80000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3636595072.0000000000181000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000002.3636572214.0000000000181000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000003.2056606690.0000000004A70000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3637104339.0000000000701000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000008.00000003.2160020226.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.3636873038.0000000000701000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000003.2243205056.0000000004D30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

Source: Ke5ufWcgxp.exe	ReversingLabs: Detection: 44%
Source: Ke5ufWcgxp.exe	Virustotal: Detection: 52%

Source: Ke5ufWcgxp.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: Ke5ufWcgxp.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: MPGPH131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: MPGPH131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: RageMP131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: RageMP131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: RageMP131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: RageMP131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe

File read: C:\Users\user\Desktop\Ke5ufWcgxp.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Ke5ufWcgxp.exe "C:\Users\user\Desktop\Ke5ufWcgxp.exe"
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior

Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll	Jump to behavior

Source: Ke5ufWcgxp.exe

Static file information: File size 2393600 > 1048576

Source: Ke5ufWcgxp.exe

Static PE information: Raw size of kwsiocfo is bigger than: 0x100000 < 0x198000

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Unpacked PE file: 0.2.Ke5ufWcgxp.exe.580000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kwsiocfo:EW;hhfhiasa:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;kwsiocfo:EW;hhfhiasa:EW;.taggant:EW;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 6.2.MPGPH131.exe.180000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kwsiocfo:EW;hhfhiasa:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;kwsiocfo:EW;hhfhiasa:EW;.taggant:EW;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 7.2.MPGPH131.exe.180000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kwsiocfo:EW;hhfhiasa:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;kwsiocfo:EW;hhfhiasa:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 8.2.RageMP131.exe.700000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kwsiocfo:EW;hhfhiasa:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;kwsiocfo:EW;hhfhiasa:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 10.2.RageMP131.exe.700000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kwsiocfo:EW;hhfhiasa:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;kwsiocfo:EW;hhfhiasa:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: Ke5ufWcgxp.exe	Static PE information: real checksum: 0x25769f should be: 0x25118b
Source: RageMP131.exe.0.dr	Static PE information: real checksum: 0x25769f should be: 0x25118b
Source: MPGPH131.exe.0.dr	Static PE information: real checksum: 0x25769f should be: 0x25118b

Source: Ke5ufWcgxp.exe	Static PE information: section name:
Source: Ke5ufWcgxp.exe	Static PE information: section name: .idata
Source: Ke5ufWcgxp.exe	Static PE information: section name:
Source: Ke5ufWcgxp.exe	Static PE information: section name: kwsiocfo
Source: Ke5ufWcgxp.exe	Static PE information: section name: hhfhiasa
Source: Ke5ufWcgxp.exe	Static PE information: section name: .taggant
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name: .idata
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name: kwsiocfo
Source: RageMP131.exe.0.dr	Static PE information: section name: hhfhiasa
Source: RageMP131.exe.0.dr	Static PE information: section name: .taggant
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name: .idata
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name: kwsiocfo
Source: MPGPH131.exe.0.dr	Static PE information: section name: hhfhiasa
Source: MPGPH131.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Code function: 0_2_005B3F59 push ecx; ret	0_2_005B3F6C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_001B3F59 push ecx; ret	6_2_001B3F6C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_001B3F59 push ecx; ret	7_2_001B3F6C
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00989680 push eax; mov dword ptr [esp], ebp	8_2_00989713
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00989680 push 6FD07C94h; mov dword ptr [esp], ebx	8_2_009897BE
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00989680 push edi; mov dword ptr [esp], 3DB8739Fh	8_2_009897EE
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00989680 push edi; mov dword ptr [esp], 57FFECEEh	8_2_00989874
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00989680 push edx; mov dword ptr [esp], ecx	8_2_009898AE
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00989680 push edx; mov dword ptr [esp], 00000000h	8_2_009898B5
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00733F59 push ecx; ret	8_2_00733F6C
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00989680 push eax; mov dword ptr [esp], ebp	10_2_00989713
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00989680 push 6FD07C94h; mov dword ptr [esp], ebx	10_2_009897BE
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00989680 push edi; mov dword ptr [esp], 3DB8739Fh	10_2_009897EE
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00989680 push edi; mov dword ptr [esp], 57FFECEEh	10_2_00989874
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00989680 push edx; mov dword ptr [esp], ecx	10_2_009898AE
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00989680 push edx; mov dword ptr [esp], 00000000h	10_2_009898B5
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00733F59 push ecx; ret	10_2_00733F6C

Source: Ke5ufWcgxp.exe	Static PE information: section name: entropy: 7.98581846796198
Source: Ke5ufWcgxp.exe	Static PE information: section name: kwsiocfo entropy: 7.9553136795218204
Source: RageMP131.exe.0.dr	Static PE information: section name: entropy: 7.98581846796198
Source: RageMP131.exe.0.dr	Static PE information: section name: kwsiocfo entropy: 7.9553136795218204
Source: MPGPH131.exe.0.dr	Static PE information: section name: entropy: 7.98581846796198
Source: MPGPH131.exe.0.dr	Static PE information: section name: kwsiocfo entropy: 7.9553136795218204

Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe			Jump to dropped file
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe			Jump to dropped file

Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe

File created: C:\ProgramData\MPGPH131\MPGPH131.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Stalling execution: Execution stalls by calling Sleep	graph_0-15853
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Stalling execution: Execution stalls by calling Sleep
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Stalling execution: Execution stalls by calling Sleep	graph_6-16840

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 7112AE second address: 7112B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8848D9 second address: 8848DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8848DD second address: 8848ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F35448276AAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8848ED second address: 884926 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F35449CBE3Bh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop ecx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F35449CBE46h 0x00000014 jng 00007F35449CBE3Eh 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c jng 00007F35449CBE36h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 884926 second address: 88493F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F35448276B0h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 87BF06 second address: 87BF0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 883881 second address: 88389B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F35448276B6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 88389B second address: 8838A7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8838A7 second address: 8838AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 883A21 second address: 883A25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 883A25 second address: 883A2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 883A2D second address: 883A46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F35449CBE36h 0x0000000a jmp 00007F35449CBE3Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 883A46 second address: 883A6C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F35448276B7h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 push eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 883A6C second address: 883A7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F35449CBE3Dh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 883ED1 second address: 883ED8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8841AD second address: 8841B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8841B3 second address: 8841BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F35448276A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8841BD second address: 8841C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 88837E second address: 88840F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F35448276ACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 289DE777h 0x00000011 call 00007F35448276ABh 0x00000016 xor cx, C76Dh 0x0000001b pop edi 0x0000001c push 00000003h 0x0000001e pushad 0x0000001f jbe 00007F35448276AAh 0x00000025 mov cx, C34Bh 0x00000029 popad 0x0000002a push 00000000h 0x0000002c sub dword ptr [ebp+122D199Ch], eax 0x00000032 push 00000003h 0x00000034 mov cx, F0B2h 0x00000038 sub dword ptr [ebp+122D1C25h], ecx 0x0000003e push FC73D8A7h 0x00000043 push esi 0x00000044 js 00007F35448276A8h 0x0000004a pop esi 0x0000004b xor dword ptr [esp], 3C73D8A7h 0x00000052 movsx edi, di 0x00000055 lea ebx, dword ptr [ebp+1244B218h] 0x0000005b xor ecx, dword ptr [ebp+122D39E0h] 0x00000061 xchg eax, ebx 0x00000062 jo 00007F35448276BBh 0x00000068 push edi 0x00000069 jmp 00007F35448276B3h 0x0000006e pop edi 0x0000006f push eax 0x00000070 pushad 0x00000071 push eax 0x00000072 push edx 0x00000073 push ecx 0x00000074 pop ecx 0x00000075 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 888468 second address: 8884A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F35449CBE36h 0x0000000a popad 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f jno 00007F35449CBE3Ch 0x00000015 push 00000000h 0x00000017 mov edx, dword ptr [ebp+122D2A49h] 0x0000001d mov edi, ecx 0x0000001f push 6789DCB7h 0x00000024 pushad 0x00000025 jns 00007F35449CBE3Ch 0x0000002b push ebx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 888562 second address: 8885C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35448276ADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b jns 00007F35448276ACh 0x00000011 pop esi 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 pushad 0x00000017 pushad 0x00000018 je 00007F35448276A6h 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 jmp 00007F35448276B4h 0x00000026 popad 0x00000027 mov eax, dword ptr [eax] 0x00000029 pushad 0x0000002a jmp 00007F35448276B6h 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8885C2 second address: 8885D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8885D7 second address: 888633 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F35448276A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pop eax 0x0000000c mov di, A8FDh 0x00000010 lea ebx, dword ptr [ebp+1244B221h] 0x00000016 push 00000000h 0x00000018 push ebp 0x00000019 call 00007F35448276A8h 0x0000001e pop ebp 0x0000001f mov dword ptr [esp+04h], ebp 0x00000023 add dword ptr [esp+04h], 00000019h 0x0000002b inc ebp 0x0000002c push ebp 0x0000002d ret 0x0000002e pop ebp 0x0000002f ret 0x00000030 xchg eax, ebx 0x00000031 pushad 0x00000032 jo 00007F35448276BFh 0x00000038 jmp 00007F35448276B9h 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 888633 second address: 888644 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F35449CBE36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 888644 second address: 888648 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8738F7 second address: 8738FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8A6DAC second address: 8A6DB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8A6DB0 second address: 8A6DDA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE43h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a jmp 00007F35449CBE40h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8A6DDA second address: 8A6DDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8A70E1 second address: 8A70EB instructions: 0x00000000 rdtsc 0x00000002 jno 00007F35449CBE36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8A752B second address: 8A7535 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8A7535 second address: 8A7539 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8A76B4 second address: 8A76C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8A76C1 second address: 8A76C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8A76C7 second address: 8A76D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8A7DD6 second address: 8A7DDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8A7DDE second address: 8A7DF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F35448276AEh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 87535A second address: 875373 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F35449CBE36h 0x00000009 jmp 00007F35449CBE3Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8A8090 second address: 8A80B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F35448276B3h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c jmp 00007F35448276AFh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8A80B9 second address: 8A80D4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F35449CBE3Ch 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8A80D4 second address: 8A80D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8A8622 second address: 8A862C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F35449CBE36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8A862C second address: 8A8630 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8A8630 second address: 8A8636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8A8636 second address: 8A8652 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F35448276B4h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8ADD44 second address: 8ADD4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F35449CBE36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8AF2C2 second address: 8AF2EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F35448276AFh 0x00000008 push esi 0x00000009 pop esi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F35448276B0h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8AF2EC second address: 8AF316 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F35449CBE38h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jnl 00007F35449CBE3Eh 0x00000014 mov eax, dword ptr [eax] 0x00000016 jc 00007F35449CBE40h 0x0000001c push eax 0x0000001d push edx 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8AF316 second address: 8AF32A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a jp 00007F35448276B8h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8AF32A second address: 8AF32E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B42E4 second address: 8B42F4 instructions: 0x00000000 rdtsc 0x00000002 js 00007F35448276B2h 0x00000008 jnp 00007F35448276A6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B393D second address: 8B3941 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B3941 second address: 8B394D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F35448276A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B3AED second address: 8B3AF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B41A8 second address: 8B41AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B6233 second address: 8B623C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B623C second address: 8B6259 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 321DD870h 0x0000000e call 00007F35448276A9h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B6259 second address: 8B625D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B625D second address: 8B6263 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B6410 second address: 8B642D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F35449CBE3Eh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B642D second address: 8B6431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B6431 second address: 8B6437 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B6966 second address: 8B696A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B696A second address: 8B6970 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B6A11 second address: 8B6A15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B723A second address: 8B7252 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F35449CBE44h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B74C9 second address: 8B74CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B7AB2 second address: 8B7AB8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B7AB8 second address: 8B7ABE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B93C0 second address: 8B93C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B93C4 second address: 8B93C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B93C8 second address: 8B93DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007F35449CBE36h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B93DA second address: 8B93E4 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F35448276A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B9F63 second address: 8B9F67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B9F67 second address: 8B9FD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007F35448276A8h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 jne 00007F35448276A9h 0x0000002a mov esi, 41C80BA0h 0x0000002f push 00000000h 0x00000031 sbb esi, 70CD8EB5h 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push ecx 0x0000003c call 00007F35448276A8h 0x00000041 pop ecx 0x00000042 mov dword ptr [esp+04h], ecx 0x00000046 add dword ptr [esp+04h], 00000014h 0x0000004e inc ecx 0x0000004f push ecx 0x00000050 ret 0x00000051 pop ecx 0x00000052 ret 0x00000053 push eax 0x00000054 jp 00007F35448276B4h 0x0000005a pushad 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8BA8D4 second address: 8BA8D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8BC2CD second address: 8BC2D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8BC2D1 second address: 8BC2D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 876F17 second address: 876F1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 876F1C second address: 876F22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8BC8DD second address: 8BC94A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 cld 0x00000008 pushad 0x00000009 movzx ecx, di 0x0000000c sub ecx, dword ptr [ebp+122D3B04h] 0x00000012 popad 0x00000013 push 00000000h 0x00000015 or esi, 18461109h 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push edi 0x00000020 call 00007F35448276A8h 0x00000025 pop edi 0x00000026 mov dword ptr [esp+04h], edi 0x0000002a add dword ptr [esp+04h], 0000001Dh 0x00000032 inc edi 0x00000033 push edi 0x00000034 ret 0x00000035 pop edi 0x00000036 ret 0x00000037 mov dword ptr [ebp+12463E55h], eax 0x0000003d mov dword ptr [ebp+122D1B87h], edx 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 jbe 00007F35448276BCh 0x0000004c jmp 00007F35448276B6h 0x00000051 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8BDF26 second address: 8BDF2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8BE722 second address: 8BE727 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8BE727 second address: 8BE731 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F35449CBE36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8C0AB0 second address: 8C0AD1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35448276B4h 0x00000007 jo 00007F35448276A6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8C1B48 second address: 8C1B52 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F35449CBE36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8C1D36 second address: 8C1DCD instructions: 0x00000000 rdtsc 0x00000002 jg 00007F35448276A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c jne 00007F35448276AEh 0x00000012 nop 0x00000013 push dword ptr fs:[00000000h] 0x0000001a sub ebx, 38999024h 0x00000020 mov dword ptr fs:[00000000h], esp 0x00000027 push 00000000h 0x00000029 push eax 0x0000002a call 00007F35448276A8h 0x0000002f pop eax 0x00000030 mov dword ptr [esp+04h], eax 0x00000034 add dword ptr [esp+04h], 0000001Dh 0x0000003c inc eax 0x0000003d push eax 0x0000003e ret 0x0000003f pop eax 0x00000040 ret 0x00000041 xor edi, 005C43DAh 0x00000047 mov eax, dword ptr [ebp+122D0171h] 0x0000004d push 00000000h 0x0000004f push eax 0x00000050 call 00007F35448276A8h 0x00000055 pop eax 0x00000056 mov dword ptr [esp+04h], eax 0x0000005a add dword ptr [esp+04h], 00000015h 0x00000062 inc eax 0x00000063 push eax 0x00000064 ret 0x00000065 pop eax 0x00000066 ret 0x00000067 mov bx, ax 0x0000006a mov di, 8677h 0x0000006e mov dword ptr [ebp+1246DDB6h], edi 0x00000074 push FFFFFFFFh 0x00000076 push eax 0x00000077 push eax 0x00000078 push edx 0x00000079 push ebx 0x0000007a jl 00007F35448276A6h 0x00000080 pop ebx 0x00000081 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8C2B60 second address: 8C2B66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8C2B66 second address: 8C2B6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8C3CF9 second address: 8C3CFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8C2B6B second address: 8C2B7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F35448276A6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8C4ADD second address: 8C4AE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8C3CFD second address: 8C3D03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8C4AE2 second address: 8C4B07 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a ja 00007F35449CBE38h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F35449CBE41h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8C3D03 second address: 8C3D08 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8C3D08 second address: 8C3D18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e pop eax 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8C3D18 second address: 8C3D1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8C4CB4 second address: 8C4CBE instructions: 0x00000000 rdtsc 0x00000002 jp 00007F35449CBE36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8C5B1B second address: 8C5B1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8C5B1F second address: 8C5B33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE40h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8C5D10 second address: 8C5D33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 push eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F35448276B6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8C8C59 second address: 8C8CEA instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F35449CBE38h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F35449CBE38h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 sub dword ptr [ebp+122D1B6Ah], ecx 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ebx 0x00000030 call 00007F35449CBE38h 0x00000035 pop ebx 0x00000036 mov dword ptr [esp+04h], ebx 0x0000003a add dword ptr [esp+04h], 0000001Ch 0x00000042 inc ebx 0x00000043 push ebx 0x00000044 ret 0x00000045 pop ebx 0x00000046 ret 0x00000047 sbb di, B392h 0x0000004c mov ebx, 04F0981Ch 0x00000051 push 00000000h 0x00000053 mov ebx, dword ptr [ebp+122D3A70h] 0x00000059 xchg eax, esi 0x0000005a pushad 0x0000005b jmp 00007F35449CBE44h 0x00000060 jbe 00007F35449CBE3Ch 0x00000066 popad 0x00000067 push eax 0x00000068 push ecx 0x00000069 push eax 0x0000006a push edx 0x0000006b pushad 0x0000006c popad 0x0000006d rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8C6E85 second address: 8C6E9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35448276ADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8C6E9C second address: 8C6EA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8C8F13 second address: 8C8F1D instructions: 0x00000000 rdtsc 0x00000002 jp 00007F35448276A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8CAD53 second address: 8CAD5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8CAD5F second address: 8CAD65 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8CAD65 second address: 8CADE9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE40h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007F35449CBE38h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 stc 0x00000025 mov dword ptr [ebp+1244BD91h], edx 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push edx 0x00000030 call 00007F35449CBE38h 0x00000035 pop edx 0x00000036 mov dword ptr [esp+04h], edx 0x0000003a add dword ptr [esp+04h], 00000016h 0x00000042 inc edx 0x00000043 push edx 0x00000044 ret 0x00000045 pop edx 0x00000046 ret 0x00000047 mov di, si 0x0000004a sbb ebx, 6BA4C17Ah 0x00000050 push 00000000h 0x00000052 movzx edi, ax 0x00000055 xchg eax, esi 0x00000056 jl 00007F35449CBE40h 0x0000005c push eax 0x0000005d jo 00007F35449CBE40h 0x00000063 pushad 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8CBE1B second address: 8CBE21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8CE41F second address: 8CE424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8D0522 second address: 8D055D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35448276AEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+122D1B87h], ebx 0x00000010 push 00000000h 0x00000012 mov dword ptr [ebp+1244BD1Ah], edx 0x00000018 push 00000000h 0x0000001a mov ebx, 67011E53h 0x0000001f xchg eax, esi 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F35448276AEh 0x00000029 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8D055D second address: 8D0561 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8CF891 second address: 8CF89B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F35448276A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8D0561 second address: 8D0567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8D0567 second address: 8D0585 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F35448276B3h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8D137C second address: 8D140A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007F35449CBE38h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 00000015h 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 mov ebx, edx 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push esi 0x0000002b call 00007F35449CBE38h 0x00000030 pop esi 0x00000031 mov dword ptr [esp+04h], esi 0x00000035 add dword ptr [esp+04h], 0000001Ch 0x0000003d inc esi 0x0000003e push esi 0x0000003f ret 0x00000040 pop esi 0x00000041 ret 0x00000042 push 00000000h 0x00000044 push 00000000h 0x00000046 push ebx 0x00000047 call 00007F35449CBE38h 0x0000004c pop ebx 0x0000004d mov dword ptr [esp+04h], ebx 0x00000051 add dword ptr [esp+04h], 0000001Bh 0x00000059 inc ebx 0x0000005a push ebx 0x0000005b ret 0x0000005c pop ebx 0x0000005d ret 0x0000005e push eax 0x0000005f pushad 0x00000060 push eax 0x00000061 push edx 0x00000062 pushad 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8D06A0 second address: 8D06A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8D14DA second address: 8D14E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8D14E0 second address: 8D14FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 pushad 0x00000008 jmp 00007F35448276B0h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8D2331 second address: 8D2361 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F35449CBE41h 0x00000008 jmp 00007F35449CBE3Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 jnl 00007F35449CBE45h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8D2361 second address: 8D23D7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 xor dword ptr [ebp+1245981Fh], eax 0x0000000e push dword ptr fs:[00000000h] 0x00000015 sub ebx, 571FBC13h 0x0000001b mov dword ptr fs:[00000000h], esp 0x00000022 mov ebx, 3A314EA0h 0x00000027 mov eax, dword ptr [ebp+122D0C55h] 0x0000002d push 00000000h 0x0000002f push ebp 0x00000030 call 00007F35448276A8h 0x00000035 pop ebp 0x00000036 mov dword ptr [esp+04h], ebp 0x0000003a add dword ptr [esp+04h], 00000017h 0x00000042 inc ebp 0x00000043 push ebp 0x00000044 ret 0x00000045 pop ebp 0x00000046 ret 0x00000047 mov dword ptr [ebp+1244A58Fh], ecx 0x0000004d push FFFFFFFFh 0x0000004f or dword ptr [ebp+1246E004h], ebx 0x00000055 nop 0x00000056 jmp 00007F35448276ACh 0x0000005b push eax 0x0000005c jc 00007F35448276B8h 0x00000062 push eax 0x00000063 push edx 0x00000064 jo 00007F35448276A6h 0x0000006a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 87A3FF second address: 87A405 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 87A405 second address: 87A40B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 87A40B second address: 87A40F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8D91EC second address: 8D91F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8D91F0 second address: 8D920C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jmp 00007F35449CBE41h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8D920C second address: 8D9211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8D9211 second address: 8D921B instructions: 0x00000000 rdtsc 0x00000002 jc 00007F35449CBE3Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8D94E8 second address: 8D950C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F35448276B6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8D950C second address: 8D9524 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F35449CBE38h 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pushad 0x00000012 popad 0x00000013 push esi 0x00000014 pop esi 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8E024C second address: 8E025C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8E0435 second address: 8E043F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F35449CBE36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8E051C second address: 8E0520 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8E613C second address: 8E6146 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F35449CBE36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8E6146 second address: 8E6165 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35448276AAh 0x00000007 jmp 00007F35448276B1h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8E53FE second address: 8E5404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8E5404 second address: 8E5408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8E55A8 second address: 8E55AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8E59DB second address: 8E59F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F35448276B5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8E5CB1 second address: 8E5CB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8E5CB5 second address: 8E5CB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8E5CB9 second address: 8E5CC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8E5CC1 second address: 8E5CC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8E5CC7 second address: 8E5CCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8E5FA6 second address: 8E5FAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 871CE8 second address: 871CEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 871CEC second address: 871CF8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jo 00007F35448276A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 871CF8 second address: 871D08 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F35449CBE38h 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8F232B second address: 8F2344 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35448276B5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8F2344 second address: 8F234A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8F234A second address: 8F234F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8F234F second address: 8F2357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B4B1B second address: 8B4B33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F35448276B3h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B4B33 second address: 89B626 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jng 00007F35449CBE49h 0x0000000e jmp 00007F35449CBE43h 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push edx 0x00000017 call 00007F35449CBE38h 0x0000001c pop edx 0x0000001d mov dword ptr [esp+04h], edx 0x00000021 add dword ptr [esp+04h], 00000019h 0x00000029 inc edx 0x0000002a push edx 0x0000002b ret 0x0000002c pop edx 0x0000002d ret 0x0000002e mov cx, F53Dh 0x00000032 lea eax, dword ptr [ebp+1247782Fh] 0x00000038 sub dword ptr [ebp+122D36E5h], esi 0x0000003e push eax 0x0000003f jmp 00007F35449CBE42h 0x00000044 mov dword ptr [esp], eax 0x00000047 call dword ptr [ebp+122D1A61h] 0x0000004d jc 00007F35449CBE50h 0x00000053 pushad 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B4D31 second address: 8B4D36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B5081 second address: 8B5087 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B5087 second address: 8B508B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B508B second address: 8B50AA instructions: 0x00000000 rdtsc 0x00000002 jc 00007F35449CBE36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F35449CBE40h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B51CA second address: 8B520C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 js 00007F35448276AEh 0x0000000f jbe 00007F35448276A8h 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 pushad 0x0000001a pushad 0x0000001b jmp 00007F35448276B6h 0x00000020 pushad 0x00000021 popad 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F35448276AAh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B5A99 second address: 8B5B1A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push esi 0x0000000a call 00007F35449CBE38h 0x0000000f pop esi 0x00000010 mov dword ptr [esp+04h], esi 0x00000014 add dword ptr [esp+04h], 0000001Dh 0x0000001c inc esi 0x0000001d push esi 0x0000001e ret 0x0000001f pop esi 0x00000020 ret 0x00000021 mov edi, dword ptr [ebp+122D383Ch] 0x00000027 push esi 0x00000028 call 00007F35449CBE44h 0x0000002d pushad 0x0000002e popad 0x0000002f pop edi 0x00000030 pop ecx 0x00000031 push 0000001Eh 0x00000033 push 00000000h 0x00000035 push ebx 0x00000036 call 00007F35449CBE38h 0x0000003b pop ebx 0x0000003c mov dword ptr [esp+04h], ebx 0x00000040 add dword ptr [esp+04h], 00000014h 0x00000048 inc ebx 0x00000049 push ebx 0x0000004a ret 0x0000004b pop ebx 0x0000004c ret 0x0000004d call 00007F35449CBE3Ch 0x00000052 mov dword ptr [ebp+122D1819h], esi 0x00000058 pop edi 0x00000059 push eax 0x0000005a push esi 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B5DE3 second address: 8B5DE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B5DE7 second address: 8B5DED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B5E90 second address: 8B5E96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B5E96 second address: 8B5EC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 or dword ptr [ebp+122D1885h], eax 0x0000000f and ecx, dword ptr [ebp+122D19E5h] 0x00000015 lea eax, dword ptr [ebp+12477873h] 0x0000001b jng 00007F35449CBE36h 0x00000021 mov dword ptr [ebp+12464392h], ebx 0x00000027 nop 0x00000028 push ebx 0x00000029 push eax 0x0000002a push edx 0x0000002b push edi 0x0000002c pop edi 0x0000002d rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B5EC3 second address: 8B5EC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B5EC7 second address: 8B5ED9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edi 0x00000009 pushad 0x0000000a jng 00007F35449CBE36h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8F16DB second address: 8F16F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F35448276AEh 0x0000000e js 00007F35448276A6h 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8F16F4 second address: 8F1705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F35449CBE3Ah 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8F1A41 second address: 8F1A47 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8F7D27 second address: 8F7D42 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE47h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8F7D42 second address: 8F7D47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8F67E3 second address: 8F67FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F35449CBE47h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8F6ABC second address: 8F6AC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8F6AC1 second address: 8F6AC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8F6AC8 second address: 8F6AD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8F6AD4 second address: 8F6AD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8F6AD9 second address: 8F6AE4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8F6C67 second address: 8F6C75 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F35449CBE36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8F6C75 second address: 8F6C79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8F6C79 second address: 8F6C84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8F7228 second address: 8F722C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8F64FF second address: 8F6517 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F35449CBE43h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8F6517 second address: 8F651D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8FD875 second address: 8FD885 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F35449CBE36h 0x0000000a jns 00007F35449CBE36h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8FC79D second address: 8FC7A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F35448276A6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8FC7A9 second address: 8FC7B2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8FC7B2 second address: 8FC7B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8FCBDA second address: 8FCBE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8FCBE0 second address: 8FCBE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8FD062 second address: 8FD080 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F35449CBE48h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8FD080 second address: 8FD095 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F35448276B0h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8FF641 second address: 8FF656 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F35449CBE3Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8FF787 second address: 8FF78B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8FF78B second address: 8FF7A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F35449CBE41h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9028B3 second address: 9028B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9028B7 second address: 9028BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 902338 second address: 902342 instructions: 0x00000000 rdtsc 0x00000002 js 00007F35448276A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 902342 second address: 90234C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 90234C second address: 902350 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 902350 second address: 902356 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 902356 second address: 902372 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F35448276B4h 0x00000008 jmp 00007F35448276AEh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 902372 second address: 902376 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9024CF second address: 9024E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F35448276B0h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 908E2D second address: 908E31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 908E31 second address: 908E37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 908E37 second address: 908E4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jp 00007F35449CBE36h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 907838 second address: 90783E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9079B9 second address: 9079D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE42h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9079D4 second address: 9079DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 907C8A second address: 907C96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F35449CBE36h 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 907C96 second address: 907C9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B5846 second address: 8B58BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 mov dword ptr [esp], eax 0x00000008 mov edx, dword ptr [ebp+122D199Ch] 0x0000000e mov ebx, dword ptr [ebp+1247786Eh] 0x00000014 jmp 00007F35449CBE49h 0x00000019 mov edi, dword ptr [ebp+122D38E8h] 0x0000001f add eax, ebx 0x00000021 push 00000000h 0x00000023 push esi 0x00000024 call 00007F35449CBE38h 0x00000029 pop esi 0x0000002a mov dword ptr [esp+04h], esi 0x0000002e add dword ptr [esp+04h], 00000015h 0x00000036 inc esi 0x00000037 push esi 0x00000038 ret 0x00000039 pop esi 0x0000003a ret 0x0000003b mov ecx, dword ptr [ebp+122D1A61h] 0x00000041 nop 0x00000042 jmp 00007F35449CBE41h 0x00000047 push eax 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c jmp 00007F35449CBE3Ah 0x00000051 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B58BF second address: 8B58C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B58C3 second address: 8B58C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 8B58C9 second address: 8B5914 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnl 00007F35448276A6h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov edx, dword ptr [ebp+122D3850h] 0x00000013 push 00000004h 0x00000015 push 00000000h 0x00000017 push esi 0x00000018 call 00007F35448276A8h 0x0000001d pop esi 0x0000001e mov dword ptr [esp+04h], esi 0x00000022 add dword ptr [esp+04h], 0000001Ch 0x0000002a inc esi 0x0000002b push esi 0x0000002c ret 0x0000002d pop esi 0x0000002e ret 0x0000002f mov dword ptr [ebp+122D2A25h], ebx 0x00000035 mov dword ptr [ebp+122D195Fh], ebx 0x0000003b push eax 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 908089 second address: 908097 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 908097 second address: 9080A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 90BA9A second address: 90BAA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 90FB5E second address: 90FB62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 90FB62 second address: 90FB6C instructions: 0x00000000 rdtsc 0x00000002 jl 00007F35449CBE36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 90FCB9 second address: 90FCBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 90FCBD second address: 90FCD0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE3Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 90FCD0 second address: 90FCD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 910285 second address: 91028A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 912BF1 second address: 912BFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 91A2E9 second address: 91A318 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F35449CBE36h 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push edx 0x0000000e pop edx 0x0000000f pushad 0x00000010 popad 0x00000011 push edi 0x00000012 pop edi 0x00000013 popad 0x00000014 pushad 0x00000015 je 00007F35449CBE36h 0x0000001b jl 00007F35449CBE36h 0x00000021 jmp 00007F35449CBE3Ch 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9182BA second address: 9182DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35448276B8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F35448276A6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9182DF second address: 9182FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE49h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9182FC second address: 918325 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F35448276AEh 0x0000000b push ebx 0x0000000c push edi 0x0000000d pop edi 0x0000000e push edi 0x0000000f pop edi 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F35448276ADh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 918490 second address: 9184B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F35449CBE36h 0x0000000a jmp 00007F35449CBE46h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9184B0 second address: 9184C3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jl 00007F35448276A6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9184C3 second address: 9184F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F35449CBE45h 0x00000009 jmp 00007F35449CBE3Eh 0x0000000e popad 0x0000000f pushad 0x00000010 jne 00007F35449CBE36h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9184F4 second address: 9184F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9184F9 second address: 9184FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 918D89 second address: 918D8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 91905B second address: 919073 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F35449CBE3Bh 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007F35449CBE36h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 919073 second address: 919082 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jp 00007F35448276A6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 919082 second address: 9190A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F35449CBE47h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9190A3 second address: 9190A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9190A9 second address: 9190C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 jg 00007F35449CBE3Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9190C0 second address: 9190D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F35448276B1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 919692 second address: 919697 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 919697 second address: 9196A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9196A1 second address: 9196A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9196A7 second address: 9196AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 919961 second address: 919975 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE3Ah 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 919975 second address: 919979 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 919979 second address: 91997F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 91997F second address: 919993 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F35448276B2h 0x0000000c jnc 00007F35448276A6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 919C89 second address: 919C8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 919C8F second address: 919C95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 919C95 second address: 919CAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007F35449CBE3Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 919F54 second address: 919F80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F35448276B4h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F35448276B1h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 91D37C second address: 91D389 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007F35449CBE36h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 91D389 second address: 91D38D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 91DEF5 second address: 91DF0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F35449CBE3Fh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 91DF0C second address: 91DF20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35448276AFh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 922BA7 second address: 922BC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jp 00007F35449CBE36h 0x0000000f jnp 00007F35449CBE36h 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 922BC0 second address: 922BC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 92A858 second address: 92A866 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F35449CBE3Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 92A866 second address: 92A86A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 928F31 second address: 928F37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 928F37 second address: 928F3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 928F3B second address: 928F3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9291C1 second address: 9291C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9291C7 second address: 9291CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9291CB second address: 9291CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9291CF second address: 9291E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F35449CBE42h 0x0000000c jne 00007F35449CBE36h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 92971C second address: 929727 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F35448276A6h 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 929727 second address: 92972F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 92972F second address: 929741 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F35448276A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnp 00007F35448276ACh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 92870C second address: 928726 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F35449CBE40h 0x00000009 je 00007F35449CBE36h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 928726 second address: 92872A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 931A29 second address: 931A30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 931B8D second address: 931B9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007F35448276A6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 931B9D second address: 931BB1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jbe 00007F35449CBE36h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 87D8A0 second address: 87D8A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 87D8A5 second address: 87D8AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 93EBAB second address: 93EBAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 94341F second address: 943423 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 945E1C second address: 945E20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 945E20 second address: 945E57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F35449CBE41h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c jnp 00007F35449CBE36h 0x00000012 jmp 00007F35449CBE48h 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 94B45B second address: 94B45F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9537DD second address: 9537E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9537E1 second address: 9537E6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9537E6 second address: 95381A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jo 00007F35449CBE42h 0x0000000b jng 00007F35449CBE36h 0x00000011 jno 00007F35449CBE36h 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F35449CBE48h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 95381A second address: 953834 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F35448276B0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 953834 second address: 953847 instructions: 0x00000000 rdtsc 0x00000002 je 00007F35449CBE36h 0x00000008 jp 00007F35449CBE36h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9585FA second address: 958604 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 95F801 second address: 95F810 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 95E901 second address: 95E909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 95E909 second address: 95E90D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 962E07 second address: 962E0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 975DA5 second address: 975DA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 975DA9 second address: 975DC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35448276B3h 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 975DC1 second address: 975DCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 975DCC second address: 975DD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 984DF3 second address: 984DF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 984DF9 second address: 984E00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 984E00 second address: 984E08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9B003B second address: 9B0041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9B0041 second address: 9B004C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9B01A6 second address: 9B01AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9B01AA second address: 9B01B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9B01B0 second address: 9B01B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9B01B9 second address: 9B01C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9B0301 second address: 9B0325 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F35448276B8h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9B0325 second address: 9B0350 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE3Eh 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F35449CBE3Eh 0x00000013 pop ebx 0x00000014 popad 0x00000015 push ecx 0x00000016 push ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9B0350 second address: 9B0359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9B0359 second address: 9B0363 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F35449CBE36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9B0363 second address: 9B0367 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9B04BE second address: 9B04C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9B04C4 second address: 9B04D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007F35448276ACh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9B04D3 second address: 9B04E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F35449CBE3Ch 0x0000000a pushad 0x0000000b popad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9B04E9 second address: 9B04EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9B04EF second address: 9B0501 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007F35449CBE36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9B0695 second address: 9B069B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9B069B second address: 9B06A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F35449CBE36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9B0A67 second address: 9B0A85 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F35448276B8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9B54E4 second address: 9B54E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9B555F second address: 9B5565 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9B5565 second address: 9B556A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 9B70EE second address: 9B70F3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 523064E second address: 5230654 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5200019 second address: 520001F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 520001F second address: 5200023 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5200023 second address: 5200039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F35448276ABh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5200039 second address: 520006F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c jmp 00007F35449CBE3Eh 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 520006F second address: 5200073 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5200073 second address: 5200077 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5200077 second address: 520007D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 520007D second address: 5200083 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5200083 second address: 5200087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5270061 second address: 5270066 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 51F0D4B second address: 51F0D4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 51F0D96 second address: 51F0DBA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 51F0DBA second address: 51F0DCD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35448276AFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 51F0DCD second address: 51F0DD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 51F0DD3 second address: 51F0DD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5240C1D second address: 5240C23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5240C23 second address: 5240C27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5240C27 second address: 5240C36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5240C36 second address: 5240C3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5240C3A second address: 5240C3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5240C3E second address: 5240C44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5240C44 second address: 5240C71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c movzx esi, bx 0x0000000f mov di, 78CCh 0x00000013 popad 0x00000014 pop ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F35449CBE3Eh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5270B6C second address: 5270B99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35448276B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F35448276ADh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5270B99 second address: 5270BE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, D3h 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F35449CBE3Fh 0x00000010 xchg eax, ebp 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F35449CBE44h 0x00000018 adc ax, 66D8h 0x0000001d jmp 00007F35449CBE3Bh 0x00000022 popfd 0x00000023 mov dh, ch 0x00000025 popad 0x00000026 mov ebp, esp 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5270BE6 second address: 5270BEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5270BEA second address: 5270BF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5270BF0 second address: 5270C3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F35448276B5h 0x00000009 and eax, 4CA8E926h 0x0000000f jmp 00007F35448276B1h 0x00000014 popfd 0x00000015 call 00007F35448276B0h 0x0000001a pop ecx 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e pop ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 push ecx 0x00000023 pop edi 0x00000024 pushad 0x00000025 popad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5270C3E second address: 5270C44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5200663 second address: 5200669 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5200669 second address: 520066D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 520066D second address: 5200671 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5260D7C second address: 5260D82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5260D82 second address: 5260DA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35448276ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d mov bl, 33h 0x0000000f mov edx, ecx 0x00000011 popad 0x00000012 xchg eax, ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5260DA1 second address: 5260DB0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5260DB0 second address: 5260DC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov cx, dx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5260DC3 second address: 5260DC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5260DC9 second address: 5260DCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 527039D second address: 52703BA instructions: 0x00000000 rdtsc 0x00000002 mov bx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F35449CBE44h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5240B7E second address: 5240B82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5240B82 second address: 5240B92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d mov edx, eax 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5240B92 second address: 5240B9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 230C074Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5270D1B second address: 5270D21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5270D21 second address: 5270D25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5270D25 second address: 5270D59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 pushad 0x0000000a mov ecx, 56441AD9h 0x0000000f movzx ecx, bx 0x00000012 popad 0x00000013 mov dword ptr [esp], ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov ax, 6C49h 0x0000001d jmp 00007F35449CBE46h 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5270D59 second address: 5270D86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, bl 0x00000005 call 00007F35448276AAh 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 mov di, 6C12h 0x00000015 mov si, bx 0x00000018 popad 0x00000019 pop ebp 0x0000001a pushad 0x0000001b call 00007F35448276ABh 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 522080A second address: 522085B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d pop edx 0x0000000e mov eax, 5915D735h 0x00000013 popad 0x00000014 pushfd 0x00000015 jmp 00007F35449CBE42h 0x0000001a jmp 00007F35449CBE45h 0x0000001f popfd 0x00000020 popad 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 522085B second address: 522085F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 522085F second address: 5220863 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5220863 second address: 5220869 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5220869 second address: 522086F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 522086F second address: 5220873 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5220873 second address: 5220877 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52808AC second address: 52808B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52808B0 second address: 52808B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52808B6 second address: 52808BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52808BC second address: 52808C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52808C0 second address: 52808C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52808C4 second address: 52808E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F35449CBE3Fh 0x00000011 mov eax, 482A2BCFh 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52808E5 second address: 5280932 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F35448276ABh 0x00000009 sub eax, 2810C4DEh 0x0000000f jmp 00007F35448276B9h 0x00000014 popfd 0x00000015 mov esi, 7CADB3A7h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e jmp 00007F35448276ADh 0x00000023 xchg eax, ebp 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 mov si, 3469h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5280932 second address: 5280966 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F35449CBE42h 0x0000000c or ecx, 519EEF38h 0x00000012 jmp 00007F35449CBE3Bh 0x00000017 popfd 0x00000018 popad 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5280966 second address: 528096A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 528096A second address: 5280970 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5280970 second address: 5280A4C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35448276AAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a jmp 00007F35448276B0h 0x0000000f push eax 0x00000010 pushad 0x00000011 call 00007F35448276B1h 0x00000016 pushfd 0x00000017 jmp 00007F35448276B0h 0x0000001c jmp 00007F35448276B5h 0x00000021 popfd 0x00000022 pop ecx 0x00000023 jmp 00007F35448276B1h 0x00000028 popad 0x00000029 xchg eax, ecx 0x0000002a pushad 0x0000002b pushfd 0x0000002c jmp 00007F35448276B3h 0x00000031 and ecx, 1E6B21CEh 0x00000037 jmp 00007F35448276B9h 0x0000003c popfd 0x0000003d popad 0x0000003e mov eax, dword ptr [76FA65FCh] 0x00000043 pushad 0x00000044 pushfd 0x00000045 jmp 00007F35448276B8h 0x0000004a add ax, 1D78h 0x0000004f jmp 00007F35448276ABh 0x00000054 popfd 0x00000055 popad 0x00000056 test eax, eax 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5280A4C second address: 5280A50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5280A50 second address: 5280A54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5280A54 second address: 5280A5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5280A5A second address: 5280A87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F35448276B8h 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e je 00007F35B64CA591h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5280A87 second address: 5280A9F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE44h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5280A9F second address: 5280AB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F35448276AEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5280AB1 second address: 5280AC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5280AC1 second address: 5280AD9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35448276B4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5280AD9 second address: 5280B6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F35449CBE41h 0x00000009 sbb ax, 24E6h 0x0000000e jmp 00007F35449CBE41h 0x00000013 popfd 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xor eax, dword ptr [ebp+08h] 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F35449CBE43h 0x00000023 adc eax, 4289A01Eh 0x00000029 jmp 00007F35449CBE49h 0x0000002e popfd 0x0000002f jmp 00007F35449CBE40h 0x00000034 popad 0x00000035 and ecx, 1Fh 0x00000038 jmp 00007F35449CBE40h 0x0000003d ror eax, cl 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5280B6E second address: 5280B72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5280B72 second address: 5280B78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5240085 second address: 52400A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35448276B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52400A0 second address: 524017D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F35449CBE3Ch 0x00000012 adc cl, FFFFFF98h 0x00000015 jmp 00007F35449CBE3Bh 0x0000001a popfd 0x0000001b mov cx, 2D4Fh 0x0000001f popad 0x00000020 and esp, FFFFFFF8h 0x00000023 pushad 0x00000024 jmp 00007F35449CBE40h 0x00000029 call 00007F35449CBE42h 0x0000002e pop edx 0x0000002f popad 0x00000030 xchg eax, ecx 0x00000031 pushad 0x00000032 pushfd 0x00000033 jmp 00007F35449CBE3Ah 0x00000038 or cl, 00000058h 0x0000003b jmp 00007F35449CBE3Bh 0x00000040 popfd 0x00000041 mov di, si 0x00000044 popad 0x00000045 push eax 0x00000046 pushad 0x00000047 call 00007F35449CBE3Eh 0x0000004c pushfd 0x0000004d jmp 00007F35449CBE42h 0x00000052 xor esi, 457631E8h 0x00000058 jmp 00007F35449CBE3Bh 0x0000005d popfd 0x0000005e pop eax 0x0000005f popad 0x00000060 xchg eax, ecx 0x00000061 jmp 00007F35449CBE3Fh 0x00000066 xchg eax, ebx 0x00000067 push eax 0x00000068 push edx 0x00000069 pushad 0x0000006a mov di, E806h 0x0000006e mov di, 7E92h 0x00000072 popad 0x00000073 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 524017D second address: 52401EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35448276B8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov bh, E5h 0x0000000d mov ah, DBh 0x0000000f popad 0x00000010 xchg eax, ebx 0x00000011 jmp 00007F35448276B5h 0x00000016 mov ebx, dword ptr [ebp+10h] 0x00000019 jmp 00007F35448276AEh 0x0000001e xchg eax, esi 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F35448276AEh 0x00000026 xor esi, 19149B68h 0x0000002c jmp 00007F35448276ABh 0x00000031 popfd 0x00000032 push eax 0x00000033 push edx 0x00000034 mov bx, si 0x00000037 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52401EF second address: 5240225 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 13F1D6F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007F35449CBE47h 0x00000010 xchg eax, esi 0x00000011 pushad 0x00000012 mov di, si 0x00000015 mov ecx, 35412F37h 0x0000001a popad 0x0000001b mov esi, dword ptr [ebp+08h] 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5240225 second address: 5240234 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35448276ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5240234 second address: 524027B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 call 00007F35449CBE45h 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007F35449CBE3Ch 0x00000014 mov dword ptr [esp], edi 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F35449CBE47h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 524027B second address: 5240281 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5240281 second address: 5240285 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5240285 second address: 5240289 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5240289 second address: 52402C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test esi, esi 0x0000000a jmp 00007F35449CBE47h 0x0000000f je 00007F35B66AA1A1h 0x00000015 pushad 0x00000016 movzx ecx, dx 0x00000019 mov bh, AEh 0x0000001b popad 0x0000001c cmp dword ptr [esi+08h], DDEEDDEEh 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52402C3 second address: 52402D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F35448276ABh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52402D3 second address: 52402FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, ebx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007F35B66AA184h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 call 00007F35449CBE43h 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52402FA second address: 52402FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52402FE second address: 5240315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 call 00007F35449CBE3Fh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5240315 second address: 524034A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 mov edx, dword ptr [esi+44h] 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushfd 0x0000000d jmp 00007F35448276B1h 0x00000012 adc si, 6DD6h 0x00000017 jmp 00007F35448276B1h 0x0000001c popfd 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 524034A second address: 52403BA instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 call 00007F35449CBE3Dh 0x0000000c pushad 0x0000000d popad 0x0000000e pop eax 0x0000000f popad 0x00000010 or edx, dword ptr [ebp+0Ch] 0x00000013 jmp 00007F35449CBE3Dh 0x00000018 test edx, 61000000h 0x0000001e jmp 00007F35449CBE3Eh 0x00000023 jne 00007F35B66AA138h 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007F35449CBE48h 0x00000032 xor si, D0B8h 0x00000037 jmp 00007F35449CBE3Bh 0x0000003c popfd 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52403BA second address: 524040A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F35448276AFh 0x00000009 or cx, 327Eh 0x0000000e jmp 00007F35448276B9h 0x00000013 popfd 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 test byte ptr [esi+48h], 00000001h 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F35448276B3h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5260153 second address: 5260157 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5260157 second address: 5260181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 and esp, FFFFFFF8h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007F35448276B9h 0x00000012 pop eax 0x00000013 mov ch, bl 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5260181 second address: 5260187 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5260187 second address: 526018B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 526018B second address: 52601B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE45h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F35449CBE3Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52601B6 second address: 526023E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov edi, 2CC00260h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f mov edx, eax 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 call 00007F35448276ACh 0x00000019 pop ecx 0x0000001a popad 0x0000001b popad 0x0000001c xchg eax, ebx 0x0000001d jmp 00007F35448276B1h 0x00000022 xchg eax, esi 0x00000023 jmp 00007F35448276AEh 0x00000028 push eax 0x00000029 jmp 00007F35448276ABh 0x0000002e xchg eax, esi 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 jmp 00007F35448276ABh 0x00000037 pushfd 0x00000038 jmp 00007F35448276B8h 0x0000003d xor ch, FFFFFF98h 0x00000040 jmp 00007F35448276ABh 0x00000045 popfd 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 526023E second address: 5260294 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F35449CBE3Ch 0x00000013 sub esi, 09895E28h 0x00000019 jmp 00007F35449CBE3Bh 0x0000001e popfd 0x0000001f mov ch, 27h 0x00000021 popad 0x00000022 mov ebx, 00000000h 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F35449CBE3Ah 0x00000030 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5260294 second address: 5260298 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5260298 second address: 526029E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 526029E second address: 52602AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F35448276ADh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52602AF second address: 5260323 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test esi, esi 0x0000000d jmp 00007F35449CBE3Eh 0x00000012 je 00007F35B6681EEEh 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F35449CBE3Eh 0x0000001f sbb esi, 67EC8548h 0x00000025 jmp 00007F35449CBE3Bh 0x0000002a popfd 0x0000002b push eax 0x0000002c pushad 0x0000002d popad 0x0000002e pop edi 0x0000002f popad 0x00000030 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F35449CBE47h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5260323 second address: 5260373 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35448276B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, esi 0x0000000b jmp 00007F35448276AEh 0x00000010 je 00007F35B64DD6F9h 0x00000016 jmp 00007F35448276B0h 0x0000001b test byte ptr [76FA6968h], 00000002h 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5260373 second address: 5260377 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5260377 second address: 526037D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 526037D second address: 52603A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE44h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F35B6681E57h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov edx, 704B8EE0h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52603A6 second address: 52603B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F35448276ABh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52603B5 second address: 5260474 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov edx, dword ptr [ebp+0Ch] 0x0000000e jmp 00007F35449CBE3Eh 0x00000013 xchg eax, ebx 0x00000014 jmp 00007F35449CBE40h 0x00000019 push eax 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F35449CBE41h 0x00000021 xor al, FFFFFFA6h 0x00000024 jmp 00007F35449CBE41h 0x00000029 popfd 0x0000002a pushfd 0x0000002b jmp 00007F35449CBE40h 0x00000030 adc esi, 1C3DD848h 0x00000036 jmp 00007F35449CBE3Bh 0x0000003b popfd 0x0000003c popad 0x0000003d xchg eax, ebx 0x0000003e jmp 00007F35449CBE46h 0x00000043 xchg eax, ebx 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007F35449CBE47h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5260474 second address: 5260479 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5260479 second address: 526049C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F35449CBE45h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 526049C second address: 52604A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52604A0 second address: 52604A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52604A4 second address: 52604AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52604AA second address: 52604C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F35449CBE3Bh 0x00000008 mov di, cx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52604C5 second address: 52604C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52604C9 second address: 52604CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52604CF second address: 52604FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, F2h 0x00000005 mov edx, 291E7274h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push dword ptr [ebp+14h] 0x00000010 jmp 00007F35448276B3h 0x00000015 push dword ptr [ebp+10h] 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52604FB second address: 52604FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52604FF second address: 5260505 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5260542 second address: 5260546 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5260546 second address: 526055D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35448276B3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 526055D second address: 52605A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a jmp 00007F35449CBE3Eh 0x0000000f pop ebx 0x00000010 pushad 0x00000011 mov si, 118Dh 0x00000015 mov edi, eax 0x00000017 popad 0x00000018 mov esp, ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F35449CBE3Bh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52605A1 second address: 52605B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F35448276B4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52605B9 second address: 52605E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F35449CBE48h 0x00000011 mov esi, 2D9C6681h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5250147 second address: 5250162 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35448276B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52A1BD8 second address: 52A1C06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F35449CBE48h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52A1C06 second address: 52A1C15 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35448276ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52A1C15 second address: 52A1C65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F35449CBE3Fh 0x00000009 sub esi, 0F491D5Eh 0x0000000f jmp 00007F35449CBE49h 0x00000014 popfd 0x00000015 mov ch, 52h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov dl, 2Ch 0x00000020 call 00007F35449CBE40h 0x00000025 pop esi 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5200285 second address: 52002A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F35448276B7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52002A0 second address: 52002D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F35449CBE40h 0x00000010 xor ax, A008h 0x00000015 jmp 00007F35449CBE3Bh 0x0000001a popfd 0x0000001b push eax 0x0000001c push edx 0x0000001d movzx ecx, bx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52002D1 second address: 52002E6 instructions: 0x00000000 rdtsc 0x00000002 mov edi, 7452F076h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov edx, ecx 0x00000012 push ecx 0x00000013 pop edx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52002E6 second address: 520034C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE47h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov dl, ah 0x0000000e mov bx, 3574h 0x00000012 popad 0x00000013 push esp 0x00000014 jmp 00007F35449CBE48h 0x00000019 mov dword ptr [esp], ecx 0x0000001c jmp 00007F35449CBE40h 0x00000021 and dword ptr [ebp-04h], 00000000h 0x00000025 pushad 0x00000026 call 00007F35449CBE3Eh 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 520034C second address: 5200372 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov edx, 05557634h 0x0000000a popad 0x0000000b lea eax, dword ptr [ebp-04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F35448276B6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 520045E second address: 520049E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b jmp 00007F35449CBE3Eh 0x00000010 js 00007F35B50F7A64h 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F35449CBE47h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 520049E second address: 52004C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35448276B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebp-04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 mov bh, 9Bh 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 51E0E00 second address: 51E0E1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 51E0E1D second address: 51E0E23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 51E0E23 second address: 51E0E27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 51E0E27 second address: 51E0E2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 51E0E2B second address: 51E0E46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F35449CBE3Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 51E0E46 second address: 51E0E55 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35448276ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 51E0E55 second address: 51E0E93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edi 0x00000005 call 00007F35449CBE3Bh 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F35449CBE40h 0x0000001a and si, 1978h 0x0000001f jmp 00007F35449CBE3Bh 0x00000024 popfd 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 51E0E93 second address: 51E0E98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 51E0E98 second address: 51E0EAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, D0A8h 0x00000007 push ebx 0x00000008 pop ecx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 51E0EAC second address: 51E0EB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 51E0EB2 second address: 51E0EF4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE47h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F35449CBE3Bh 0x00000013 jmp 00007F35449CBE43h 0x00000018 popfd 0x00000019 push eax 0x0000001a pop edx 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5290080 second address: 5290084 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5290084 second address: 529008A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 529008A second address: 5290090 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5290090 second address: 5290094 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5290094 second address: 5290098 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5290098 second address: 52900AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov si, di 0x0000000f push edi 0x00000010 pop eax 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52900AA second address: 52900F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 1DEE9D43h 0x00000008 push ecx 0x00000009 pop ebx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], ebp 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F35448276B0h 0x00000017 jmp 00007F35448276B5h 0x0000001c popfd 0x0000001d call 00007F35448276B0h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5260EB4 second address: 5260EBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5260EBA second address: 5260EBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5260EBE second address: 5260F0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F35449CBE49h 0x00000011 xchg eax, ebp 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushfd 0x00000016 jmp 00007F35449CBE3Ah 0x0000001b jmp 00007F35449CBE45h 0x00000020 popfd 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5260F0E second address: 5260F12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5260F12 second address: 5260F21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dx, ax 0x00000009 popad 0x0000000a mov ebp, esp 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5240DD4 second address: 5240DE3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35448276ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 5240DE3 second address: 5240E49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F35449CBE3Eh 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F35449CBE3Dh 0x0000001a xor ah, 00000076h 0x0000001d jmp 00007F35449CBE41h 0x00000022 popfd 0x00000023 call 00007F35449CBE40h 0x00000028 pop ecx 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52C0910 second address: 52C0928 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F35448276B4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52C0928 second address: 52C0957 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F35449CBE46h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52C0957 second address: 52C095B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52C095B second address: 52C0977 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE48h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52C0977 second address: 52C097D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52C097D second address: 52C09CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35449CBE3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F35449CBE3Eh 0x00000011 mov ebp, esp 0x00000013 jmp 00007F35449CBE40h 0x00000018 push dword ptr [ebp+0Ch] 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F35449CBE47h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52C09CD second address: 52C0A20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F35448276AFh 0x00000009 sbb cx, 33AEh 0x0000000e jmp 00007F35448276B9h 0x00000013 popfd 0x00000014 mov edi, eax 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push dword ptr [ebp+08h] 0x0000001c jmp 00007F35448276AAh 0x00000021 push C6AD98B7h 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 mov dx, cx 0x0000002c movzx ecx, dx 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52C0A20 second address: 52C0A25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52C0A63 second address: 52C0A67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52C0A67 second address: 52C0A6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52C0A6D second address: 52C0A8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35448276AAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 movzx eax, al 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov di, 2730h 0x00000013 mov di, 865Ch 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52C0A8A second address: 52C0ABE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F35449CBE47h 0x00000008 pop esi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F35449CBE41h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52C0ABE second address: 52C0AC4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52C0AC4 second address: 52C0AC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52803CD second address: 52803DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F35448276ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	RDTSC instruction interceptor: First address: 52803DC second address: 52803E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Special instruction interceptor: First address: 710B9B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Special instruction interceptor: First address: 939615 instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: 310B9B instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: 539615 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: 890B9B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: AB9615 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe

Code function: 0_2_052C0049 rdtsc

0_2_052C0049

Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Window / User API: threadDelayed 1237	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Window / User API: threadDelayed 1260	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Window / User API: threadDelayed 519	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Window / User API: threadDelayed 776	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Window / User API: threadDelayed 1391	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 1194	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 488	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 1165	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 481	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 1316	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1240	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 495	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1269	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1191	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 509	Jump to behavior

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_6-16941
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_0-15873

Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe TID: 2824	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe TID: 2800	Thread sleep count: 1237 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe TID: 2800	Thread sleep time: -2475237s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe TID: 2164	Thread sleep count: 1260 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe TID: 2164	Thread sleep time: -2521260s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe TID: 6556	Thread sleep count: 519 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe TID: 6556	Thread sleep time: -52419s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe TID: 4460	Thread sleep count: 776 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe TID: 4460	Thread sleep time: -1552776s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe TID: 2520	Thread sleep count: 1391 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe TID: 2520	Thread sleep time: -2783391s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1480	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 2408	Thread sleep count: 1194 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 2408	Thread sleep time: -2389194s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5908	Thread sleep count: 99 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5908	Thread sleep count: 488 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5908	Thread sleep time: -49288s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1360	Thread sleep count: 1165 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1360	Thread sleep time: -2331165s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7204	Thread sleep count: 48 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7204	Thread sleep time: -96048s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7208	Thread sleep count: 45 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7208	Thread sleep time: -90045s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1408	Thread sleep count: 100 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1408	Thread sleep count: 481 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1408	Thread sleep time: -48581s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7188	Thread sleep count: 1316 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7188	Thread sleep time: -2633316s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7408	Thread sleep time: -60030s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7392	Thread sleep count: 1240 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7392	Thread sleep time: -2481240s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7360	Thread sleep count: 71 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7360	Thread sleep count: 495 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7360	Thread sleep time: -49995s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7400	Thread sleep count: 1269 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7400	Thread sleep time: -2539269s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7752	Thread sleep time: -60030s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7732	Thread sleep count: 1191 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7732	Thread sleep time: -2383191s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7696	Thread sleep count: 58 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7696	Thread sleep count: 509 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7696	Thread sleep time: -51409s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Last function: Thread delayed

Source: RageMP131.exe, RageMP131.exe, 0000000A.00000002.3639511163.0000000000A0D000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Ke5ufWcgxp.exe, 00000000.00000002.3646592079.000000000117E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}i
Source: Ke5ufWcgxp.exe, 00000000.00000002.3646592079.0000000001170000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&0^?V
Source: RageMP131.exe, 0000000A.00000002.3647150748.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: RageMP131.exe, 00000008.00000002.3646900740.000000000121E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_CD14D628]9
Source: RageMP131.exe, 0000000A.00000002.3636609539.00000000005BC000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}d
Source: RageMP131.exe, 0000000A.00000003.2266336956.0000000001237000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}Om
Source: RageMP131.exe, 0000000A.00000002.3647150748.0000000001235000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 00000007.00000002.3646701337.0000000000D3C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}A
Source: RageMP131.exe, 0000000A.00000002.3647150748.0000000001235000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_CD14D628v
Source: MPGPH131.exe, 00000007.00000002.3646701337.0000000000D67000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}@
Source: MPGPH131.exe, 00000007.00000002.3646701337.0000000000D67000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}~
Source: RageMP131.exe, 0000000A.00000002.3647150748.0000000001235000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_CD14D628
Source: RageMP131.exe, 0000000A.00000003.2266336956.0000000001235000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: RageMP131.exe, 00000008.00000002.3646900740.0000000001286000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000J%
Source: MPGPH131.exe, 00000007.00000002.3646701337.0000000000D6C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll>
Source: Ke5ufWcgxp.exe, 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.3638291706.000000000048D000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000002.3638295977.000000000048D000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.3639684463.0000000000A0D000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000002.3639511163.0000000000A0D000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: MPGPH131.exe, 00000007.00000002.3646701337.0000000000D87000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}u~
Source: Ke5ufWcgxp.exe, 00000000.00000002.3646592079.00000000011E3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3646874202.0000000000F15000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3646900740.0000000001286000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.3647150748.000000000121C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: MPGPH131.exe, 00000007.00000002.3646701337.0000000000D1A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&Vn

Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Thread information set: HideFromDebugger	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe

Code function: 0_2_052C0049 rdtsc

0_2_052C0049

Source: RageMP131.exe, RageMP131.exe, 0000000A.00000002.3639511163.0000000000A0D000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: NwPProgram Manager
Source: Ke5ufWcgxp.exe, 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.3638291706.000000000048D000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000002.3638295977.000000000048D000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: oNwPProgram Manager

Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe

Code function: 0_2_005B361D GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_005B361D

Source: C:\Users\user\Desktop\Ke5ufWcgxp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected RisePro Stealer

Source: Yara match	File source: Process Memory Space: Ke5ufWcgxp.exe PID: 6172, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 6152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7356, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7692, type: MEMORYSTR

Remote Access Functionality

Yara detected RisePro Stealer

Source: Yara match	File source: Process Memory Space: Ke5ufWcgxp.exe PID: 6172, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 6152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7356, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7692, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	2 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	24 Virtualization/Sandbox Evasion	LSASS Memory	741 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	2 Process Injection	Security Account Manager	24 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	214 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Ke5ufWcgxp.exe	45%	ReversingLabs	Win32.Trojan.RisePro
Ke5ufWcgxp.exe	53%	Virustotal		Browse
Ke5ufWcgxp.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	45%	ReversingLabs	Win32.Trojan.RisePro
C:\ProgramData\MPGPH131\MPGPH131.exe	53%	Virustotal		Browse
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	45%	ReversingLabs	Win32.Trojan.RisePro
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	53%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
https://ipinfo.io/	0%	URL Reputation	safe
https://ipinfo.io/widget/demo/8.46.123.33%Um	0%	Avira URL Cloud	safe
https://ipinfo.io/ameSpace/	0%	Avira URL Cloud	safe
https://ipinfo.io/widget/demo/8.46.123.33	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORTzn	0%	Avira URL Cloud	safe
https://www.maxmind.com/en/locate-my-ip-address	0%	Avira URL Cloud	safe
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	0%	Avira URL Cloud	safe
https://ipinfo.io/widget/demo/8.46.123.33t	0%	Avira URL Cloud	safe
https://ipinfo.io/h	0%	Avira URL Cloud	safe
https://www.maxmind.com/en/locate-my-ip-address	0%	Virustotal		Browse
https://t.me/RiseProSUPPORT(	0%	Avira URL Cloud	safe
http://www.winimage.com/zLibDll	1%	Virustotal		Browse
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	0%	Virustotal		Browse
https://ipinfo.io/h	0%	Virustotal		Browse
https://t.me/RiseProSUPPORT(	1%	Virustotal		Browse
http://www.winimage.com/zLibDll	0%	Avira URL Cloud	safe
https://ipinfo.io/d0	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORT	0%	Avira URL Cloud	safe
https://ipinfo.io/widget/demo/8.46.123.33x	0%	Avira URL Cloud	safe
https://ipinfo.io/widget/demo/8.46.123.330c	0%	Avira URL Cloud	safe
https://ipinfo.io/l	0%	Avira URL Cloud	safe
https://ipinfo.io/Namespace	0%	Avira URL Cloud	safe
https://ipinfo.io/l	0%	Virustotal		Browse
https://t.me/RiseProSUPPORT	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/widget/demo/8.46.123.33%Um	Ke5ufWcgxp.exe, 00000000.00000002.3646592079.00000000011EC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/	RageMP131.exe, 0000000A.00000002.3647150748.000000000120C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ipinfo.io/widget/demo/8.46.123.33	Ke5ufWcgxp.exe, 00000000.00000002.3646592079.00000000011EC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3646874202.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3646701337.0000000000D4D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3646900740.000000000125C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.3647150748.00000000011FD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/ameSpace/	RageMP131.exe, 00000008.00000002.3646900740.000000000121E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.maxmind.com/en/locate-my-ip-address	RageMP131.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORTzn	MPGPH131.exe, 00000006.00000002.3646874202.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	Ke5ufWcgxp.exe, 00000000.00000003.2027583976.0000000005040000.00000004.00001000.00020000.00000000.sdmp, Ke5ufWcgxp.exe, 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000003.2056577894.0000000004B80000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3636595072.0000000000181000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000002.3636572214.0000000000181000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000003.2056606690.0000000004A70000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3637104339.0000000000701000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000008.00000003.2160020226.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.3636873038.0000000000701000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000003.2243205056.0000000004D30000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ipinfo.io/widget/demo/8.46.123.33t	RageMP131.exe, 00000008.00000002.3646900740.000000000121E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/h	MPGPH131.exe, 00000007.00000002.3646701337.0000000000D5C000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORT(	MPGPH131.exe, 00000007.00000002.3646701337.0000000000D1A000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDll	Ke5ufWcgxp.exe, 00000000.00000003.2027583976.0000000005040000.00000004.00001000.00020000.00000000.sdmp, Ke5ufWcgxp.exe, 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000003.2056577894.0000000004B80000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3636595072.0000000000181000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000002.3636572214.0000000000181000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000003.2056606690.0000000004A70000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3637104339.0000000000701000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000008.00000003.2160020226.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.3636873038.0000000000701000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000003.2243205056.0000000004D30000.00000004.00001000.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ipinfo.io/d0	MPGPH131.exe, 00000006.00000002.3646874202.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORT	Ke5ufWcgxp.exe, 00000000.00000002.3646592079.000000000117E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3646874202.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3646701337.0000000000D1A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3646900740.000000000121E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.3647150748.00000000011CB000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ipinfo.io/widget/demo/8.46.123.33x	RageMP131.exe, 00000008.00000002.3646900740.000000000121E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/l	RageMP131.exe, 00000008.00000002.3646900740.0000000001261000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ipinfo.io/widget/demo/8.46.123.330c	MPGPH131.exe, 00000006.00000002.3646874202.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/Namespace	RageMP131.exe, 0000000A.00000002.3647150748.00000000011F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
77.91.77.66	unknown	Russian Federation		42861	FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1461288
Start date and time:	2024-06-23 16:14:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Ke5ufWcgxp.exe renamed because original name is a hash value
Original Sample Name:	85b0f825ec9f8661f2b1237a0e33ad06.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@11/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
10:15:28	API Interceptor	1443520x Sleep call for process: Ke5ufWcgxp.exe modified
10:15:31	API Interceptor	2448212x Sleep call for process: MPGPH131.exe modified
10:15:41	API Interceptor	1801187x Sleep call for process: RageMP131.exe modified
16:15:00	Task Scheduler	Run new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
16:15:00	Task Scheduler	Run new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
16:15:02	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
16:15:10	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
77.91.77.66	BqqQh4Jr7L.exe	Get hash	malicious	RisePro Stealer	Browse
	file.exe	Get hash	malicious	RisePro Stealer	Browse
	file.exe	Get hash	malicious	RisePro Stealer	Browse
	plTAoSCew2.exe	Get hash	malicious	RisePro Stealer	Browse
	7rA1iX60wh.exe	Get hash	malicious	RisePro Stealer	Browse
	PNO3otPYOa.exe	Get hash	malicious	RisePro Stealer	Browse
	YnsEArPlqx.exe	Get hash	malicious	RisePro Stealer	Browse
	AlCsIOd0pd.exe	Get hash	malicious	RisePro Stealer	Browse
	setup.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	D44CPdpkNk.exe	Get hash	malicious	RisePro Stealer	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU	yWny5Jds8b.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse	77.91.77.81
	file.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, Monster Stealer, PureLog Stealer, RedLine, SmokeLoader	Browse	77.91.77.81
	BqqQh4Jr7L.exe	Get hash	malicious	RisePro Stealer	Browse	77.91.77.66
	file.exe	Get hash	malicious	RisePro Stealer	Browse	77.91.77.66
	setup.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, PureLog Stealer, RedLine	Browse	77.91.77.81
	setup.exe	Get hash	malicious	Amadey	Browse	77.91.77.81
	It5068xROy.dll	Get hash	malicious	RedLine	Browse	77.91.77.6
	file.exe	Get hash	malicious	RisePro Stealer	Browse	77.91.77.66
	plTAoSCew2.exe	Get hash	malicious	RisePro Stealer	Browse	77.91.77.66
	7rA1iX60wh.exe	Get hash	malicious	RisePro Stealer	Browse	77.91.77.66

Process:	C:\Users\user\Desktop\Ke5ufWcgxp.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2393600
Entropy (8bit):	7.966388365043691
Encrypted:	false
SSDEEP:	49152:RVQGeQ3baj4j62r4XenE+svt3aaJzeuNh4zHhSeb78G5oEz:TmdU+2r4X+Mt3hey4tSs78GT
MD5:	85B0F825EC9F8661F2B1237A0E33AD06
SHA1:	16A3542ADA51249BE3B3A2939B79447B817B7A02
SHA-256:	9AE617395AD5440F6774902B04F331A59282737D0F3C897D9F21AB73C19B691E
SHA-512:	E3C720D343F8D51FC008B951663669615BFEB22513705532D0C63D64662028DB6561B6AD302BB71AE6D9C7BF876B9FB33665F09AE877D821ED60642BB7E22A80
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45% Antivirus: Virustotal, Detection: 53%, Browse
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....iLf...............'.....\|........]...........@...........................]......v%...@.................................^...r.......8.....................]...............................]..............................6..@................... . ............................@....rsrc...8...........................@....idata ............................@... .P+.........................@...kwsiocfo..... D.....................@...hhfhiasa......]......`$.............@....taggant.0....].."...d$.............@...........................................................................................................................................................................................

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Ke5ufWcgxp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Download File

Process:	C:\Users\user\Desktop\Ke5ufWcgxp.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2393600
Entropy (8bit):	7.966388365043691
Encrypted:	false
SSDEEP:	49152:RVQGeQ3baj4j62r4XenE+svt3aaJzeuNh4zHhSeb78G5oEz:TmdU+2r4X+Mt3hey4tSs78GT
MD5:	85B0F825EC9F8661F2B1237A0E33AD06
SHA1:	16A3542ADA51249BE3B3A2939B79447B817B7A02
SHA-256:	9AE617395AD5440F6774902B04F331A59282737D0F3C897D9F21AB73C19B691E
SHA-512:	E3C720D343F8D51FC008B951663669615BFEB22513705532D0C63D64662028DB6561B6AD302BB71AE6D9C7BF876B9FB33665F09AE877D821ED60642BB7E22A80
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45% Antivirus: Virustotal, Detection: 53%, Browse
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....iLf...............'.....\|........]...........@...........................]......v%...@.................................^...r.......8.....................]...............................]..............................6..@................... . ............................@....rsrc...8...........................@....idata ............................@... .P+.........................@...kwsiocfo..... D.....................@...hhfhiasa......]......`$.............@....taggant.0....].."...d$.............@...........................................................................................................................................................................................

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Ke5ufWcgxp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Download File

Process:	C:\Users\user\Desktop\Ke5ufWcgxp.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	13
Entropy (8bit):	2.8731406795131336
Encrypted:	false
SSDEEP:	3:L4UcZn:6Zn
MD5:	86186CC248F7A1B35E4872A0AAFD6A71
SHA1:	BB2B96946CF82BCBBB856BC26F829DBCACDA29FE
SHA-256:	BBFF526100D847AB4D6675AF4CD489E946E3887B9AAF94F7DF51C9D1AC8D5748
SHA-512:	D59CE3F53986105A372B983BF3237E936FA3B85E0EB3AF6029711C93F23C83A378AA5732ACF5FE485E72F749F18062A7D65D9F695FF0025AD39C0DA591A21B7A
Malicious:	false
Reputation:	low
Preview:	1719155728960

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.966388365043691
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Ke5ufWcgxp.exe
File size:	2'393'600 bytes
MD5:	85b0f825ec9f8661f2b1237a0e33ad06
SHA1:	16a3542ada51249be3b3a2939b79447b817b7a02
SHA256:	9ae617395ad5440f6774902b04f331a59282737d0f3c897d9f21ab73c19b691e
SHA512:	e3c720d343f8d51fc008b951663669615bfeb22513705532d0c63d64662028db6561b6ad302bb71ae6d9c7bf876b9fb33665f09ae877d821ed60642bb7e22a80
SSDEEP:	49152:RVQGeQ3baj4j62r4XenE+svt3aaJzeuNh4zHhSeb78G5oEz:TmdU+2r4X+Mt3hey4tSs78GT
TLSH:	E4B533157FF632D4E0A4A2B1891F06E19C333F29805B5738FA5D368A0DD6A34EEE5835
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s...../.s

File Icon


Icon Hash:	8596a1a0a1a1b171

Static PE Info

General

Entrypoint:	0x9db000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x664C6914 [Tue May 21 09:27:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F35447D769Ah
pcmpgtb mm4, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F35447D9695h
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop ds
add byte ptr [eax+000000FEh], ah
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
or al, byte ptr [eax]
add byte ptr [edx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x18c05e	0x72	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x18a000	0x1638	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5d9e0c	0x10	kwsiocfo
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x5d9dbc	0x18	kwsiocfo
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x18369c	0x40
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x189000	0xab400	5471edd808084016e0c0c3a96d435481	False	0.998762545620438	data	7.98581846796198	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x18a000	0x1638	0x1800	fe6f3fdb9e7e97cba92d8ce4e4fcc95b	False	0.7220052083333334	data	6.54017046361188	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x18c000	0x1000	0x200	0e14477ce436cc9ebd87f17a92173639	False	0.1640625	data	1.180504109820196	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x18d000	0x2b5000	0x200	04106eec78bb2c4e1e59132fa62f213f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
kwsiocfo	0x442000	0x198000	0x198000	c945eb9894dc34a72b47bb6c4df6080d	False	0.9946779737285539	data	7.9553136795218204	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
hhfhiasa	0x5da000	0x1000	0x400	2e220f818bac0bf8641c0720b7e1fee9	False	0.7646484375	data	6.131629474123768	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x5db000	0x3000	0x2200	4b95b5d779876c4e79c6ebd6d1317d62	False	0.06939338235294118	DOS executable (COM)	0.7729148449928186	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x18a440	0x1060	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Russian	Russia	0.8838263358778626
RT_GROUP_ICON	0x18b4a0	0x14	data	Russian	Russia	1.05
RT_VERSION	0x18a130	0x310	data	Russian	Russia	0.45408163265306123
RT_MANIFEST	0x18b4b8	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/23/24-16:17:36.899727	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49707	58709	192.168.2.5	77.91.77.66
06/23/24-16:17:38.200223	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49716	58709	192.168.2.5	77.91.77.66
06/23/24-16:17:04.473158	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49716	77.91.77.66	192.168.2.5
06/23/24-16:15:23.534284	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49716	77.91.77.66	192.168.2.5
06/23/24-16:17:36.899737	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49706	58709	192.168.2.5	77.91.77.66
06/23/24-16:17:37.415514	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49708	58709	192.168.2.5	77.91.77.66
06/23/24-16:15:00.772679	TCP	2049060	ET TROJAN RisePro TCP Heartbeat Packet	49705	58709	192.168.2.5	77.91.77.66
06/23/24-16:17:01.678127	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49706	77.91.77.66	192.168.2.5
06/23/24-16:17:36.603047	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49705	58709	192.168.2.5	77.91.77.66
06/23/24-16:17:02.960524	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49708	77.91.77.66	192.168.2.5
06/23/24-16:15:15.298112	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49708	77.91.77.66	192.168.2.5
06/23/24-16:17:01.182074	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49705	77.91.77.66	192.168.2.5
06/23/24-16:17:01.624141	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49707	77.91.77.66	192.168.2.5
06/23/24-16:15:01.352624	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49705	77.91.77.66	192.168.2.5
06/23/24-16:15:05.509073	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49707	77.91.77.66	192.168.2.5
06/23/24-16:15:05.517411	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49706	77.91.77.66	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 23, 2024 16:15:00.748106956 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:00.753428936 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:00.753511906 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:00.772679090 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:00.777529001 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:01.352623940 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:01.398731947 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:04.492782116 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:04.497533083 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:04.892509937 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:04.893577099 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:04.897715092 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:04.897778034 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:04.898437023 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:04.898494005 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:04.921189070 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:04.923012972 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:04.926070929 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:04.927823067 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:05.509073019 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:05.517410994 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:05.554936886 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:05.570545912 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:08.649018049 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:08.649173975 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:08.654016972 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:08.654051065 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:14.693591118 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:14.698492050 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:14.698575974 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:14.726803064 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:14.731648922 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:15.298111916 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:15.351821899 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:18.414664984 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:18.419529915 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:22.899780035 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:22.904768944 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:22.904843092 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:22.938586950 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:22.943538904 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:23.534284115 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:23.586234093 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:26.649014950 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:26.654118061 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:35.793039083 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:35.798006058 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:36.852849960 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:36.857702971 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:39.992818117 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:39.997832060 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:42.055290937 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:42.060045958 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:43.117942095 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:43.123101950 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:45.180358887 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:45.185194016 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:46.258421898 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:46.258450031 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:46.263315916 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:46.263355970 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:46.586687088 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:46.591458082 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:48.305342913 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:48.310271025 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:49.398998022 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:49.399185896 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:49.404014111 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:49.404052019 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:51.445935965 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:51.450807095 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:52.524106026 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:52.524243116 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:52.529158115 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:52.529212952 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:52.852283001 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:52.857127905 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:54.571398020 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:54.576260090 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:54.836695910 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:54.841589928 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:55.649090052 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:55.649126053 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:55.654762030 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:55.654803038 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:57.711618900 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:57.716592073 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:58.789843082 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:58.789874077 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:58.795109987 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:58.795149088 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:15:59.103468895 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:15:59.109081984 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:00.852336884 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:00.857300997 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:01.102185965 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:01.107177019 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:01.930392027 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:01.930522919 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:01.935590029 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:01.935623884 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:02.242877007 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:02.248553038 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:03.993062973 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:03.998423100 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:05.060386896 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:05.060482025 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:05.065538883 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:05.065577984 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:05.383685112 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:05.388719082 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:07.120527029 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:07.125572920 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:07.383697033 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:07.388619900 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:08.196985960 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:08.197451115 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:08.201963902 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:08.202394962 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:08.508800983 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:08.513849020 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:10.245803118 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:10.250811100 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:10.508917093 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:10.513806105 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:11.321288109 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:11.321615934 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:11.326246023 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:11.326461077 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:11.634299994 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:11.639533043 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:13.368529081 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:13.373518944 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:13.651774883 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:13.656913042 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:14.446743011 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:14.446835041 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:14.451601982 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:14.451641083 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:14.759444952 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:14.764445066 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:16.493645906 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:16.498543978 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:16.786015034 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:16.791073084 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:17.587579966 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:17.587702990 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:17.592609882 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:17.592644930 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:17.899918079 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:17.905082941 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:19.634159088 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:19.642519951 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:19.899951935 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:19.905098915 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:20.728045940 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:20.728092909 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:20.733037949 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:20.733089924 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:21.025070906 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:21.029999971 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:22.759814024 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:22.764719009 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:23.040527105 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:23.045547962 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:23.852930069 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:23.852991104 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:23.857914925 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:23.857956886 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:24.166465998 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:24.171442986 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:25.884187937 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:25.889208078 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:26.165612936 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:26.170536995 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:26.993793964 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:26.993947029 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:26.998702049 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:26.998867035 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:27.290539980 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:27.295613050 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:29.025126934 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:29.030101061 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:29.305968046 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:29.310914040 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:30.134454012 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:30.134578943 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:30.139396906 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:30.139431000 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:30.415668964 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:30.420783043 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:32.165705919 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:32.170706034 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:32.434623003 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:32.439606905 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:33.260803938 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:33.261399031 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:33.265824080 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:33.266225100 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:33.555856943 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:33.560841084 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:35.306394100 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:35.311278105 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:35.556020975 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:35.562953949 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:36.384679079 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:36.384774923 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:36.389691114 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:36.389724970 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:36.700115919 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:36.705250978 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:38.435704947 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:38.696996927 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:38.729630947 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:38.785433054 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:38.785465002 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:38.785492897 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:39.509407997 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:39.509438038 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:39.514311075 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:39.514345884 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:39.853178024 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:39.859842062 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:41.556361914 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:41.561897039 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:41.840039968 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:41.845510960 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:42.634723902 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:42.634840965 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:42.639741898 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:42.639802933 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:42.978274107 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:42.983673096 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:44.696954966 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:44.701893091 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:44.979337931 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:44.984230995 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:45.759572029 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:45.759622097 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:45.767039061 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:45.767070055 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:46.118885040 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:46.127645969 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:47.822216034 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:47.828449011 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:48.106271029 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:48.111160040 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:48.884411097 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:48.884455919 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:48.889281034 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:48.889316082 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:49.244415998 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:49.249475002 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:50.946997881 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:50.951920033 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:51.243423939 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:51.248331070 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:52.024702072 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:52.024820089 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:52.029670954 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:52.029808044 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:52.384109020 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:52.389101982 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:54.071989059 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:54.076936007 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:54.368807077 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:54.373717070 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:55.150108099 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:55.150171041 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:55.155253887 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:55.155298948 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:55.509643078 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:55.514527082 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:57.197226048 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:57.202851057 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:57.493757010 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:57.498759031 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:58.290757895 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:58.290848970 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:58.301069021 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:58.301103115 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:16:58.649985075 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:16:58.654778004 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:00.321820021 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:00.326894999 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:00.619477987 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:00.624349117 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:01.182074070 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:01.263520956 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:01.416069031 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:01.416332006 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:01.421035051 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:01.421170950 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:01.624140978 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:01.678127050 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:01.707834959 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:01.727313995 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:01.779037952 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:01.784097910 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:02.960524082 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:03.055392981 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:03.759295940 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:03.764142990 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:04.321490049 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:04.326383114 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:04.473157883 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:04.618144035 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:04.759196043 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:04.764316082 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:04.805890083 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:04.810888052 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:06.087085962 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:06.092135906 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:07.446686029 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:07.451488018 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:07.602880955 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:07.607736111 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:07.884073019 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:07.889008999 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:07.931184053 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:07.936176062 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:09.227953911 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:09.232753038 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:10.571676970 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:10.576628923 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:10.727906942 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:10.734484911 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:11.024832010 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:11.056786060 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:11.090905905 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:11.090922117 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:12.368434906 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:12.373476028 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:13.696799040 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:13.701697111 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:13.868547916 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:13.873678923 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:14.165453911 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:14.170295954 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:14.196512938 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:14.201790094 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:15.509206057 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:15.514532089 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:16.412205935 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:16.555418968 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:16.619469881 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:16.631758928 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:16.679426908 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:16.727344990 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:16.993388891 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:16.999217033 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:17.225663900 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:17.352304935 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:17.904524088 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:18.118129969 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:19.524858952 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:19.529942036 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:19.743829966 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:19.743932962 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:19.750685930 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:19.750699997 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:20.337388992 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:20.342210054 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:21.040319920 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:21.045144081 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:22.649782896 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:22.654711962 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:22.884012938 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:22.884128094 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:22.889072895 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:22.889108896 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:23.462291002 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:23.467356920 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:24.165394068 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:24.170355082 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:25.774669886 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:25.781359911 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:26.009110928 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:26.009135962 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:26.014050007 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:26.014069080 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:26.587275982 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:26.592211008 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:27.290546894 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:27.295478106 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:28.918216944 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:28.923396111 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:29.149872065 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:29.149961948 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:29.154798031 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:29.154815912 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:29.712178946 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:29.717150927 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:30.348942041 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:30.436187983 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:30.444555998 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:30.556180954 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:30.626257896 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:30.645334959 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:30.730366945 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:30.748198986 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:31.161633968 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:31.255724907 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:31.918330908 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:32.134318113 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:33.478053093 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:33.483206034 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:33.759269953 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:33.759315014 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:33.764142036 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:33.764190912 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:34.291204929 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:34.296230078 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:35.056797028 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:35.061722994 CEST	58709	49716	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:36.603046894 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:36.608021021 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:36.899727106 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:36.899736881 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:36.904803038 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:36.904839039 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:37.415513992 CEST	49708	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:37.421209097 CEST	58709	49708	77.91.77.66	192.168.2.5
Jun 23, 2024 16:17:38.200222969 CEST	49716	58709	192.168.2.5	77.91.77.66
Jun 23, 2024 16:17:38.205562115 CEST	58709	49716	77.91.77.66	192.168.2.5

Target ID:	0
Start time:	10:14:57
Start date:	23/06/2024
Path:	C:\Users\user\Desktop\Ke5ufWcgxp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Ke5ufWcgxp.exe"
Imagebase:	0x580000
File size:	2'393'600 bytes
MD5 hash:	85B0F825EC9F8661F2B1237A0E33AD06
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	10:14:59
Start date:	23/06/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0x9a0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:15:00
Start date:	23/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:15:00
Start date:	23/06/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0x9a0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:15:00
Start date:	23/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:15:00
Start date:	23/06/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x180000
File size:	2'393'600 bytes
MD5 hash:	85B0F825EC9F8661F2B1237A0E33AD06
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs Detection: 53%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	10:15:00
Start date:	23/06/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x180000
File size:	2'393'600 bytes
MD5 hash:	85B0F825EC9F8661F2B1237A0E33AD06
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	10:15:10
Start date:	23/06/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x700000
File size:	2'393'600 bytes
MD5 hash:	85B0F825EC9F8661F2B1237A0E33AD06
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs Detection: 53%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	10:15:19
Start date:	23/06/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x700000
File size:	2'393'600 bytes
MD5 hash:	85B0F825EC9F8661F2B1237A0E33AD06
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	1%
Signature Coverage:	2.5%
Total number of Nodes:	1831
Total number of Limit Nodes:	25

Executed Functions

Function 00589280 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 383
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASend.WS2_32(?,?,00000001,00000000,00000000,00000000,00000000,?,?,?,?,006CD15C,00000000,76A923A0,-00709880), ref: 005896C9

Strings

Ws2_32.dll, xrefs: 0058969A

Memory Dump Source

Source File: 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.3636469569.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3636606230.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3637426316.000000000070A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000070D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3643625441.00000000009C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644742846.0000000000B59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644840814.0000000000B5B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_Ke5ufWcgxp.jbxd

Similarity

API ID: Send
String ID: Ws2_32.dll
API String ID: 121738739-3093949381
Opcode ID: 705bb3c057c617e361f66346830b6c958ce386060fab07b78a55b5db2e1a47c9
Instruction ID: 84d6b944c86de66a33516cf31112bea06247a1eca36f20b723f0eb4b95f2d05d
Opcode Fuzzy Hash: 705bb3c057c617e361f66346830b6c958ce386060fab07b78a55b5db2e1a47c9
Instruction Fuzzy Hash: A402BC70D04298DEDF25DFA4C8907ADBFB0FF55304F284289E8857B686D7741986CB92

Function 052C0049 Relevance: 1.8, APIs: 1, Instructions: 318
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 052C027C

Memory Dump Source

Source File: 00000000.00000002.3656648467.00000000052C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52c0000_Ke5ufWcgxp.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 078c6dea32cea5c190c40b26fef740a7cc04738b00d5f48d55bb3ac22c4d6b8e
Instruction ID: 1723d5718f221abd4e44f1a051e882103147ea4efce448dfcc41977483140c4b
Opcode Fuzzy Hash: 078c6dea32cea5c190c40b26fef740a7cc04738b00d5f48d55bb3ac22c4d6b8e
Instruction Fuzzy Hash: 78518EEB17C111FEA116C5866B58AFE6E2FEED673073086AEB407D6603E2D44A495031

Function 00647B00 Relevance: 16.8, APIs: 11, Instructions: 284
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000428,0000FFFF,00001006,?,00000008), ref: 00647BA7
recv.WS2_32(?,00000004,00000002), ref: 00647BC1
recv.WS2_32(00000000,0000000C,00000002,00000000), ref: 00647C43
recv.WS2_32(00000000,0000000C,00000008), ref: 00647C64
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?,00000000), ref: 00647D00

Part of subcall function 00648590: WSAStartup.WS2_32 ref: 006485BB
Part of subcall function 00648590: socket.WS2_32(?,?,?,?,?,?,00709328,?,?), ref: 0064865E
Part of subcall function 00648590: connect.WS2_32(00000000,006D9BFC,?,?,?,?,00709328,?,?), ref: 00648672
Part of subcall function 00648590: closesocket.WS2_32(00000000), ref: 0064867D

recv.WS2_32(00000000,?,00000008), ref: 00647D1B
recv.WS2_32(?,00000004,00000008), ref: 00647E23
__Xtime_get_ticks.LIBCPMT ref: 00647E2A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00647E38
Sleep.KERNELBASE(00000001,00000000,?,00002710,00000000), ref: 00647EB1
Sleep.KERNELBASE(00000064,?,00002710,00000000), ref: 00647EB9

Memory Dump Source

Source File: 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.3636469569.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3636606230.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3637426316.000000000070A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000070D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3643625441.00000000009C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644742846.0000000000B59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644840814.0000000000B5B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_Ke5ufWcgxp.jbxd

Similarity

API ID: recv$Sleepsetsockopt$StartupUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@closesocketconnectsocket
String ID:
API String ID: 301102601-0
Opcode ID: 32c02504779385be311d958d794d6a05fb1e2fcfe5596dbac2edd6bea07c8943
Instruction ID: fca40866e11e79f0fd0be67fb8c4311228d3a15b2bdacd5da3361a7910ce82cb
Opcode Fuzzy Hash: 32c02504779385be311d958d794d6a05fb1e2fcfe5596dbac2edd6bea07c8943
Instruction Fuzzy Hash: 5CB19DB1D04349DFEB10DBA4CC89BAEBBB6BF45300F204259E554AB2D2D7746D84CB91

Function 00648590 Relevance: 6.1, APIs: 4, Instructions: 99
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 006485BB
socket.WS2_32(?,?,?,?,?,?,00709328,?,?), ref: 0064865E
connect.WS2_32(00000000,006D9BFC,?,?,?,?,00709328,?,?), ref: 00648672
closesocket.WS2_32(00000000), ref: 0064867D

Memory Dump Source

Source File: 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.3636469569.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3636606230.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3637426316.000000000070A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000070D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3643625441.00000000009C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644742846.0000000000B59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644840814.0000000000B5B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_Ke5ufWcgxp.jbxd

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: 58001ca3d99f732ae77c8115151dbd50e5810d78f3bf3185173585a588f11ee9
Instruction ID: 46af861ab35d57bda57526e6ae76cb6f7d877f5e84a8fbbb2faff28647ed334e
Opcode Fuzzy Hash: 58001ca3d99f732ae77c8115151dbd50e5810d78f3bf3185173585a588f11ee9
Instruction Fuzzy Hash: 7131E7729053019FD7609F288C85A6FB7E6FFC5334F025F19FAA8932E0E77098148696

Function 052C0037 Relevance: 1.8, APIs: 1, Instructions: 349
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3656648467.00000000052C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52c0000_Ke5ufWcgxp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fba0db42e5e8588ecf5e2fbc36106cc426294d94620d863a91cb351c20913900
Instruction ID: 29e88cfdede27bbf3f7bdd075447803026fe8e44141061a78eff751c7a2ef808
Opcode Fuzzy Hash: fba0db42e5e8588ecf5e2fbc36106cc426294d94620d863a91cb351c20913900
Instruction Fuzzy Hash: 3571AFEB17C151EEA112C1866B5CAFE6E2FEED673073186EEF40BD6603E2C44A495031

Function 052C0072 Relevance: 1.8, APIs: 1, Instructions: 316
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 052C027C

Memory Dump Source

Source File: 00000000.00000002.3656648467.00000000052C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52c0000_Ke5ufWcgxp.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 51f62e6d92ac42d4f4eb7ca5094c8de210570650a074ee959940c86c3be6bdf4
Instruction ID: 68112a3b73ae53ec4a1eea7970e4171cf13631e7997b2f5262098655327e8554
Opcode Fuzzy Hash: 51f62e6d92ac42d4f4eb7ca5094c8de210570650a074ee959940c86c3be6bdf4
Instruction Fuzzy Hash: FF519EEB17C110FEA116C5866B58AFE6E2FEAD673073086EEF807D6603E2D54A495031

Function 052C00B4 Relevance: 1.8, APIs: 1, Instructions: 306
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3656648467.00000000052C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52c0000_Ke5ufWcgxp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6ba35abf770b93480ec1b91d13fc93ed8a4eb6b953f728deb34f4a141e338ca
Instruction ID: 7896b1ba876c5e616486dd5dedb896802306316586a3f34160373328d40ab231
Opcode Fuzzy Hash: d6ba35abf770b93480ec1b91d13fc93ed8a4eb6b953f728deb34f4a141e338ca
Instruction Fuzzy Hash: 965190AB17C151EEA516C5962B6CAFF5E2FEED673073086EEF407C6603D2C44A495031

Function 052C0144 Relevance: 1.8, APIs: 1, Instructions: 287
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 052C027C

Memory Dump Source

Source File: 00000000.00000002.3656648467.00000000052C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52c0000_Ke5ufWcgxp.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: a473831491abb8fa92208940c4c7bc6a684ba2c49ae9589f0e61dcb253cfc0a7
Instruction ID: 9e51690d713cdee7c4430730880365c1b86afa8591d2cde2265280d796ffee4a
Opcode Fuzzy Hash: a473831491abb8fa92208940c4c7bc6a684ba2c49ae9589f0e61dcb253cfc0a7
Instruction Fuzzy Hash: 30518CEB17C211FEA516C5866B5CAFE5E2FEAD673073086EEF807D6603E2C44A495031

Function 052C00EA Relevance: 1.8, APIs: 1, Instructions: 285
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 052C027C

Memory Dump Source

Source File: 00000000.00000002.3656648467.00000000052C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52c0000_Ke5ufWcgxp.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 519f9b86975ab9ddac866fdfd6bf040e169683655e124c8f59fa85cc59f21e0c
Instruction ID: 5a30ea04a6fe6494de577dcfcba5770ee5e69c7271921a4d413f563ab4517ac4
Opcode Fuzzy Hash: 519f9b86975ab9ddac866fdfd6bf040e169683655e124c8f59fa85cc59f21e0c
Instruction Fuzzy Hash: 65518EEB17C211FEA116C5826B5CAFE6E2FEAD673073086AEF407D6203D3C44A494131

Function 052C0128 Relevance: 1.8, APIs: 1, Instructions: 270
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 052C027C

Memory Dump Source

Source File: 00000000.00000002.3656648467.00000000052C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52c0000_Ke5ufWcgxp.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 676935969decc642a1ac244da75e803326b0592c50f8de37bf8d328ed09a2f16
Instruction ID: 1af7d19233980279bfce9b966600ffc1cce3656acbd224582e3b5d686ef1eb19
Opcode Fuzzy Hash: 676935969decc642a1ac244da75e803326b0592c50f8de37bf8d328ed09a2f16
Instruction Fuzzy Hash: AF517CEB17C115EEA516C5862B5CAFE5E2FEED673073086EEB80BD6603D2C44B894031

Function 052C0194 Relevance: 1.8, APIs: 1, Instructions: 259
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 052C027C

Memory Dump Source

Source File: 00000000.00000002.3656648467.00000000052C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52c0000_Ke5ufWcgxp.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: e7a7931152837f784d844aae45c6739806d5c58d19c580dc8691816c63a3cb83
Instruction ID: 7fda17f1d6ab6082f89c514fc7c5c8755f80adcf4a0643fd5546cd95ee7309f7
Opcode Fuzzy Hash: e7a7931152837f784d844aae45c6739806d5c58d19c580dc8691816c63a3cb83
Instruction Fuzzy Hash: E2519CEB17C211FEA516C5862B5CAFE5E2FEAD673073086EEF807D6203D2C44A894031

Function 052C0176 Relevance: 1.8, APIs: 1, Instructions: 254
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 052C027C

Memory Dump Source

Source File: 00000000.00000002.3656648467.00000000052C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52c0000_Ke5ufWcgxp.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 936b5d9331de5ce83a44e312ae04e1ab63548ff5bc12de29f2540c10dbc164b7
Instruction ID: 34a5072cd9b88fbb61139d1ed0b6d14fc86913a42a902ddcba47a0b334572f6b
Opcode Fuzzy Hash: 936b5d9331de5ce83a44e312ae04e1ab63548ff5bc12de29f2540c10dbc164b7
Instruction Fuzzy Hash: 67517BEB17C211EEA516C5862B5CAFF5E2FEAD673073086EEF807D6603E2C44A494131

Function 052C015D Relevance: 1.8, APIs: 1, Instructions: 253
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 052C027C

Memory Dump Source

Source File: 00000000.00000002.3656648467.00000000052C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52c0000_Ke5ufWcgxp.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: be402686a8109675bdcd2c1a5406f0d24b8dc850e8b4ad6d0055cf58231f7583
Instruction ID: 3d0608b980d90fc5a7de053b50f29e04375333d49eb036ed54fe91226865ab01
Opcode Fuzzy Hash: be402686a8109675bdcd2c1a5406f0d24b8dc850e8b4ad6d0055cf58231f7583
Instruction Fuzzy Hash: 65516DEB17C115FEA516C5862B5CAFE5E2FEAD673073086EEB807D6203D2C44A495031

Function 052C0164 Relevance: 1.8, APIs: 1, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 052C027C

Memory Dump Source

Source File: 00000000.00000002.3656648467.00000000052C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52c0000_Ke5ufWcgxp.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: cf74d4e3e0e934be0e5f0c046ee98ab4998098870b2eea94c563999bf9ef4000
Instruction ID: 1d1247caa4cd6ec138e0ec45ae89b5664d695e54d41e8191692140d2476be821
Opcode Fuzzy Hash: cf74d4e3e0e934be0e5f0c046ee98ab4998098870b2eea94c563999bf9ef4000
Instruction Fuzzy Hash: B5516BEB17C215FEA516C5862B5CAFE5E2FEAD677073086EEB807D6203D6C44A894031

Function 052C01AA Relevance: 1.7, APIs: 1, Instructions: 247
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 052C027C

Memory Dump Source

Source File: 00000000.00000002.3656648467.00000000052C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52c0000_Ke5ufWcgxp.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 81b69b3f249f334cd81217c385c113ef8b65a4126553ae0b6ab0f0b7f375b00f
Instruction ID: af313be15fe702eab5c5ebaf7f6ff64576846d5a3987cc37a06bee24b8743eaf
Opcode Fuzzy Hash: 81b69b3f249f334cd81217c385c113ef8b65a4126553ae0b6ab0f0b7f375b00f
Instruction Fuzzy Hash: 59417CEB17C110FEA556C5822B5CAFE6E2FEAD673073086EEB807D6603D2C54B494131

Function 052C01D8 Relevance: 1.7, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 052C027C

Memory Dump Source

Source File: 00000000.00000002.3656648467.00000000052C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52c0000_Ke5ufWcgxp.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: bf5996259809577a8da877b84f0645012aa0a7a0e7633dd784dbc5262a19462e
Instruction ID: 63510c2e38ea57ae8d68109512be4908b258f33a568ca2d316cb36297f509b5f
Opcode Fuzzy Hash: bf5996259809577a8da877b84f0645012aa0a7a0e7633dd784dbc5262a19462e
Instruction Fuzzy Hash: 3D417EE717C221FEA116C1962A6CAFF5E2FEAD673073086EEB807D6603D3C54A495031

Function 052C021D Relevance: 1.7, APIs: 1, Instructions: 233COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 052C027C

Memory Dump Source

Source File: 00000000.00000002.3656648467.00000000052C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52c0000_Ke5ufWcgxp.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 7cf12b44a0f608738bc0e7c801c9ac63dec94b0bd8a54ef08bfb4cedaab78559
Instruction ID: dd10fc443eea666d0d90b9ffcd584fb8a3a38cd682dd8ed10f1b479c67a77d9b
Opcode Fuzzy Hash: 7cf12b44a0f608738bc0e7c801c9ac63dec94b0bd8a54ef08bfb4cedaab78559
Instruction Fuzzy Hash: 1241A1EB13C111EEA616C6966A1CAFE5F2FEED673073086EEF407D6203D6C44A494132

Function 052C0201 Relevance: 1.7, APIs: 1, Instructions: 225COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 052C027C

Memory Dump Source

Source File: 00000000.00000002.3656648467.00000000052C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52c0000_Ke5ufWcgxp.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 57bf39d8b396f07a0eafef4723403d34cd0c6fd08deae8e0b77b292e0ce6bcca
Instruction ID: 393a516804e7dda10cfe18eaa92b78102340b07f11a7cab9f4101df2d8506f6d
Opcode Fuzzy Hash: 57bf39d8b396f07a0eafef4723403d34cd0c6fd08deae8e0b77b292e0ce6bcca
Instruction Fuzzy Hash: B8417DEB17C114FEA516C5822B5CAFF5E2FEAD673073086AEF807D6203E2C40A495131

Function 052C0231 Relevance: 1.7, APIs: 1, Instructions: 214COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 052C027C

Memory Dump Source

Source File: 00000000.00000002.3656648467.00000000052C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52c0000_Ke5ufWcgxp.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 5ab1f7039846cccca876964fb12748b6a4b9da86b450bfbbee7236a9ab0821ba
Instruction ID: 47aba66a2055d01f470241ebec9b9ec0b3c318a3da075ea6c867d7a9c3005f60
Opcode Fuzzy Hash: 5ab1f7039846cccca876964fb12748b6a4b9da86b450bfbbee7236a9ab0821ba
Instruction Fuzzy Hash: DA417FEB17C110EEA516C2966B5DAFF5E2FEAD677073086EEF807D6203D2D40A494131

Function 052C02A8 Relevance: 1.7, APIs: 1, Instructions: 212COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 052C027C

Memory Dump Source

Source File: 00000000.00000002.3656648467.00000000052C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52c0000_Ke5ufWcgxp.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 199ae7877530b2a91d0cc488046254887713da042c7d44b11591f90c51382a1a
Instruction ID: 032c16381cdae208c63bab9fb2180c2bec75ae404ec69565b014d0e6fbcca6e2
Opcode Fuzzy Hash: 199ae7877530b2a91d0cc488046254887713da042c7d44b11591f90c51382a1a
Instruction Fuzzy Hash: 19416DAB17C210EEA516C2962B5CAFE5E2FEAD677073086EEF807D6603D2C44B495131

Function 052C0252 Relevance: 1.7, APIs: 1, Instructions: 206COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 052C027C

Memory Dump Source

Source File: 00000000.00000002.3656648467.00000000052C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52c0000_Ke5ufWcgxp.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: d9cee2bbb55405322c5be2bb8a1dab27d2e79d1764585aa33586666abad4bdc0
Instruction ID: 8d85efe08ce7bbb682d3ce758c1fc6b7bc451c6b9d7da3d53cb75982fe922738
Opcode Fuzzy Hash: d9cee2bbb55405322c5be2bb8a1dab27d2e79d1764585aa33586666abad4bdc0
Instruction Fuzzy Hash: 2F4190A717C210EEA512C6966A5CAFE6F2FEAD673073086EEF407D6203D2D40A494132

Function 052C0271 Relevance: 1.7, APIs: 1, Instructions: 201COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 052C027C

Memory Dump Source

Source File: 00000000.00000002.3656648467.00000000052C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52c0000_Ke5ufWcgxp.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 9d129ec38a8d7708035402925f9bd3e002b81b803f452347e178a304093684fe
Instruction ID: 94e6162fb9e05b0ff926363be9dd32c7a38a080180a9192a733057443e36447e
Opcode Fuzzy Hash: 9d129ec38a8d7708035402925f9bd3e002b81b803f452347e178a304093684fe
Instruction Fuzzy Hash: 3C418EEB13C224EEA556C1862B5CAFF5E2FEAD673073086EEB807D6203D6C50B494131

Function 005C9789 Relevance: 1.7, APIs: 1, Instructions: 198fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000000,?), ref: 005C990E

Memory Dump Source

Source File: 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.3636469569.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3636606230.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3637426316.000000000070A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000070D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3643625441.00000000009C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644742846.0000000000B59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644840814.0000000000B5B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_Ke5ufWcgxp.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 469ee91106bc7601de719d370aa5e150b29dda1e262869b287fe7d59cd18ca8e
Instruction ID: 2b3006ad0169ce2611462dfa82b3b160966a2ebd2fae19483175863c3de98ac4
Opcode Fuzzy Hash: 469ee91106bc7601de719d370aa5e150b29dda1e262869b287fe7d59cd18ca8e
Instruction Fuzzy Hash: 6561917290411AAEDF119FE8C888FEEBFB9BF4A304F14054DE904A7246D736D951CBA1

Function 005C8DFF Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,005C8CE6,00000000,?,006FA178,0000000C,005C8DA2,?,?,?), ref: 005C8E55

Memory Dump Source

Source File: 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.3636469569.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3636606230.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3637426316.000000000070A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000070D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3643625441.00000000009C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644742846.0000000000B59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644840814.0000000000B5B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_Ke5ufWcgxp.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 8c4e6344aeaaa11202f7fd2853b9d4e88ab3c6f301e38bd0c2bc9526a930fb12
Instruction ID: 7486d7fcaf79efa5f899ad13b4d7cb0266d436f913b195571f42b9f159f585b3
Opcode Fuzzy Hash: 8c4e6344aeaaa11202f7fd2853b9d4e88ab3c6f301e38bd0c2bc9526a930fb12
Instruction Fuzzy Hash: 24112B336051145DDA6522F5584AF7E2F4DABC3738F29065DF9188B1C3DF719CC18265

Function 005C251C Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,?,?,?,?,?,00000000,?,?,?,005C2626,?,?,?,?,?), ref: 005C2558

Memory Dump Source

Source File: 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.3636469569.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3636606230.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3637426316.000000000070A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000070D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3643625441.00000000009C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644742846.0000000000B59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644840814.0000000000B5B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_Ke5ufWcgxp.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 14d775ccf9365a175e86268c0173eb2b7ea18c7c015ef6e62a1458c0f93571d5
Instruction ID: 646a7a774c1481b9968d69a838b8eeba094f2843e15a2128f28288a0f1dba767
Opcode Fuzzy Hash: 14d775ccf9365a175e86268c0173eb2b7ea18c7c015ef6e62a1458c0f93571d5
Instruction Fuzzy Hash: A401D632610515AFCF199F99DC55E9E7F69EB85330F24024CF8109B2E1EA71ED918B90

Function 005832D0 Relevance: 1.5, APIs: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0058331F

Memory Dump Source

Source File: 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.3636469569.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3636606230.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3637426316.000000000070A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000070D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3643625441.00000000009C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644742846.0000000000B59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644840814.0000000000B5B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_Ke5ufWcgxp.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 0fd589d96c9d07b1efa01aec19e4ff46bb0766daf2056f60d33bc81ca57302d3
Instruction ID: 8357e3fc5127b7bd2bdb7be42ed1961fbb43cdab9ca9d2b740bfd4dd3b3a8b87
Opcode Fuzzy Hash: 0fd589d96c9d07b1efa01aec19e4ff46bb0766daf2056f60d33bc81ca57302d3
Instruction Fuzzy Hash: CEF0B4721001059BDB147F64D4195E9BFE8FF64362750097AFC8DE7212EF26EA40C790

Function 005CA65A Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000001,?,005C9FE0,00000001,00000364,00000001,00000006,000000FF,?,005B4B3F,?,?,76A923A0,?), ref: 005CA69B

Memory Dump Source

Source File: 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.3636469569.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3636606230.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3637426316.000000000070A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000070D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3643625441.00000000009C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644742846.0000000000B59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644840814.0000000000B5B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_Ke5ufWcgxp.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a15c79ba39cf1d3dada70b3a75e218c0111c6336ff5f680c2549d8f076afaf9f
Instruction ID: 0cf9d709aa2d8f387de30b3afd17bf43afd0851b408c426f4a79321c0abee4a1
Opcode Fuzzy Hash: a15c79ba39cf1d3dada70b3a75e218c0111c6336ff5f680c2549d8f076afaf9f
Instruction Fuzzy Hash: CEF0B4329115296E9B225AF29C05F6A7F59BF817B4F2D811DE804EB080CA20DC8085E6

Function 005CB094 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000001,?,?,005B4B3F,?,?,76A923A0,?,?,00583522,?,?), ref: 005CB0C6

Memory Dump Source

Source File: 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.3636469569.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3636606230.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3637426316.000000000070A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000070D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3643625441.00000000009C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644742846.0000000000B59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644840814.0000000000B5B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_Ke5ufWcgxp.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 86c26695d84a816306d6ed81de709755d20e2ffb7b612e7186101b32296515b7
Instruction ID: 64649c1a90d547c9266734015c1c3858db1f61dd6a99a8b28b2ef82f8318d79a
Opcode Fuzzy Hash: 86c26695d84a816306d6ed81de709755d20e2ffb7b612e7186101b32296515b7
Instruction Fuzzy Hash: 20E0E5361016215EFA2126F59C0EF5B7E48BF813A0F150258EC20B20C1DB64CC1081A5

Non-executed Functions

Function 005D47BF Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 005D49D6

Strings

1#SNAN, xrefs: 005D48CB
1#QNAN, xrefs: 005D48D2
1#IND, xrefs: 005D48C4
1#INF, xrefs: 005D48F5

Memory Dump Source

Source File: 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.3636469569.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3636606230.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3637426316.000000000070A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000070D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3643625441.00000000009C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644742846.0000000000B59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644840814.0000000000B5B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_Ke5ufWcgxp.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 35e1ec0cb6eb822cca7e57ca60293c7af9ff44f854269893050401b6579c35db
Instruction ID: c7810f8b0d080080c3ab4ae2d36cdf7533d85c1448e15dfab8b64c333d50b1d7
Opcode Fuzzy Hash: 35e1ec0cb6eb822cca7e57ca60293c7af9ff44f854269893050401b6579c35db
Instruction Fuzzy Hash: 53D22471E086298BDB75CE28CC447EABBB5FB84345F1445EBD40DA7240EB78AE858F41

Function 005BC960 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.3636469569.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3636606230.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3637426316.000000000070A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000070D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3643625441.00000000009C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644742846.0000000000B59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644840814.0000000000B5B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_Ke5ufWcgxp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 333d4b6d5425d6f9d03797ee82114c3711da98524c03317fffdb5ec62fb2b380
Instruction ID: 0e8ebace06537052f35a9a54edb47d9d8862ff8c120bbf6057b4a5c75119c6f0
Opcode Fuzzy Hash: 333d4b6d5425d6f9d03797ee82114c3711da98524c03317fffdb5ec62fb2b380
Instruction Fuzzy Hash: 24022871E002199FDF14CFA9C8806EEBFB1FF88314F24826AD919AB341D731A941CB94

Function 005B361D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 28timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,005B3077,?,?,?,?,00647E2F), ref: 005B3655

Strings

`-X, xrefs: 005B364F

Memory Dump Source

Source File: 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.3636469569.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3636606230.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3637426316.000000000070A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000070D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3643625441.00000000009C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644742846.0000000000B59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644840814.0000000000B5B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_Ke5ufWcgxp.jbxd

Similarity

API ID: Time$FilePreciseSystem
String ID: `-X
API String ID: 1802150274-4060909851
Opcode ID: 11030c24364ca991a3d19e6b214ed6d49a0ec77bc3c6769179450a4e7c75e7ba
Instruction ID: fb01bd420f035ba2070b6456a67b699c40f30560101f7743916a8d7a15a7ab6f
Opcode Fuzzy Hash: 11030c24364ca991a3d19e6b214ed6d49a0ec77bc3c6769179450a4e7c75e7ba
Instruction Fuzzy Hash: 02F06572A44558EFCB019F54DC05F9EBBA8FB09B10F014626E812E7790DB74A9008E94

Function 00672FD0 Relevance: .7, Instructions: 735COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.3636469569.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3636606230.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3637426316.000000000070A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000070D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3643625441.00000000009C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644742846.0000000000B59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644840814.0000000000B5B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_Ke5ufWcgxp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64e9c0abed2e7589debaea49888c95bac1596adee29f6d05b56a34662257128a
Instruction ID: 57aa99d04412f6aff173a9ce1c02ee8f6fb8de0ec035bd3f4fc89509f5f81267
Opcode Fuzzy Hash: 64e9c0abed2e7589debaea49888c95bac1596adee29f6d05b56a34662257128a
Instruction Fuzzy Hash: C7624CB0E012559FDB18CF59C5846ADBBB2BF48308F24C1ADD818AB342D775DA46DF90

Function 005AF580 Relevance: .4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.3636469569.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3636606230.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3637426316.000000000070A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000070D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3643625441.00000000009C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644742846.0000000000B59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644840814.0000000000B5B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_Ke5ufWcgxp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80b9970b4e61b3a89387c81d03852b8640c12f30169ca405eadcc1892538b820
Instruction ID: 10fbabe425d087221e15058648b915988ca7613ed3b7d92c5f03d53ed3ecce49
Opcode Fuzzy Hash: 80b9970b4e61b3a89387c81d03852b8640c12f30169ca405eadcc1892538b820
Instruction Fuzzy Hash: E8E10376E1022A9FCB05CFA8D4816ADFBF1FF89320F1942A9D915B7340D670AD45CBA0

Function 005C036F Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.3636469569.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3636606230.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3637426316.000000000070A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000070D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3643625441.00000000009C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644742846.0000000000B59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644840814.0000000000B5B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_Ke5ufWcgxp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6665ebe8fa650c8c1f845cfa4a8782547fc1c7cb9d8a616eea8a7dec2caa958f
Instruction ID: 9bfee9d4164f47ab92cb38d3449510d5091b7169893b4812372c3406d32d483e
Opcode Fuzzy Hash: 6665ebe8fa650c8c1f845cfa4a8782547fc1c7cb9d8a616eea8a7dec2caa958f
Instruction Fuzzy Hash: 41C1B970900646CFCB28CEE8C484FBABFA1BF85310F246A1DD6969B6D1D330AD85CB51

Function 005CDA86 Relevance: .3, Instructions: 270COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.3636469569.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3636606230.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3637426316.000000000070A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000070D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3643625441.00000000009C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644742846.0000000000B59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644840814.0000000000B5B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_Ke5ufWcgxp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ab2501460c97c37bc66cf3dd30333669de3ffa09423681ef0499ae37808c530
Instruction ID: 3a2b438ba1bb188f188c81234161a23d053909b21f9f14ef6befbaeaeeb755c2
Opcode Fuzzy Hash: 0ab2501460c97c37bc66cf3dd30333669de3ffa09423681ef0499ae37808c530
Instruction Fuzzy Hash: 55B124316106089FD719CF68C48AB657FB0FB45364F29866CE89ACF2A1C335E992CB50

Function 005D8BB0 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.3636469569.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3636606230.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3637426316.000000000070A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000070D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3643625441.00000000009C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644742846.0000000000B59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644840814.0000000000B5B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_Ke5ufWcgxp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76bc5c008dc7788c433eb2a106453ca78ca6abfb1c15c982f7542a757f469c88
Instruction ID: 21f02f6dfa73d9783c987f3dd014b25895f81a55cd40456ae9205c4957f0016b
Opcode Fuzzy Hash: 76bc5c008dc7788c433eb2a106453ca78ca6abfb1c15c982f7542a757f469c88
Instruction Fuzzy Hash: AC81C0B1D01246DFDB219F5CD8857BABFB5FB29300F54026AD9549B393CA349D09C7A0

Function 0066FC40 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.3636469569.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3636606230.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3637426316.000000000070A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000070D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3643625441.00000000009C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644742846.0000000000B59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644840814.0000000000B5B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_Ke5ufWcgxp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2153788f4f032f5bbd540185ec0b399920189e7259226259fdc242c20ab92e52
Instruction ID: 695586c4ec705f1dc3bdce94535c38aca96e753f8da1704678e52ce07d34114c
Opcode Fuzzy Hash: 2153788f4f032f5bbd540185ec0b399920189e7259226259fdc242c20ab92e52
Instruction Fuzzy Hash: 9F6134316246A54FEB18CF1EFCC04763B53A38A3013855669EA85CF3D6C535EA26D7E0

Function 005BA928 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.3636469569.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3636606230.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3637426316.000000000070A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000070D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3643625441.00000000009C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644742846.0000000000B59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644840814.0000000000B5B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_Ke5ufWcgxp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46680d0314554fd398ed7fd020ff60bee8df1d437ae882661bd78aeb1168d151
Instruction ID: aa4492be10cc562045f6983e6db50c19140bf7236a2c3da1c898a592be7906de
Opcode Fuzzy Hash: 46680d0314554fd398ed7fd020ff60bee8df1d437ae882661bd78aeb1168d151
Instruction Fuzzy Hash: B7518E72D0021AEFDF14CF98C940AEEBFB2FF88300F198459E955AB201D734AA40DB91

Function 005B71A0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.3636469569.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3636606230.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3637426316.000000000070A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000070D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3643625441.00000000009C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644742846.0000000000B59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644840814.0000000000B5B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_Ke5ufWcgxp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 0081f709d2e7fc9484f47f6cf92fee0c20c31e28c14bd4118aa9bff11425dfc4
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 15112B7B20D48A47D6148A3DC8B46F7EF95FBDD320B2D437AE0924FB58D222B945E510

Function 0059A060 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0059A09D
std::_Lockit::_Lockit.LIBCPMT ref: 0059A0BF
std::_Lockit::~_Lockit.LIBCPMT ref: 0059A0E7
__Getctype.LIBCPMT ref: 0059A1C5
std::_Facet_Register.LIBCPMT ref: 0059A1F9
std::_Lockit::~_Lockit.LIBCPMT ref: 0059A223

Strings

PDX, xrefs: 0059A19A
PGX, xrefs: 0059A1BF
EX, xrefs: 0059A1AE

Memory Dump Source

Source File: 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.3636469569.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3636606230.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3637426316.000000000070A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000070D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3643625441.00000000009C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644742846.0000000000B59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644840814.0000000000B5B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_Ke5ufWcgxp.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID: PDX$PGX$EX
API String ID: 1102183713-2800748994
Opcode ID: 9f980843c592bb5c681bf0990278489eeaa0226fa6ef6135ab1c52fee771764a
Instruction ID: 89db69fc106b7a12f4bcbfea98495c022d6cc802067d29e08903156def197929
Opcode Fuzzy Hash: 9f980843c592bb5c681bf0990278489eeaa0226fa6ef6135ab1c52fee771764a
Instruction Fuzzy Hash: BD5198B0D01246DFCF11DF58C9457AEBFB0BB40714F288259D855AB391DB74AA44CBE2

Function 005B72D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 005B7307
___except_validate_context_record.LIBVCRUNTIME ref: 005B730F
_ValidateLocalCookies.LIBCMT ref: 005B7398
__IsNonwritableInCurrentImage.LIBCMT ref: 005B73C3
_ValidateLocalCookies.LIBCMT ref: 005B7418

Strings

csm, xrefs: 005B73AD
`-X, xrefs: 005B73DC

Memory Dump Source

Source File: 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.3636469569.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3636606230.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3637426316.000000000070A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000070D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3643625441.00000000009C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644742846.0000000000B59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644840814.0000000000B5B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_Ke5ufWcgxp.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: `-X$csm
API String ID: 1170836740-1905254112
Opcode ID: 9bf277648b66732636178774b6c50e3674fa567e95aa350e3defcc5486bca38f
Instruction ID: a5d66899e1982b99602f8649b54cd44456e2f0d208955cc878d449534c8d2f98
Opcode Fuzzy Hash: 9bf277648b66732636178774b6c50e3674fa567e95aa350e3defcc5486bca38f
Instruction Fuzzy Hash: D9418E34A0420D9BCF10DF68C885AEEBFE5BF89314F148556E8199B392DB31FA05DB91

Function 0059C430 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0059C45A
std::_Lockit::_Lockit.LIBCPMT ref: 0059C47C
std::_Lockit::~_Lockit.LIBCPMT ref: 0059C4A4
std::_Facet_Register.LIBCPMT ref: 0059C59A
std::_Lockit::~_Lockit.LIBCPMT ref: 0059C5C4

Strings

EX, xrefs: 0059C562
PDX, xrefs: 0059C54E

Memory Dump Source

Source File: 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.3636469569.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3636606230.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3637426316.000000000070A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000070D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3643625441.00000000009C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644742846.0000000000B59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644840814.0000000000B5B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_Ke5ufWcgxp.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: EX$PDX
API String ID: 459529453-3077487657
Opcode ID: 9c285c222024e44ccf39a8f14889344acde48911e3ffc1a780a2325a3aaf4b08
Instruction ID: c03dc3c3cdfd1c51e35d1baf40ceb642cf3e1ef968539353a135e1a4873efd5a
Opcode Fuzzy Hash: 9c285c222024e44ccf39a8f14889344acde48911e3ffc1a780a2325a3aaf4b08
Instruction Fuzzy Hash: C951ABB0A00245DFDF11DF58C854BAEBFF0FB41314F248559E849AB381DB75AA05CB91

Function 005CBB66 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 005CBBEC

Memory Dump Source

Source File: 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.3636469569.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3636606230.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3637426316.000000000070A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000070D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3643625441.00000000009C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644742846.0000000000B59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644840814.0000000000B5B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_Ke5ufWcgxp.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 785c90e8ff89e0f1a3d98e37725974d6f6ea20f06d45e48120c47f1ca5a82ffe
Instruction ID: 620ecf723f188c27a93c9c478f9f29f061dbd67ffe2070b1f9407405a789cd6a
Opcode Fuzzy Hash: 785c90e8ff89e0f1a3d98e37725974d6f6ea20f06d45e48120c47f1ca5a82ffe
Instruction Fuzzy Hash: 7AB14672E002569FEB218FA8CC83FEA7FA9FF55710F14415AE905AB282D7749D01C7A1

Function 005B2729 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 005B2730
std::_Lockit::_Lockit.LIBCPMT ref: 005B273B
std::_Lockit::~_Lockit.LIBCPMT ref: 005B27A9

Part of subcall function 005B288C: std::locale::_Locimp::_Locimp.LIBCPMT ref: 005B28A4

std::locale::_Setgloballocale.LIBCPMT ref: 005B2756

Strings

`-X, xrefs: 005B2778, 005B279C

Memory Dump Source

Source File: 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.3636469569.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3636606230.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3637426316.000000000070A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000070D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3643625441.00000000009C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644742846.0000000000B59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644840814.0000000000B5B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_Ke5ufWcgxp.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_Setgloballocale
String ID: `-X
API String ID: 677527491-4060909851
Opcode ID: f46bf465325885c946f0a65a7052d80b9f92b62c0895a5a4c8231b83e65d2cc9
Instruction ID: 809e328ba3d2907baae7fea7e6fbb383b3177d93473f70c5deffe28d9a230e07
Opcode Fuzzy Hash: f46bf465325885c946f0a65a7052d80b9f92b62c0895a5a4c8231b83e65d2cc9
Instruction Fuzzy Hash: 54015A75A016129BCB0AEB24D8495BDBFA2FBC9750F154109E81157391CF78BA02CBAA

Function 00587350 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 158COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 0058750C
___std_exception_destroy.LIBVCRUNTIME ref: 00587522

Strings

[json.exception., xrefs: 005873A1
)X, xrefs: 00587502, 0058751C

Memory Dump Source

Source File: 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.3636469569.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3636606230.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3637426316.000000000070A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000070D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3643625441.00000000009C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644742846.0000000000B59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644840814.0000000000B5B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_Ke5ufWcgxp.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: )X$[json.exception.
API String ID: 4194217158-4038045775
Opcode ID: 151a74fdb7cc2aca7247cbe8645a5268969624a0446c8c0fa70ca09b4d0e3421
Instruction ID: 2fb7d8c6f4519791ac47d206daef4289835a587325ec69db0c5cb88ae45d1673
Opcode Fuzzy Hash: 151a74fdb7cc2aca7247cbe8645a5268969624a0446c8c0fa70ca09b4d0e3421
Instruction Fuzzy Hash: 9951E0B0C057499BDB00DFA8C905B9EBFB4FF55314F104259E850AB382E7B45A44C7E1

Function 00584900 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0058499F

Strings

ios_base::badbit set, xrefs: 00584937, 00584962
ios_base::eofbit set, xrefs: 00584946
ios_base::failbit set, xrefs: 00584828, 00584941

Memory Dump Source

Source File: 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.3636469569.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3636606230.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3637426316.000000000070A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000070D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3643625441.00000000009C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644742846.0000000000B59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644840814.0000000000B5B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_Ke5ufWcgxp.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 323602529-1866435925
Opcode ID: f7472c174918ec07fa445c3fbf22ee52cb0b11a0b8253c9c4391ab427c32b25a
Instruction ID: aca178d31bb9983c0e8472ca3af3eb651046e4cdad4541588bb34f53a398e091
Opcode Fuzzy Hash: f7472c174918ec07fa445c3fbf22ee52cb0b11a0b8253c9c4391ab427c32b25a
Instruction Fuzzy Hash: F9112C72904B856BC720EF5C8C07BAA7B98F745710F044629FE69972C1FB35A901CB92

Function 005836E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 178COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00583819
___std_exception_destroy.LIBVCRUNTIME ref: 005838F0

Strings

)X, xrefs: 005837ED, 005838EA

Memory Dump Source

Source File: 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.3636469569.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3636606230.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3637426316.000000000070A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000070D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3643625441.00000000009C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644742846.0000000000B59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644840814.0000000000B5B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_Ke5ufWcgxp.jbxd

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: )X
API String ID: 2970364248-3875199455
Opcode ID: 9a918def4731b6d3e5eb7f631f7e489d9cae0af89207ad1cf60661b7062be738
Instruction ID: dc185f7b4b15437f385b184ef59ab3923e727a87231a502c4f65e37845bbafd7
Opcode Fuzzy Hash: 9a918def4731b6d3e5eb7f631f7e489d9cae0af89207ad1cf60661b7062be738
Instruction Fuzzy Hash: 136188B1C01249DFDB10DF98C849B9DFFB5FF08324F14825AE818AB282D7B55A44CBA1

Function 005847F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 153COMMONLIBRARYCODE

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0058499F

Strings

ios_base::badbit set, xrefs: 00584937, 00584962
ios_base::failbit set, xrefs: 00584828

Memory Dump Source

Source File: 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.3636469569.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3636606230.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3637426316.000000000070A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000070D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3643625441.00000000009C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644742846.0000000000B59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644840814.0000000000B5B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_Ke5ufWcgxp.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: ios_base::badbit set$ios_base::failbit set
API String ID: 323602529-1240500531
Opcode ID: 3d5e21e196f706f9aa2556d450240ca84628bd395bc0ea15cb818d9a54b9062a
Instruction ID: f5039d316d9b04badd714047ae60ea920a96efe4ccd692f8fd554c2830e13bb8
Opcode Fuzzy Hash: 3d5e21e196f706f9aa2556d450240ca84628bd395bc0ea15cb818d9a54b9062a
Instruction Fuzzy Hash: 934135B1D00649ABCB04EF58CC45BAEBFB9FB45710F24821DF954AB381E7756A00CBA1

Function 00584040 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00584061
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 005840C4

Strings

bad locale name, xrefs: 005840E6

Memory Dump Source

Source File: 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.3636469569.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3636606230.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3637426316.000000000070A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000070D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3643625441.00000000009C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644742846.0000000000B59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644840814.0000000000B5B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_Ke5ufWcgxp.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: a53472c7994080b8e441467cbc93c728ddd126100efc478ece229b133f7d293c
Instruction ID: b63ccfd900e8d89123c323785ac421a5031375b77cf04a983631b3ce5e8af644
Opcode Fuzzy Hash: a53472c7994080b8e441467cbc93c728ddd126100efc478ece229b133f7d293c
Instruction Fuzzy Hash: 0911E670805BC4EED721CF68C50878BBFF4AF15714F14868DE4959BB81D3B96604CBA1

Function 00596590 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005965C9
___std_exception_copy.LIBVCRUNTIME ref: 005965FC

Strings

)X, xrefs: 005965BA, 005965ED

Memory Dump Source

Source File: 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.3636469569.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3636606230.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3637426316.000000000070A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000070D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3643625441.00000000009C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644742846.0000000000B59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644840814.0000000000B5B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_Ke5ufWcgxp.jbxd

Similarity

API ID: ___std_exception_copy
String ID: )X
API String ID: 2659868963-3875199455
Opcode ID: f5ad671392453e81c40b1df2b3d449eb69b12a16722a7b7d1297c3a418cc5d2e
Instruction ID: 994437175ba8ac5ccdd29ea24fb74d96126f076d6a2d593c930f8766b66c4eb0
Opcode Fuzzy Hash: f5ad671392453e81c40b1df2b3d449eb69b12a16722a7b7d1297c3a418cc5d2e
Instruction Fuzzy Hash: 37112EB1910745EBCB11DF99D980B86FBF9FF09720F10876AE9149B741E774A6408BA0

Function 00587A20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00587A5C
___std_exception_destroy.LIBVCRUNTIME ref: 00587A72

Strings

)X, xrefs: 00587A52, 00587A6C

Memory Dump Source

Source File: 00000000.00000002.3636606230.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.3636469569.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3636606230.0000000000705000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3637426316.000000000070A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000070D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3638293541.00000000009C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3643625441.00000000009C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644742846.0000000000B59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3644840814.0000000000B5B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_Ke5ufWcgxp.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: )X
API String ID: 4194217158-3875199455
Opcode ID: a30ba0da27bfc803ad87410e0d68e7e54790bbe79b63413079f58b7bbb588d2b
Instruction ID: 1156f975b0db08375c48274611ca5dd8c3cba564ac33e30e43bb882534642bdb
Opcode Fuzzy Hash: a30ba0da27bfc803ad87410e0d68e7e54790bbe79b63413079f58b7bbb588d2b
Instruction Fuzzy Hash: 01F062B1C04745DFCB10DF98D90178DBBF8FB05724F50066AE415A3781D3B566048BA1

Analysis Process: MPGPH131.exePID: 320, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	3.5%
Dynamic/Decrypted Code Coverage:	0.9%
Signature Coverage:	0%
Total number of Nodes:	1830
Total number of Limit Nodes:	25

Executed Functions

Function 00247B00 Relevance: 16.8, APIs: 11, Instructions: 284
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(000003F4,0000FFFF,00001006,?,00000008), ref: 00247BA6
recv.WS2_32(?,00000004,00000002), ref: 00247BC1
recv.WS2_32(00000000,0000000C,00000002,00000000), ref: 00247C43
recv.WS2_32(00000000,0000000C,00000008), ref: 00247C64
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?,00000000), ref: 00247D01

Part of subcall function 00248590: WSAStartup.WS2_32 ref: 002485BA
Part of subcall function 00248590: socket.WS2_32(?,?,?,?,?,?,00309328,?,?), ref: 0024865E
Part of subcall function 00248590: connect.WS2_32(00000000,002D9BFC,?,?,?,?,00309328,?,?), ref: 00248671
Part of subcall function 00248590: closesocket.WS2_32(00000000), ref: 0024867D

recv.WS2_32(00000000,?,00000008), ref: 00247D1B
recv.WS2_32(?,00000004,00000008), ref: 00247E23
__Xtime_get_ticks.LIBCPMT ref: 00247E2A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00247E38
Sleep.KERNELBASE(00000001,00000000,?,00002710,00000000), ref: 00247EB1
Sleep.KERNELBASE(00000064,?,00002710,00000000), ref: 00247EB9

Memory Dump Source

Source File: 00000006.00000002.3636595072.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000006.00000002.3636486064.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3636595072.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3637424331.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3643585194.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644739386.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644836669.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_MPGPH131.jbxd

Similarity

API ID: recv$Sleepsetsockopt$StartupUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@closesocketconnectsocket
String ID:
API String ID: 301102601-0
Opcode ID: e459f39bedbfcde756fe09d17baf4b6f1983af703d579ab8916ee786210360a5
Instruction ID: 01167bdf9768f9e657ac40c74d19d4d54c6a217bf08524f0b5f902fd79cde8a4
Opcode Fuzzy Hash: e459f39bedbfcde756fe09d17baf4b6f1983af703d579ab8916ee786210360a5
Instruction Fuzzy Hash: 31B1DC70D14308DFEB15DFA4CC99BAEBBB5BB54304F20425AE454AB2E2D7B06D44CB91

Function 00248590 Relevance: 6.1, APIs: 4, Instructions: 99
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 002485BA
socket.WS2_32(?,?,?,?,?,?,00309328,?,?), ref: 0024865E
connect.WS2_32(00000000,002D9BFC,?,?,?,?,00309328,?,?), ref: 00248671
closesocket.WS2_32(00000000), ref: 0024867D

Memory Dump Source

Source File: 00000006.00000002.3636595072.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000006.00000002.3636486064.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3636595072.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3637424331.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3643585194.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644739386.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644836669.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_MPGPH131.jbxd

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: 1af561908ef579670e3d1af10d3653286799cc6cea5bb4fb2a7b829d2d04a81f
Instruction ID: 7d1400bf024d6f60fb893602969403958cd287b7d443665c5f18de8790e2255e
Opcode Fuzzy Hash: 1af561908ef579670e3d1af10d3653286799cc6cea5bb4fb2a7b829d2d04a81f
Instruction Fuzzy Hash: CD3137729253015BC7209F248C4062FB7E8FFC5334F125F19FAA8A31E0D7309C648A92

Function 00189280 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 383
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASend.WS2_32(?,?,00000001,00000000,00000000,00000000,00000000,?,?,?,?,002CD15C,00000000,76A923A0,-00309880), ref: 001896C9

Strings

Ws2_32.dll, xrefs: 0018969A

Memory Dump Source

Source File: 00000006.00000002.3636595072.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000006.00000002.3636486064.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3636595072.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3637424331.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3643585194.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644739386.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644836669.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_MPGPH131.jbxd

Similarity

API ID: Send
String ID: Ws2_32.dll
API String ID: 121738739-3093949381
Opcode ID: bb3c4c721826dcc8540e76718a7f58e54a343a240de1c87e8abc00fc534e5bea
Instruction ID: 5ef0cd9ef63313e25aae1e0c4fd9f1fdb95815cb7ef5141bce2a8d6eddfca6ba
Opcode Fuzzy Hash: bb3c4c721826dcc8540e76718a7f58e54a343a240de1c87e8abc00fc534e5bea
Instruction Fuzzy Hash: 8102EDB0D14298DFDF25DFA4C8907ACBBB0FF55304F284289E4856B686D7741A86CF92

Function 04E00983 Relevance: 1.8, APIs: 1, Instructions: 349
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3656088986.0000000004E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e00000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: d3da07d99dbc7d35c5d1ed12d979d988e1cd75fb33e7aac23c4803b90cccb1ef
Instruction ID: 13c4a80cd71d6e733d1c2640680055a7a191ec49ce5e701ed72bc2dbe3f1a571
Opcode Fuzzy Hash: d3da07d99dbc7d35c5d1ed12d979d988e1cd75fb33e7aac23c4803b90cccb1ef
Instruction Fuzzy Hash: AE618BEB24C121BDF10281823B64FFA676DE7D2730330E86AF857D1482F7946ACA6131

Function 04E00B22 Relevance: 1.7, APIs: 1, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(04E00B1E), ref: 04E00B92

Memory Dump Source

Source File: 00000006.00000002.3656088986.0000000004E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e00000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 6d642d7d7211f1c28b6b23f1e5fb6d09bfd852706407c325e5cd14a5a50b4fe2
Instruction ID: ac7a9d0d1d60efa3394573abb64d9a93f52623a425b833d769e131a4c32c56bb
Opcode Fuzzy Hash: 6d642d7d7211f1c28b6b23f1e5fb6d09bfd852706407c325e5cd14a5a50b4fe2
Instruction Fuzzy Hash: 62418BEB24C121BDF50282813B64FFA6B6DE7D2730330E866F817D1082F7946A8A6531

Function 04E00B2B Relevance: 1.7, APIs: 1, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(04E00B1E), ref: 04E00B92

Memory Dump Source

Source File: 00000006.00000002.3656088986.0000000004E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e00000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 170b5571e310b64a4e7c6b668f70e146579d3cc434378259e809223dd0b0f9fb
Instruction ID: 9b72e7e024ef6ddbe590988f3306decfce2d678b7d8614c84999dd503890d393
Opcode Fuzzy Hash: 170b5571e310b64a4e7c6b668f70e146579d3cc434378259e809223dd0b0f9fb
Instruction Fuzzy Hash: 21417BEB24D121BDF50282813B64FFA6B6DE7D2730730E866F817D1582F7946ACA6131

Function 04E00BAE Relevance: 1.7, APIs: 1, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(04E00B1E), ref: 04E00B92

Memory Dump Source

Source File: 00000006.00000002.3656088986.0000000004E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e00000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 508749c07bcf1d3044902a7be2662128555f9e3ced58973062a257515df746d3
Instruction ID: 796984499bb1f47d5ebe3d8d98e39c4bd011445e281f2d26aea46e4151afda8e
Opcode Fuzzy Hash: 508749c07bcf1d3044902a7be2662128555f9e3ced58973062a257515df746d3
Instruction Fuzzy Hash: C1419AEB24D121BDF50281823B64FF66B2DE7C2B30330E866F817D5482F7946A8A6071

Function 04E00B61 Relevance: 1.7, APIs: 1, Instructions: 215
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(04E00B1E), ref: 04E00B92

Memory Dump Source

Source File: 00000006.00000002.3656088986.0000000004E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e00000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: a0a06610b50b9f70e0bd68035bd446df5ce2770abb6e40e0b4687a86b1d50604
Instruction ID: dbf42098633868a7c8b4d371c6bdcae3fea2e14aa0a1b7dbf2c398658ded64c8
Opcode Fuzzy Hash: a0a06610b50b9f70e0bd68035bd446df5ce2770abb6e40e0b4687a86b1d50604
Instruction Fuzzy Hash: F0419FEB34D161BDF50281813B64FFA6B2DE7D2730330E8A6F813D5086F7946A8A6531

Function 04E00B10 Relevance: 1.7, APIs: 1, Instructions: 213
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(04E00B1E), ref: 04E00B92

Memory Dump Source

Source File: 00000006.00000002.3656088986.0000000004E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e00000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 889a1b9974b5f3e42d54a794f52a83188f39d7d69fb58cdbf36ffd694aeb1be4
Instruction ID: ae37bc51ccdb014562d10986aba0e1f492097b1195a05e9eae7dd07df696340d
Opcode Fuzzy Hash: 889a1b9974b5f3e42d54a794f52a83188f39d7d69fb58cdbf36ffd694aeb1be4
Instruction Fuzzy Hash: 1E41BDEB24C161BDF51282813B64FF66B2DE7D2730330E8A6F813D5082F7946ACA6131

Function 04E00B7D Relevance: 1.7, APIs: 1, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(04E00B1E), ref: 04E00B92

Memory Dump Source

Source File: 00000006.00000002.3656088986.0000000004E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e00000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 45f0152daee50a3d4d23884aba72ed0b3cc4e97af5484e9b575cb08610e010ad
Instruction ID: 23556530eac608d37b79f6a7a106b635e9cbdc8bf0e9e8337ef9f7d770b674a2
Opcode Fuzzy Hash: 45f0152daee50a3d4d23884aba72ed0b3cc4e97af5484e9b575cb08610e010ad
Instruction Fuzzy Hash: 1D419EEB24C121BDF51281813B64FF6676DE7D2B30330E866F813E5082F7946ACA6131

Function 001C9789 Relevance: 1.7, APIs: 1, Instructions: 198
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000000,?), ref: 001C990E

Memory Dump Source

Source File: 00000006.00000002.3636595072.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000006.00000002.3636486064.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3636595072.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3637424331.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3643585194.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644739386.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644836669.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_MPGPH131.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 46bda0ff4784b18fe862455b014a310af42fa0ade3a1dc91ed163def2cd4d17a
Instruction ID: 5bc66584c60f191415e6e338de302e0f2da7ca8b0452bdedba26eda580d1f4d7
Opcode Fuzzy Hash: 46bda0ff4784b18fe862455b014a310af42fa0ade3a1dc91ed163def2cd4d17a
Instruction Fuzzy Hash: 0561C672D04159AFDF15CFA8C848FEEBBB9AF29308F15014DE904A7246D731D911CBA1

Function 001C8DFF Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,001C8CE6,00000000,?,002FA178,0000000C,001C8DA2,?,?,?), ref: 001C8E55

Memory Dump Source

Source File: 00000006.00000002.3636595072.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000006.00000002.3636486064.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3636595072.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3637424331.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3643585194.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644739386.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644836669.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_MPGPH131.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 5a0f7fd0d4b3a92fc547c07aec26127a5c7f48134d99014880edba42162770c1
Instruction ID: 4f89967dd62cd71733203b26e46d1cb2805e068e5fcc276ab6b9a86604a2f862
Opcode Fuzzy Hash: 5a0f7fd0d4b3a92fc547c07aec26127a5c7f48134d99014880edba42162770c1
Instruction Fuzzy Hash: 9F114E336051641AD625227568C2FBE678D8BF3738F29061DF9188B1C3DF71DC814261

Function 001C251C Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(00000000,?,?,?,?,?,00000000,?,?,?,001C2626,?,?,?,?,?), ref: 001C2558

Memory Dump Source

Source File: 00000006.00000002.3636595072.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000006.00000002.3636486064.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3636595072.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3637424331.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3643585194.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644739386.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644836669.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_MPGPH131.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d3f21811f57698b8860619b1ea13802af16925e36bcccd327e85d4b38832ff70
Instruction ID: e2a8544f5219c9a7e0f1a4a8de0fcc67d95f6273bdef8444880c6d92a1212e06
Opcode Fuzzy Hash: d3f21811f57698b8860619b1ea13802af16925e36bcccd327e85d4b38832ff70
Instruction Fuzzy Hash: 12012632710254AFCF09CF58DC11EDE7B69DB95334B24010CF8009B2A1EB71ED518BA0

Function 001832D0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0018331F

Memory Dump Source

Source File: 00000006.00000002.3636595072.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000006.00000002.3636486064.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3636595072.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3637424331.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3643585194.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644739386.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644836669.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_MPGPH131.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 0fd589d96c9d07b1efa01aec19e4ff46bb0766daf2056f60d33bc81ca57302d3
Instruction ID: 9ed4b02ac229b45a1a310c2c913546ae7fd48b5ccdb163c4e3103eae90377dc4
Opcode Fuzzy Hash: 0fd589d96c9d07b1efa01aec19e4ff46bb0766daf2056f60d33bc81ca57302d3
Instruction Fuzzy Hash: 5BF0B4721001049BDB147F64D4155E9B3F8EF24361754097AFCADC7212EB26DB50CB90

Function 001CA65A Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000001,?,001C9FE0,00000001,00000364,00000001,00000006,000000FF,?,001B4B3F,?,?,76A923A0,?), ref: 001CA69B

Memory Dump Source

Source File: 00000006.00000002.3636595072.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000006.00000002.3636486064.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3636595072.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3637424331.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3643585194.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644739386.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644836669.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_MPGPH131.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7546c8c1b0fa1dc43a25adbb7b4cc7f6db585b82435d5f509915e3d9e668c4b7
Instruction ID: 5e4c4187f41ae11d974b8d0bbce163958d3607ac9920be33189fce3ae8906a39
Opcode Fuzzy Hash: 7546c8c1b0fa1dc43a25adbb7b4cc7f6db585b82435d5f509915e3d9e668c4b7
Instruction Fuzzy Hash: 3FF0E2321515386ADB236A72DC12F6A774DAF717B4F9D812EE804EB080DB30DC0086E6

Function 001CB094 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000001,?,?,001B4B3F,?,?,76A923A0,?,?,00183522,?,?), ref: 001CB0C7

Memory Dump Source

Source File: 00000006.00000002.3636595072.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000006.00000002.3636486064.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3636595072.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3637424331.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3643585194.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644739386.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644836669.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_MPGPH131.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 08218610a062a868084db083e1fab89843fbd220a73f256dbd223f87925a6f37
Instruction ID: 388eb239681873e4b7ff9fad8e93dbf0bb7257616d28ed47ef3f22fe8fdadcbe
Opcode Fuzzy Hash: 08218610a062a868084db083e1fab89843fbd220a73f256dbd223f87925a6f37
Instruction Fuzzy Hash: 6BE02B311096306ADB3126759C93F5F766D9F723A0F050259FC24D24C1DB20CC30C1E6

Function 04E10346 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3656160462.0000000004E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e10000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc22806dbe342e24f9adce13dfd386917e02ca0dd5c69a1fe410d66927a5894e
Instruction ID: 4d44907b0b8e4563912eda889ae8ac5bf5efcf3a608788436ebbc205bc426fa2
Opcode Fuzzy Hash: fc22806dbe342e24f9adce13dfd386917e02ca0dd5c69a1fe410d66927a5894e
Instruction Fuzzy Hash: 69C012773CC025DBC0C1A09626442F56755B3537313706263F04384C22754023D97521

Non-executed Functions

Function 001BC960 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3636595072.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000006.00000002.3636486064.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3636595072.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3637424331.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3643585194.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644739386.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644836669.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 333d4b6d5425d6f9d03797ee82114c3711da98524c03317fffdb5ec62fb2b380
Instruction ID: bd870b6c25173df810139d121d3ac0cc15803509ae083af51ec187d6f0536042
Opcode Fuzzy Hash: 333d4b6d5425d6f9d03797ee82114c3711da98524c03317fffdb5ec62fb2b380
Instruction Fuzzy Hash: 97022A75E012199BDF14CFA9C9806EEBBB1FF58314F24826AE919E7381D731A941CBD0

Function 0019A060 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0019A09D
std::_Lockit::_Lockit.LIBCPMT ref: 0019A0BF
std::_Lockit::~_Lockit.LIBCPMT ref: 0019A0E7
__Getctype.LIBCPMT ref: 0019A1C5
std::_Facet_Register.LIBCPMT ref: 0019A1F9
std::_Lockit::~_Lockit.LIBCPMT ref: 0019A223

Strings

W, xrefs: 0019A0AF, 0019A208

Memory Dump Source

Source File: 00000006.00000002.3636595072.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000006.00000002.3636486064.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3636595072.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3637424331.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3643585194.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644739386.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644836669.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_MPGPH131.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID: W
API String ID: 1102183713-1235663173
Opcode ID: e296a2c9c687e739b93c7c84ddb23044a619728e46309fe2c704e470bcaed8de
Instruction ID: bf7af338d11fb01ad718cf2211c6b1ffc9f4216d384af837703a73491aa16505
Opcode Fuzzy Hash: e296a2c9c687e739b93c7c84ddb23044a619728e46309fe2c704e470bcaed8de
Instruction Fuzzy Hash: 1F5188B0D01245CBCB11DF58C9417AEBBB4BF11714F248299D855AB391DB74AE48CBD2

Function 001B72D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 001B7307
___except_validate_context_record.LIBVCRUNTIME ref: 001B730F
_ValidateLocalCookies.LIBCMT ref: 001B7398
__IsNonwritableInCurrentImage.LIBCMT ref: 001B73C3
_ValidateLocalCookies.LIBCMT ref: 001B7418

Strings

csm, xrefs: 001B73AD
iEa], xrefs: 001B7382, 001B73FF

Memory Dump Source

Source File: 00000006.00000002.3636595072.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000006.00000002.3636486064.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3636595072.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3637424331.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3643585194.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644739386.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644836669.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_MPGPH131.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm$iEa]
API String ID: 1170836740-1433933915
Opcode ID: fb6a0f5718628581a0da8c5d29705cd4807015128aee89b9639ac22af8a0994d
Instruction ID: f8058b93ad49525a024304d05409db8653cc1c46d5cb9e9c4c17b682464de9bf
Opcode Fuzzy Hash: fb6a0f5718628581a0da8c5d29705cd4807015128aee89b9639ac22af8a0994d
Instruction Fuzzy Hash: 0B41A134A042099FCF10DF68C885ADEBBE5BF95314F148196EC199B3A2DB31E901DB91

Function 001CBB66 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 001CBBEC

Memory Dump Source

Source File: 00000006.00000002.3636595072.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000006.00000002.3636486064.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3636595072.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3637424331.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3643585194.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644739386.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644836669.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_MPGPH131.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 785c90e8ff89e0f1a3d98e37725974d6f6ea20f06d45e48120c47f1ca5a82ffe
Instruction ID: 1d2b0f4d6bc6e4f79494d18678aa4d9ae3b84e4fffaabde0a461fd7dbdb60e4d
Opcode Fuzzy Hash: 785c90e8ff89e0f1a3d98e37725974d6f6ea20f06d45e48120c47f1ca5a82ffe
Instruction Fuzzy Hash: BCB14232A082959FDB158F68C8C3FFA7BA5EF75710F14416AE905EB282D770D801C7A1

Function 0019C430 Relevance: 7.6, APIs: 5, Instructions: 119COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0019C45A
std::_Lockit::_Lockit.LIBCPMT ref: 0019C47C
std::_Lockit::~_Lockit.LIBCPMT ref: 0019C4A4
std::_Facet_Register.LIBCPMT ref: 0019C59A
std::_Lockit::~_Lockit.LIBCPMT ref: 0019C5C4

Memory Dump Source

Source File: 00000006.00000002.3636595072.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000006.00000002.3636486064.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3636595072.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3637424331.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3643585194.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644739386.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644836669.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_MPGPH131.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 672710caead5b6b6abf9175d1f4f5f9faf653e344e37a5ac99f17013ed14e0a6
Instruction ID: 1db5e25c9ea9a6540e44e72843bf9c70ba4213c807652ca4f06187606cb69b8e
Opcode Fuzzy Hash: 672710caead5b6b6abf9175d1f4f5f9faf653e344e37a5ac99f17013ed14e0a6
Instruction Fuzzy Hash: CA51A9B0A01245DBEF12DF58C854BAEBBF4FB11314F24819AE895AB381D775AE05CBD0

Function 001CA6B7 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 001CA86C

Part of subcall function 001CB094: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,001B4B3F,?,?,76A923A0,?,?,00183522,?,?), ref: 001CB0C7

__freea.LIBCMT ref: 001CA87F
__freea.LIBCMT ref: 001CA88C

Strings

iEa], xrefs: 001CA6BE

Memory Dump Source

Source File: 00000006.00000002.3636595072.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000006.00000002.3636486064.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3636595072.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3637424331.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3643585194.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644739386.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644836669.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_MPGPH131.jbxd

Similarity

API ID: __freea$AllocateHeap
String ID: iEa]
API String ID: 2243444508-2013749009
Opcode ID: 13c6919d317bc04d9a20bb4ff511cb9f752443fcc7454835e887ab7e8d1f54fe
Instruction ID: 09ed3844c4e4e710b8e87995a1c3e81081bba963a4212380b158fdd7da54ce6d
Opcode Fuzzy Hash: 13c6919d317bc04d9a20bb4ff511cb9f752443fcc7454835e887ab7e8d1f54fe
Instruction Fuzzy Hash: 5651C17260020AABEB269EA4DC86FBB7BA9EF64715B55052DFD04D7110EB30DC1186A1

Function 00184900 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0018499F

Strings

ios_base::failbit set, xrefs: 00184828, 00184941
ios_base::eofbit set, xrefs: 00184946
ios_base::badbit set, xrefs: 00184937, 00184962

Memory Dump Source

Source File: 00000006.00000002.3636595072.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000006.00000002.3636486064.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3636595072.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3637424331.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3643585194.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644739386.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644836669.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_MPGPH131.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 323602529-1866435925
Opcode ID: ed527ccfaa617876f0949548d4de8d2bcf88de42822a155f58ccd1595dd8b334
Instruction ID: 7afe677da9cf6c34186d5469c8c483e759a6fdae3a1b0080a60c52041add5a43
Opcode Fuzzy Hash: ed527ccfaa617876f0949548d4de8d2bcf88de42822a155f58ccd1595dd8b334
Instruction Fuzzy Hash: 19112C72D647946BC720FF5C8C03FA67398D719714F044629FE68872C2EF35AA108B92

Function 001B2729 Relevance: 6.0, APIs: 4, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001B2730
std::_Lockit::_Lockit.LIBCPMT ref: 001B273B
std::_Lockit::~_Lockit.LIBCPMT ref: 001B27A9

Part of subcall function 001B288C: std::locale::_Locimp::_Locimp.LIBCPMT ref: 001B28A4

std::locale::_Setgloballocale.LIBCPMT ref: 001B2756

Memory Dump Source

Source File: 00000006.00000002.3636595072.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000006.00000002.3636486064.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3636595072.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3637424331.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3643585194.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644739386.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644836669.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_MPGPH131.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_Setgloballocale
String ID:
API String ID: 677527491-0
Opcode ID: 5fde5f644523d57f0807e3cf1dee0dbe961b294dae779e82fcba72b96590f082
Instruction ID: 1adb84c692a1219dd22c55454e2d58b3081159fb7f3acdceb53a5a9dfcfdf327
Opcode Fuzzy Hash: 5fde5f644523d57f0807e3cf1dee0dbe961b294dae779e82fcba72b96590f082
Instruction Fuzzy Hash: C601DF79A016109BCB0AEB24D8555BD7BB1FFE5750B14404AE81157391CF74AE06CFC6

Function 00187350 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 0018750C
___std_exception_destroy.LIBVCRUNTIME ref: 00187522

Strings

[json.exception., xrefs: 001873A1

Memory Dump Source

Source File: 00000006.00000002.3636595072.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000006.00000002.3636486064.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3636595072.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3637424331.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3643585194.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644739386.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644836669.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_MPGPH131.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.
API String ID: 4194217158-791563284
Opcode ID: 5d6a1d3a15075020977b29c9edbf1074f946ad81b1bb26292726f98ba29edfef
Instruction ID: cfa56d36de850c2308cab8a1c5fbdaa9d2fbb45bed5685e8ff72d8ab090a7902
Opcode Fuzzy Hash: 5d6a1d3a15075020977b29c9edbf1074f946ad81b1bb26292726f98ba29edfef
Instruction Fuzzy Hash: FD51C1B1C146489FDB00EFA8C905B9EBBB4EF25314F144259E854AB382E7B45B44CBE1

Function 001847F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 153COMMONLIBRARYCODE

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0018499F

Strings

ios_base::failbit set, xrefs: 00184828
ios_base::badbit set, xrefs: 00184937, 00184962

Memory Dump Source

Source File: 00000006.00000002.3636595072.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000006.00000002.3636486064.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3636595072.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3637424331.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3643585194.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644739386.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644836669.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_MPGPH131.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: ios_base::badbit set$ios_base::failbit set
API String ID: 323602529-1240500531
Opcode ID: 29c7cb8acbb97c3b68d82bc6330e448346c9e847bfdb3651ea8e5df6bd445e8d
Instruction ID: 3c769b5c32d0de714f0ac246b9d0722173be60247edf0c185007c9ec282834d3
Opcode Fuzzy Hash: 29c7cb8acbb97c3b68d82bc6330e448346c9e847bfdb3651ea8e5df6bd445e8d
Instruction Fuzzy Hash: 4D4116B1D00648ABCB14EF58CC45BAEBBB8EB19710F24825DF554A7381DB756F00CBA1

Function 00184040 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00184061
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 001840C4

Strings

bad locale name, xrefs: 001840E6

Memory Dump Source

Source File: 00000006.00000002.3636595072.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000006.00000002.3636486064.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3636595072.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3637424331.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3638291706.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3643585194.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644739386.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3644836669.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_MPGPH131.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: ab56833a55ae58ba905199606e748174fc2b1f1ff861517a72351e6ed20b3c5b
Instruction ID: a313dbdf024ead10a8452ec9d0811ef2084efb8231dff073382adb1329e5b069
Opcode Fuzzy Hash: ab56833a55ae58ba905199606e748174fc2b1f1ff861517a72351e6ed20b3c5b
Instruction Fuzzy Hash: 8211D370805B84EED721CFA8C50478BBFF4AF26714F14869DE49597B81D3B96604CB91

Analysis Process: MPGPH131.exePID: 6152, Parent PID: 1068COMMON

Executed Functions

Function 00247B00 Relevance: 16.8, APIs: 11, Instructions: 284
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(000003E4,0000FFFF,00001006,?,00000008), ref: 00247BA7
recv.WS2_32(?,00000004,00000002), ref: 00247BC1
recv.WS2_32(00000000,0000000C,00000002,00000000), ref: 00247C43
recv.WS2_32(00000000,0000000C,00000008), ref: 00247C64
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?,00000000), ref: 00247D01

Part of subcall function 00248590: WSAStartup.WS2_32 ref: 002485BB
Part of subcall function 00248590: socket.WS2_32(?,?,?,?,?,?,00309328,?,?), ref: 0024865D
Part of subcall function 00248590: connect.WS2_32(00000000,002D9BFC,?,?,?,?,00309328,?,?), ref: 00248671
Part of subcall function 00248590: closesocket.WS2_32(00000000), ref: 0024867D

recv.WS2_32(00000000,?,00000008), ref: 00247D1B
recv.WS2_32(?,00000004,00000008), ref: 00247E23
__Xtime_get_ticks.LIBCPMT ref: 00247E2A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00247E38
Sleep.KERNELBASE(00000001,00000000,?,00002710,00000000), ref: 00247EB1
Sleep.KERNELBASE(00000064,?,00002710,00000000), ref: 00247EB9

Memory Dump Source

Source File: 00000007.00000002.3636572214.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000007.00000002.3636394421.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3636572214.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3637432440.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3643624192.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644741337.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644835018.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_180000_MPGPH131.jbxd

Similarity

API ID: recv$Sleepsetsockopt$StartupUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@closesocketconnectsocket
String ID:
API String ID: 301102601-0
Opcode ID: 6580aed4a1379b1b06c3394e8497da4f6805358f09f6416c4b02ab62aedddb60
Instruction ID: edb0086e38b27651fa01a21da02dfdc4cbf6efefb1a62c17210e972640d70996
Opcode Fuzzy Hash: 6580aed4a1379b1b06c3394e8497da4f6805358f09f6416c4b02ab62aedddb60
Instruction Fuzzy Hash: 46B1CB70D14308DFEB15DFA4CC99BAEBBB5BB45300F20425AE454AB2E2D7B06D84CB91

Function 00248590 Relevance: 6.1, APIs: 4, Instructions: 99
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 002485BB
socket.WS2_32(?,?,?,?,?,?,00309328,?,?), ref: 0024865D
connect.WS2_32(00000000,002D9BFC,?,?,?,?,00309328,?,?), ref: 00248671
closesocket.WS2_32(00000000), ref: 0024867D

Memory Dump Source

Source File: 00000007.00000002.3636572214.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000007.00000002.3636394421.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3636572214.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3637432440.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3643624192.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644741337.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644835018.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_180000_MPGPH131.jbxd

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: c4bdeaeea399484152d205e3b61abc59bc15fba2f3340f69fdc5741898b208eb
Instruction ID: e1ad9fb36bad8236a0f214b60c3bc5db9b15bfd1e71e2163f67d3618e0cc9da8
Opcode Fuzzy Hash: c4bdeaeea399484152d205e3b61abc59bc15fba2f3340f69fdc5741898b208eb
Instruction Fuzzy Hash: A73139715253015BC7209F248C4562FB7E8FFC5334F125F19FAA4531E0D7309C548692

Function 04CF061B Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 391
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04CF085A

Strings

9yZ, xrefs: 04CF0B62

Memory Dump Source

Source File: 00000007.00000002.3655994682.0000000004CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4cf0000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: 9yZ
API String ID: 2104809126-3320311314
Opcode ID: 01f74f265337a1f2bf96b4878827b5c753a85cabbf8a2abbfe445faca7aca016
Instruction ID: 5891f8166287c0794eefb6f68097e3c177f66daf2b8b456b07b2d6a1ffce1ed3
Opcode Fuzzy Hash: 01f74f265337a1f2bf96b4878827b5c753a85cabbf8a2abbfe445faca7aca016
Instruction Fuzzy Hash: 9C715BEB34C111BDB18281836F24AFB676FE6D2F30735846BFA07D5503F2985A8A6431

Function 00189280 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 383
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASend.WS2_32(?,?,00000001,00000000,00000000,00000000,00000000,?,?,?,?,002CD15C,00000000,76A923A0,-00309880), ref: 001896C9

Strings

Ws2_32.dll, xrefs: 0018969A

Memory Dump Source

Source File: 00000007.00000002.3636572214.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000007.00000002.3636394421.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3636572214.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3637432440.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3643624192.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644741337.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644835018.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_180000_MPGPH131.jbxd

Similarity

API ID: Send
String ID: Ws2_32.dll
API String ID: 121738739-3093949381
Opcode ID: c55b971bfca33273b7da805d038e1ece5992086eb48c0509bd43963282ad88a3
Instruction ID: 6fef90a0a579e6c184865225f69a54bc86fe8546f12c4f1cec5c9455980c1504
Opcode Fuzzy Hash: c55b971bfca33273b7da805d038e1ece5992086eb48c0509bd43963282ad88a3
Instruction Fuzzy Hash: 6D02EDB0D14298DFDF25DFA4C8907ACBBB0FF55304F284289E4856B286D7741A86CF92

Function 04CF063D Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 378
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04CF085A

Strings

9yZ, xrefs: 04CF0B62

Memory Dump Source

Source File: 00000007.00000002.3655994682.0000000004CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4cf0000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: 9yZ
API String ID: 2104809126-3320311314
Opcode ID: 721280e9d763498a9c75470836314012088909137eb47a308789fba74b02c195
Instruction ID: fb231930b4b683047aa3784d2042cc7fa91f0ee889f4cbcada0ce3d3dafe2af5
Opcode Fuzzy Hash: 721280e9d763498a9c75470836314012088909137eb47a308789fba74b02c195
Instruction Fuzzy Hash: 3F716CEB34C111BDB28281436F24AFB676FE6C2B30735846BFA07D5503F2985A8A6531

Function 04CF0614 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 357
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04CF085A

Strings

9yZ, xrefs: 04CF0B62

Memory Dump Source

Source File: 00000007.00000002.3655994682.0000000004CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4cf0000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: 9yZ
API String ID: 2104809126-3320311314
Opcode ID: f536caec5339043e143064a5070d1ed54a803adf7808666430dbbd6502f95dc9
Instruction ID: 9c676e25a9c2fcfb0cdc2480e173fa644cd2c70e65512343fd457568c0001289
Opcode Fuzzy Hash: f536caec5339043e143064a5070d1ed54a803adf7808666430dbbd6502f95dc9
Instruction Fuzzy Hash: 39615AEB34C111BDB18280836F24AFB57AFE6D2F30734846BFA07D5503F2985A896431

Function 04CF062F Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 353
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04CF085A

Strings

9yZ, xrefs: 04CF0B62

Memory Dump Source

Source File: 00000007.00000002.3655994682.0000000004CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4cf0000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: 9yZ
API String ID: 2104809126-3320311314
Opcode ID: 2567902f26673633dae39261d4cf09a465275fbcb69a1fc4b93e949210673f07
Instruction ID: 4ec88fa3b6a048e4abc579176723673e709e954b0db2b239b85fcd7100effef2
Opcode Fuzzy Hash: 2567902f26673633dae39261d4cf09a465275fbcb69a1fc4b93e949210673f07
Instruction Fuzzy Hash: C6614AEB34C111BDB18281836F24AFB67AEE6D2F30734846BFA07D5507F2985A896531

Function 04CF0670 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04CF085A

Strings

9yZ, xrefs: 04CF0B62

Memory Dump Source

Source File: 00000007.00000002.3655994682.0000000004CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4cf0000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: 9yZ
API String ID: 2104809126-3320311314
Opcode ID: e59780ff18b229196af0717639c1c09008f71efe0c4994e1b4bdf9877730ab87
Instruction ID: b0ef7c067719abfd72a2d23ac0db0ab41f354e3962ef84461022e08085a7e834
Opcode Fuzzy Hash: e59780ff18b229196af0717639c1c09008f71efe0c4994e1b4bdf9877730ab87
Instruction Fuzzy Hash: 89513AEB34C115BDB19280836F24AFB676FE6D2F30734846BFA07D5507F2985A8A6431

Function 04CF06A6 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04CF085A

Strings

9yZ, xrefs: 04CF0B62

Memory Dump Source

Source File: 00000007.00000002.3655994682.0000000004CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4cf0000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: 9yZ
API String ID: 2104809126-3320311314
Opcode ID: d997d3ef265017970dac68823559927b3ae4753d7dd593e438ce03625a398224
Instruction ID: 1cfeafea81182b45a6d561e657a5ab3f08abf5836224f8535c854a9aa437b703
Opcode Fuzzy Hash: d997d3ef265017970dac68823559927b3ae4753d7dd593e438ce03625a398224
Instruction Fuzzy Hash: 415139EB34C115BDB18281832F24AFB57AFE6D2F30734846BFA07D5507F2981A896431

Function 04CF06B2 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 315
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04CF085A

Strings

9yZ, xrefs: 04CF0B62

Memory Dump Source

Source File: 00000007.00000002.3655994682.0000000004CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4cf0000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: 9yZ
API String ID: 2104809126-3320311314
Opcode ID: d1f405b6e577643c5bc33c219e8c7642a523c2041ba6992b063d37be02027af2
Instruction ID: f67b8de6a3f8f18a0eb2934f8a77d20bf916491376e6fa7db55a0ea0205b35e1
Opcode Fuzzy Hash: d1f405b6e577643c5bc33c219e8c7642a523c2041ba6992b063d37be02027af2
Instruction Fuzzy Hash: 625159EB34C115BDB18281836F24AFB576FE6D2F30738846BFA07D5503F2981A8A6531

Function 04CF06CB Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 306
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04CF085A

Strings

9yZ, xrefs: 04CF0B62

Memory Dump Source

Source File: 00000007.00000002.3655994682.0000000004CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4cf0000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: 9yZ
API String ID: 2104809126-3320311314
Opcode ID: 64816da106ad3bed9be368a76b4256f74313f9daaf57dd7bf2e697aba4efa4bb
Instruction ID: 366ace4d44bff72fd441055d1858dff691835652b17892dc3ccb91b7b495f688
Opcode Fuzzy Hash: 64816da106ad3bed9be368a76b4256f74313f9daaf57dd7bf2e697aba4efa4bb
Instruction Fuzzy Hash: 8B5148EB34C115BDB18281836F24AFB67AFE6D2F30734846BFA07D1507F6981A896431

Function 04CF0772 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04CF085A

Strings

9yZ, xrefs: 04CF0B62

Memory Dump Source

Source File: 00000007.00000002.3655994682.0000000004CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4cf0000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: 9yZ
API String ID: 2104809126-3320311314
Opcode ID: 3ead539436cf87552750adb8e065bb0e990f7a6416297a324f2c79c38a6ca3a1
Instruction ID: 2a7c1d6fa516dbaa03cb802f4ae7d0a317cb1b5ccfd90a92fb10f597972c3419
Opcode Fuzzy Hash: 3ead539436cf87552750adb8e065bb0e990f7a6416297a324f2c79c38a6ca3a1
Instruction Fuzzy Hash: 2E519DEB34C111BDB28280532F24AF757AFE6D2F30739846BFA07C5507F2881A896071

Function 04CF0727 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 282
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04CF085A

Strings

9yZ, xrefs: 04CF0B62

Memory Dump Source

Source File: 00000007.00000002.3655994682.0000000004CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4cf0000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: 9yZ
API String ID: 2104809126-3320311314
Opcode ID: 0f6545e79c59a11a381a1263385111a8569b44ae2b2e1e55e3fda85da6e3ddc6
Instruction ID: febf71be99124623b366dac82535a7078d6ad9fd1c7da92caad4ab04acee39cb
Opcode Fuzzy Hash: 0f6545e79c59a11a381a1263385111a8569b44ae2b2e1e55e3fda85da6e3ddc6
Instruction Fuzzy Hash: DC518DEB34C111BDB19280532F24AFB67AFE6D6F30735846BFA07C5507F2985A8A6071

Function 04CF06FA Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 281
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04CF085A

Strings

9yZ, xrefs: 04CF0B62

Memory Dump Source

Source File: 00000007.00000002.3655994682.0000000004CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4cf0000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: 9yZ
API String ID: 2104809126-3320311314
Opcode ID: e502ea78f43c6a7d308f0fd7a51ee95cdbcb84d59041b2d2243bab5dda597991
Instruction ID: c5504e839b01df174006dc30441c2345d6342078fc0824a9895230b5c20d2e73
Opcode Fuzzy Hash: e502ea78f43c6a7d308f0fd7a51ee95cdbcb84d59041b2d2243bab5dda597991
Instruction Fuzzy Hash: E0515BAB34C115BDB18281436F24AFB67AFE6D6F30734846BFA07C5507F2982A896431

Function 04CF0713 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04CF085A

Strings

9yZ, xrefs: 04CF0B62

Memory Dump Source

Source File: 00000007.00000002.3655994682.0000000004CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4cf0000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: 9yZ
API String ID: 2104809126-3320311314
Opcode ID: e2878860171af9f203450233de28d96c1cf04771152c7005a55733090941101f
Instruction ID: 1cdf2f0f31f38fdceb39f0d2ed610ff04f4cd701f3bd4fa6a46d6069c586b8ea
Opcode Fuzzy Hash: e2878860171af9f203450233de28d96c1cf04771152c7005a55733090941101f
Instruction Fuzzy Hash: 71514AEB34C115BDB18280432F24AFB57AFE6D6F30738846BFA07C5507F6986A896471

Function 04CF07BE Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 258COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04CF085A

Strings

9yZ, xrefs: 04CF0B62

Memory Dump Source

Source File: 00000007.00000002.3655994682.0000000004CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4cf0000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: 9yZ
API String ID: 2104809126-3320311314
Opcode ID: afebfcb38959172c709cf0a4c588939a6ed24710bc9a14197a37384011da42df
Instruction ID: 915aee926f2f8a87950255f14149d948dcc4230a36c6da81f6e04fe29b102a6c
Opcode Fuzzy Hash: afebfcb38959172c709cf0a4c588939a6ed24710bc9a14197a37384011da42df
Instruction Fuzzy Hash: 80517CEB74C125BDB19280532F64AFB57AFE6D2F30734846BFA07C1507F2986A896071

Function 04CF07A2 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 254COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04CF085A

Strings

9yZ, xrefs: 04CF0B62

Memory Dump Source

Source File: 00000007.00000002.3655994682.0000000004CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4cf0000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: 9yZ
API String ID: 2104809126-3320311314
Opcode ID: 3e453141e8015c05f464afb94d91152cf99f90f6d480b6b3ecce03d3ccb12a06
Instruction ID: c97d3f59e0815d4aa74c536452413231833b75fef84484ab67c0814863e322e1
Opcode Fuzzy Hash: 3e453141e8015c05f464afb94d91152cf99f90f6d480b6b3ecce03d3ccb12a06
Instruction Fuzzy Hash: 59417DEB34C125BDB19280432F24AFB57AFE6D2F30734846BFA07C1507F2985A896071

Function 04CF0756 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 254COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04CF085A

Strings

9yZ, xrefs: 04CF0B62

Memory Dump Source

Source File: 00000007.00000002.3655994682.0000000004CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4cf0000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: 9yZ
API String ID: 2104809126-3320311314
Opcode ID: 002635e703c39ddf20ef5f695b05a734797f5f3a972efd006c0cbbf6727d114f
Instruction ID: 0011fecd8280eee384c63dcb4d4515f6441e73ff4cac221208b5cb59b493f7f9
Opcode Fuzzy Hash: 002635e703c39ddf20ef5f695b05a734797f5f3a972efd006c0cbbf6727d114f
Instruction Fuzzy Hash: 9D419CEB34C211BDB19281532F24AFB67AFE6D2F307788467FA07C5503F2981A4A6171

Function 04CF07D7 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04CF085A

Strings

9yZ, xrefs: 04CF0B62

Memory Dump Source

Source File: 00000007.00000002.3655994682.0000000004CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4cf0000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: 9yZ
API String ID: 2104809126-3320311314
Opcode ID: 2456f75dc4adbc35fd8241e62bd3e90018fbeb4b62535c73661628c1ae6079f6
Instruction ID: 6ec9f5220698d31a262493fd3d83455f7cb3ab1a5f8f36336cba5c60dcdaca28
Opcode Fuzzy Hash: 2456f75dc4adbc35fd8241e62bd3e90018fbeb4b62535c73661628c1ae6079f6
Instruction Fuzzy Hash: 484159EB34C211BDB19280432F24AFB67AFE6D6F30778846BFA07C5503F2885A496071

Function 04CF0803 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04CF085A

Strings

9yZ, xrefs: 04CF0B62

Memory Dump Source

Source File: 00000007.00000002.3655994682.0000000004CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4cf0000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: 9yZ
API String ID: 2104809126-3320311314
Opcode ID: 44fe031d7b34b1f75984c019116a41eb4fc3f6afde655d3d103294b5ba2cb687
Instruction ID: 5363833682f33fa1a000c309b6675e971b5c2ef6436ddb21514ac463c7328973
Opcode Fuzzy Hash: 44fe031d7b34b1f75984c019116a41eb4fc3f6afde655d3d103294b5ba2cb687
Instruction Fuzzy Hash: D7415AEB34C111BDB19281833F24AFB67AFE6D6F30734846AFA07C1507F2985A496071

Function 04CF0830 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 208COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04CF085A

Strings

9yZ, xrefs: 04CF0B62

Memory Dump Source

Source File: 00000007.00000002.3655994682.0000000004CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4cf0000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: 9yZ
API String ID: 2104809126-3320311314
Opcode ID: da4923b69805af5fb1d43719b174cd3bbd8d47fe3396a77b27d1be9dfc4da35a
Instruction ID: 71bb2eb7198d3bc315925f63625cde77958d06cab0b9b5b2b72b977eb77b2428
Opcode Fuzzy Hash: da4923b69805af5fb1d43719b174cd3bbd8d47fe3396a77b27d1be9dfc4da35a
Instruction Fuzzy Hash: 6D418FEB34C211BDB19281476F24AFB67AFE6D6F307348467F607C5503F2985A496131

Function 04CF084E Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04CF085A

Strings

9yZ, xrefs: 04CF0B62

Memory Dump Source

Source File: 00000007.00000002.3655994682.0000000004CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4cf0000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: 9yZ
API String ID: 2104809126-3320311314
Opcode ID: f30aff24895ee535ec1232a288782b215e5bfe84c174e9422879779198cafd6e
Instruction ID: d874d4e67f76cbdcf9aac0855b5ab4a2e08ed1442ce31ab11cdbbc090a94957b
Opcode Fuzzy Hash: f30aff24895ee535ec1232a288782b215e5bfe84c174e9422879779198cafd6e
Instruction Fuzzy Hash: B4418FEB34C115BDB18281432F24AFB67AFE6D6F307388467FA07C5503F6985A896071

Function 001C9789 Relevance: 1.7, APIs: 1, Instructions: 198fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000000,?), ref: 001C990E

Memory Dump Source

Source File: 00000007.00000002.3636572214.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000007.00000002.3636394421.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3636572214.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3637432440.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3643624192.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644741337.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644835018.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_180000_MPGPH131.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: a6f319b00cd7f9ace37470c227af5698cf72ace714e7bf2262d4b39cb9871a57
Instruction ID: 98499f1e538ce4967c2097479b893bf04689ed0d48f73cdc8a198f79594e0adb
Opcode Fuzzy Hash: a6f319b00cd7f9ace37470c227af5698cf72ace714e7bf2262d4b39cb9871a57
Instruction Fuzzy Hash: E461C572C04159AFDF15DFA8C888FEEBBB9AF29308F15014DE904A7256D732D911CBA1

Function 001C8DFF Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,001C8CE6,00000000,?,002FA178,0000000C,001C8DA2,?,?,?), ref: 001C8E55

Memory Dump Source

Source File: 00000007.00000002.3636572214.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000007.00000002.3636394421.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3636572214.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3637432440.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3643624192.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644741337.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644835018.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_180000_MPGPH131.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 63666eee067ae5b42cf6dc543c65f6e2856f50a136f1ec2b1e4023f1dcf30b88
Instruction ID: 852a05434cf128767997a54ac8e46126baebecc2da37bc7a412c2ccdb3fe2d0c
Opcode Fuzzy Hash: 63666eee067ae5b42cf6dc543c65f6e2856f50a136f1ec2b1e4023f1dcf30b88
Instruction Fuzzy Hash: 2211263360516429D6252279A8C2FBE67C94BB3738F29061DF9188B1D3DFB1EC818251

Function 001C251C Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,?,?,?,?,?,00000000,?,?,?,001C2626,?,?,?,?,?), ref: 001C2558

Memory Dump Source

Source File: 00000007.00000002.3636572214.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000007.00000002.3636394421.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3636572214.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3637432440.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3643624192.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644741337.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644835018.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_180000_MPGPH131.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: ac48bf1ac6c5cac488a0bfe5d6e9d0d56739643bf2a613971c6c05f7cd495a11
Instruction ID: 3720e252cc6489ba7945f15e9d73a358b34b72cfb5da0a37895cb3f77de61d5f
Opcode Fuzzy Hash: ac48bf1ac6c5cac488a0bfe5d6e9d0d56739643bf2a613971c6c05f7cd495a11
Instruction Fuzzy Hash: AC012632610114AFDF09DF19DC11EDE7B6ADB95330B24010CF8009B2A1E771ED418B90

Function 001832D0 Relevance: 1.5, APIs: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0018331F

Memory Dump Source

Source File: 00000007.00000002.3636572214.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000007.00000002.3636394421.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3636572214.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3637432440.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3643624192.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644741337.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644835018.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_180000_MPGPH131.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 0fd589d96c9d07b1efa01aec19e4ff46bb0766daf2056f60d33bc81ca57302d3
Instruction ID: 9ed4b02ac229b45a1a310c2c913546ae7fd48b5ccdb163c4e3103eae90377dc4
Opcode Fuzzy Hash: 0fd589d96c9d07b1efa01aec19e4ff46bb0766daf2056f60d33bc81ca57302d3
Instruction Fuzzy Hash: 5BF0B4721001049BDB147F64D4155E9B3F8EF24361754097AFCADC7212EB26DB50CB90

Function 001CA65A Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000001,?,001C9FE0,00000001,00000364,00000001,00000006,000000FF,?,001B4B3F,?,?,76A923A0,?), ref: 001CA69C

Memory Dump Source

Source File: 00000007.00000002.3636572214.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000007.00000002.3636394421.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3636572214.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3637432440.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3643624192.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644741337.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644835018.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_180000_MPGPH131.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e2bbdc92e78e516b0c38923513752a0b52f8a7d8f19737d09a36b32e4c80e039
Instruction ID: 1f5036b3737353ffdae8a511066d4c051e32abb9e0c8d2b02c643d20a2cf6973
Opcode Fuzzy Hash: e2bbdc92e78e516b0c38923513752a0b52f8a7d8f19737d09a36b32e4c80e039
Instruction Fuzzy Hash: BDF0BE321116386A9B236A729826F6A774DAF713B4F9D811AE804EB080DB20DC0086E6

Function 001CB094 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000001,?,?,001B4B3F,?,?,76A923A0,?,?,00183522,?,?), ref: 001CB0C7

Memory Dump Source

Source File: 00000007.00000002.3636572214.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000007.00000002.3636394421.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3636572214.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3637432440.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3643624192.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644741337.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644835018.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_180000_MPGPH131.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 08218610a062a868084db083e1fab89843fbd220a73f256dbd223f87925a6f37
Instruction ID: 388eb239681873e4b7ff9fad8e93dbf0bb7257616d28ed47ef3f22fe8fdadcbe
Opcode Fuzzy Hash: 08218610a062a868084db083e1fab89843fbd220a73f256dbd223f87925a6f37
Instruction Fuzzy Hash: 6BE02B311096306ADB3126759C93F5F766D9F723A0F050259FC24D24C1DB20CC30C1E6

Non-executed Functions

Function 001BC960 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3636572214.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000007.00000002.3636394421.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3636572214.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3637432440.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3643624192.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644741337.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644835018.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_180000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 333d4b6d5425d6f9d03797ee82114c3711da98524c03317fffdb5ec62fb2b380
Instruction ID: bd870b6c25173df810139d121d3ac0cc15803509ae083af51ec187d6f0536042
Opcode Fuzzy Hash: 333d4b6d5425d6f9d03797ee82114c3711da98524c03317fffdb5ec62fb2b380
Instruction Fuzzy Hash: 97022A75E012199BDF14CFA9C9806EEBBB1FF58314F24826AE919E7381D731A941CBD0

Function 001CBB66 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 001CBBEC

Memory Dump Source

Source File: 00000007.00000002.3636572214.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000007.00000002.3636394421.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3636572214.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3637432440.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3643624192.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644741337.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644835018.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_180000_MPGPH131.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 785c90e8ff89e0f1a3d98e37725974d6f6ea20f06d45e48120c47f1ca5a82ffe
Instruction ID: 1d2b0f4d6bc6e4f79494d18678aa4d9ae3b84e4fffaabde0a461fd7dbdb60e4d
Opcode Fuzzy Hash: 785c90e8ff89e0f1a3d98e37725974d6f6ea20f06d45e48120c47f1ca5a82ffe
Instruction Fuzzy Hash: BCB14232A082959FDB158F68C8C3FFA7BA5EF75710F14416AE905EB282D770D801C7A1

Function 001B72D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 001B7307
___except_validate_context_record.LIBVCRUNTIME ref: 001B730F
_ValidateLocalCookies.LIBCMT ref: 001B7398
__IsNonwritableInCurrentImage.LIBCMT ref: 001B73C3
_ValidateLocalCookies.LIBCMT ref: 001B7418

Strings

csm, xrefs: 001B73AD

Memory Dump Source

Source File: 00000007.00000002.3636572214.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000007.00000002.3636394421.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3636572214.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3637432440.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3643624192.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644741337.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644835018.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_180000_MPGPH131.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: fb6a0f5718628581a0da8c5d29705cd4807015128aee89b9639ac22af8a0994d
Instruction ID: f8058b93ad49525a024304d05409db8653cc1c46d5cb9e9c4c17b682464de9bf
Opcode Fuzzy Hash: fb6a0f5718628581a0da8c5d29705cd4807015128aee89b9639ac22af8a0994d
Instruction Fuzzy Hash: 0B41A134A042099FCF10DF68C885ADEBBE5BF95314F148196EC199B3A2DB31E901DB91

Function 0019A060 Relevance: 9.1, APIs: 6, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0019A09D
std::_Lockit::_Lockit.LIBCPMT ref: 0019A0BF
std::_Lockit::~_Lockit.LIBCPMT ref: 0019A0E7
__Getctype.LIBCPMT ref: 0019A1C5
std::_Facet_Register.LIBCPMT ref: 0019A1F9
std::_Lockit::~_Lockit.LIBCPMT ref: 0019A223

Memory Dump Source

Source File: 00000007.00000002.3636572214.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000007.00000002.3636394421.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3636572214.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3637432440.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3643624192.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644741337.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644835018.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_180000_MPGPH131.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: e296a2c9c687e739b93c7c84ddb23044a619728e46309fe2c704e470bcaed8de
Instruction ID: bf7af338d11fb01ad718cf2211c6b1ffc9f4216d384af837703a73491aa16505
Opcode Fuzzy Hash: e296a2c9c687e739b93c7c84ddb23044a619728e46309fe2c704e470bcaed8de
Instruction Fuzzy Hash: 1F5188B0D01245CBCB11DF58C9417AEBBB4BF11714F248299D855AB391DB74AE48CBD2

Function 0019C430 Relevance: 7.6, APIs: 5, Instructions: 119COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0019C45A
std::_Lockit::_Lockit.LIBCPMT ref: 0019C47C
std::_Lockit::~_Lockit.LIBCPMT ref: 0019C4A4
std::_Facet_Register.LIBCPMT ref: 0019C59A
std::_Lockit::~_Lockit.LIBCPMT ref: 0019C5C4

Memory Dump Source

Source File: 00000007.00000002.3636572214.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000007.00000002.3636394421.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3636572214.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3637432440.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3643624192.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644741337.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644835018.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_180000_MPGPH131.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 672710caead5b6b6abf9175d1f4f5f9faf653e344e37a5ac99f17013ed14e0a6
Instruction ID: 1db5e25c9ea9a6540e44e72843bf9c70ba4213c807652ca4f06187606cb69b8e
Opcode Fuzzy Hash: 672710caead5b6b6abf9175d1f4f5f9faf653e344e37a5ac99f17013ed14e0a6
Instruction Fuzzy Hash: CA51A9B0A01245DBEF12DF58C854BAEBBF4FB11314F24819AE895AB381D775AE05CBD0

Function 00184900 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0018499F

Strings

ios_base::badbit set, xrefs: 00184937, 00184962
ios_base::failbit set, xrefs: 00184828, 00184941
ios_base::eofbit set, xrefs: 00184946

Memory Dump Source

Source File: 00000007.00000002.3636572214.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000007.00000002.3636394421.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3636572214.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3637432440.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3643624192.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644741337.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644835018.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_180000_MPGPH131.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 323602529-1866435925
Opcode ID: ed527ccfaa617876f0949548d4de8d2bcf88de42822a155f58ccd1595dd8b334
Instruction ID: 7afe677da9cf6c34186d5469c8c483e759a6fdae3a1b0080a60c52041add5a43
Opcode Fuzzy Hash: ed527ccfaa617876f0949548d4de8d2bcf88de42822a155f58ccd1595dd8b334
Instruction Fuzzy Hash: 19112C72D647946BC720FF5C8C03FA67398D719714F044629FE68872C2EF35AA108B92

Function 001B2729 Relevance: 6.0, APIs: 4, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001B2730
std::_Lockit::_Lockit.LIBCPMT ref: 001B273B
std::_Lockit::~_Lockit.LIBCPMT ref: 001B27A9

Part of subcall function 001B288C: std::locale::_Locimp::_Locimp.LIBCPMT ref: 001B28A4

std::locale::_Setgloballocale.LIBCPMT ref: 001B2756

Memory Dump Source

Source File: 00000007.00000002.3636572214.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000007.00000002.3636394421.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3636572214.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3637432440.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3643624192.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644741337.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644835018.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_180000_MPGPH131.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_Setgloballocale
String ID:
API String ID: 677527491-0
Opcode ID: 5fde5f644523d57f0807e3cf1dee0dbe961b294dae779e82fcba72b96590f082
Instruction ID: 1adb84c692a1219dd22c55454e2d58b3081159fb7f3acdceb53a5a9dfcfdf327
Opcode Fuzzy Hash: 5fde5f644523d57f0807e3cf1dee0dbe961b294dae779e82fcba72b96590f082
Instruction Fuzzy Hash: C601DF79A016109BCB0AEB24D8555BD7BB1FFE5750B14404AE81157391CF74AE06CFC6

Function 00187350 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 0018750C
___std_exception_destroy.LIBVCRUNTIME ref: 00187522

Strings

[json.exception., xrefs: 001873A1

Memory Dump Source

Source File: 00000007.00000002.3636572214.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000007.00000002.3636394421.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3636572214.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3637432440.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3643624192.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644741337.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644835018.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_180000_MPGPH131.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.
API String ID: 4194217158-791563284
Opcode ID: 5d6a1d3a15075020977b29c9edbf1074f946ad81b1bb26292726f98ba29edfef
Instruction ID: cfa56d36de850c2308cab8a1c5fbdaa9d2fbb45bed5685e8ff72d8ab090a7902
Opcode Fuzzy Hash: 5d6a1d3a15075020977b29c9edbf1074f946ad81b1bb26292726f98ba29edfef
Instruction Fuzzy Hash: FD51C1B1C146489FDB00EFA8C905B9EBBB4EF25314F144259E854AB382E7B45B44CBE1

Function 001847F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 153COMMONLIBRARYCODE

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0018499F

Strings

ios_base::badbit set, xrefs: 00184937, 00184962
ios_base::failbit set, xrefs: 00184828

Memory Dump Source

Source File: 00000007.00000002.3636572214.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000007.00000002.3636394421.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3636572214.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3637432440.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3643624192.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644741337.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644835018.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_180000_MPGPH131.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: ios_base::badbit set$ios_base::failbit set
API String ID: 323602529-1240500531
Opcode ID: 29c7cb8acbb97c3b68d82bc6330e448346c9e847bfdb3651ea8e5df6bd445e8d
Instruction ID: 3c769b5c32d0de714f0ac246b9d0722173be60247edf0c185007c9ec282834d3
Opcode Fuzzy Hash: 29c7cb8acbb97c3b68d82bc6330e448346c9e847bfdb3651ea8e5df6bd445e8d
Instruction Fuzzy Hash: 4D4116B1D00648ABCB14EF58CC45BAEBBB8EB19710F24825DF554A7381DB756F00CBA1

Function 00184040 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00184061
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 001840C4

Strings

bad locale name, xrefs: 001840E6

Memory Dump Source

Source File: 00000007.00000002.3636572214.0000000000181000.00000040.00000001.01000000.00000005.sdmp, Offset: 00180000, based on PE: true

Associated: 00000007.00000002.3636394421.0000000000180000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3636572214.0000000000305000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3637432440.000000000030A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000030D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000048D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3638295977.00000000005C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3643624192.00000000005C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644741337.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3644835018.000000000075B000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_180000_MPGPH131.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: ab56833a55ae58ba905199606e748174fc2b1f1ff861517a72351e6ed20b3c5b
Instruction ID: a313dbdf024ead10a8452ec9d0811ef2084efb8231dff073382adb1329e5b069
Opcode Fuzzy Hash: ab56833a55ae58ba905199606e748174fc2b1f1ff861517a72351e6ed20b3c5b
Instruction Fuzzy Hash: 8211D370805B84EED721CFA8C50478BBFF4AF26714F14869DE49597B81D3B96604CB91

Analysis Process: RageMP131.exePID: 7356, Parent PID: 1028COMMON

Executed Functions

Function 007C7B00 Relevance: 16.8, APIs: 11, Instructions: 284
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000408,0000FFFF,00001006,?,00000008), ref: 007C7BA7
recv.WS2_32(?,00000004,00000002), ref: 007C7BC1
recv.WS2_32(00000000,0000000C,00000002,00000000), ref: 007C7C43
recv.WS2_32(00000000,0000000C,00000008), ref: 007C7C64
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?,00000000), ref: 007C7D00

Part of subcall function 007C8590: WSAStartup.WS2_32 ref: 007C85BB
Part of subcall function 007C8590: socket.WS2_32(?,?,?,?,?,?,00889328,?,?), ref: 007C865D
Part of subcall function 007C8590: connect.WS2_32(00000000,00859BFC,?,?,?,?,00889328,?,?), ref: 007C8672
Part of subcall function 007C8590: closesocket.WS2_32(00000000), ref: 007C867D

recv.WS2_32(00000000,?,00000008), ref: 007C7D1B
recv.WS2_32(?,00000004,00000008), ref: 007C7E23
__Xtime_get_ticks.LIBCPMT ref: 007C7E2A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007C7E38
Sleep.KERNELBASE(00000001,00000000,?,00002710,00000000), ref: 007C7EB1
Sleep.KERNELBASE(00000064,?,00002710,00000000), ref: 007C7EB9

Memory Dump Source

Source File: 00000008.00000002.3637104339.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 00000008.00000002.3636972290.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3637104339.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639571615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3644661506.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645069719.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645245904.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_700000_RageMP131.jbxd

Similarity

API ID: recv$Sleepsetsockopt$StartupUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@closesocketconnectsocket
String ID:
API String ID: 301102601-0
Opcode ID: dbb466f14517dcf569e2b711a4db92752d3a3e4a4fcd2d250309017344559f96
Instruction ID: d4d17d5a8ef32d54f9617420f09ad7fda704c6b8352694070e03506ddf6673fc
Opcode Fuzzy Hash: dbb466f14517dcf569e2b711a4db92752d3a3e4a4fcd2d250309017344559f96
Instruction Fuzzy Hash: F9B19B71D04308DFEB24DBA8CC89BADBBB5BB54310F24025DE454AB2D2DBB85D84CB91

Function 007C8590 Relevance: 6.1, APIs: 4, Instructions: 99
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 007C85BB
socket.WS2_32(?,?,?,?,?,?,00889328,?,?), ref: 007C865D
connect.WS2_32(00000000,00859BFC,?,?,?,?,00889328,?,?), ref: 007C8672
closesocket.WS2_32(00000000), ref: 007C867D

Memory Dump Source

Source File: 00000008.00000002.3637104339.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 00000008.00000002.3636972290.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3637104339.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639571615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3644661506.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645069719.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645245904.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_700000_RageMP131.jbxd

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: c446d019e7e3f08c7ed3bbc4ef1506afd7bec5bd94b58de89d8ddb174afd1684
Instruction ID: f59778b444123b932502906e16e8dc82ffb5af4e5c58f4af8b9f01c296828944
Opcode Fuzzy Hash: c446d019e7e3f08c7ed3bbc4ef1506afd7bec5bd94b58de89d8ddb174afd1684
Instruction Fuzzy Hash: 3731E1729053416BD7208E288C45B6BB7E4FB85328F115F1DFAA4A22E1E775AC048697

Function 00709280 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 383
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASend.WS2_32(?,?,00000001,00000000,00000000,00000000,00000000,?,?,?,?,0084D15C,00000000,76A923A0,-00889880), ref: 007096C9

Strings

Ws2_32.dll, xrefs: 0070969A

Memory Dump Source

Source File: 00000008.00000002.3637104339.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 00000008.00000002.3636972290.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3637104339.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639571615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3644661506.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645069719.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645245904.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_700000_RageMP131.jbxd

Similarity

API ID: Send
String ID: Ws2_32.dll
API String ID: 121738739-3093949381
Opcode ID: 30c2909f2a0d8fd56a656c45f2aa03cb854989379236318d3a88eaf6a4c38d66
Instruction ID: ca2089664e0350294d137bef476dec1ed7a00be190a9d1ce8ce25822a77dc143
Opcode Fuzzy Hash: 30c2909f2a0d8fd56a656c45f2aa03cb854989379236318d3a88eaf6a4c38d66
Instruction Fuzzy Hash: B502CD70D04298DFDF25CFA8C8947ADBBB0EF59304F244289E4856B2C7D7781986CB92

Function 0501099B Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 05010B79

Strings

]h, xrefs: 050109B2

Memory Dump Source

Source File: 00000008.00000002.3655904541.0000000005010000.00000040.00001000.00020000.00000000.sdmp, Offset: 05010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5010000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID: ]h
API String ID: 2104809126-3573960236
Opcode ID: 2e17d2cf278e93de51af5fb676a9b82054fbc1e217b21c00a3bbd76db258d3cb
Instruction ID: 0475da6979efc0e444b9079f24c78934b194d4d7c66d32d09acb4609822585c8
Opcode Fuzzy Hash: 2e17d2cf278e93de51af5fb676a9b82054fbc1e217b21c00a3bbd76db258d3cb
Instruction Fuzzy Hash: 383137E72491157FA692C08977BCBFE6B5FB7D77307308526BC87D6542E2840ACA013A

Function 0501097B Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 163
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 05010B79

Strings

]h, xrefs: 050109B2

Memory Dump Source

Source File: 00000008.00000002.3655904541.0000000005010000.00000040.00001000.00020000.00000000.sdmp, Offset: 05010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5010000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID: ]h
API String ID: 2104809126-3573960236
Opcode ID: 2c136399760b8769949a8dae2adf81b7719b8bbd1f9c7e8c423eb09931c4b2f8
Instruction ID: 163a64c7188b0865449157473f70335decf8cbb20c63a646b479c0b9e2cb0291
Opcode Fuzzy Hash: 2c136399760b8769949a8dae2adf81b7719b8bbd1f9c7e8c423eb09931c4b2f8
Instruction Fuzzy Hash: 1B3128EB249105BFA252D0857B78BFF675FB7D7730B304526BD87D6542D2840ACA013A

Function 05010975 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 05010B79

Strings

]h, xrefs: 050109B2

Memory Dump Source

Source File: 00000008.00000002.3655904541.0000000005010000.00000040.00001000.00020000.00000000.sdmp, Offset: 05010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5010000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID: ]h
API String ID: 2104809126-3573960236
Opcode ID: 4c7a3a27e546711adb4b0c80f00c5dcd5184f1d0f89d62cfa577bc6e38e837b5
Instruction ID: 0ce45ac2f7f317c3e7ee796480c7c83b95f70c2079c71805172a7ea764dc728a
Opcode Fuzzy Hash: 4c7a3a27e546711adb4b0c80f00c5dcd5184f1d0f89d62cfa577bc6e38e837b5
Instruction Fuzzy Hash: DF31F5EB249105BFA252C089777CBFE675FB7D77307308426BD87D6642E2840ACA013A

Function 00749789 Relevance: 1.7, APIs: 1, Instructions: 198
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0074990E

Memory Dump Source

Source File: 00000008.00000002.3637104339.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 00000008.00000002.3636972290.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3637104339.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639571615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3644661506.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645069719.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645245904.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_700000_RageMP131.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: debddbb988c9b05502572a6514d3506d993c5f69782c50de23cfa24796fe6297
Instruction ID: 9b57ae5cd08c77de1e5a51a4200e5fcbc97c9b7f4548bacc8047f4b1286ffe8a
Opcode Fuzzy Hash: debddbb988c9b05502572a6514d3506d993c5f69782c50de23cfa24796fe6297
Instruction Fuzzy Hash: C16191B1D04119BFDF11DFA8C884AEFBBB9BF4A304F140149EA04A7246D73AD911CBA1

Function 050109DA Relevance: 1.6, APIs: 1, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 05010B79

Memory Dump Source

Source File: 00000008.00000002.3655904541.0000000005010000.00000040.00001000.00020000.00000000.sdmp, Offset: 05010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5010000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: cd664be1c0b772757745639e3559697c4ef57f31940f0d20bfe27be6ddfb0dea
Instruction ID: 011b1496774a0a3affd49aa2d6f11ccf5269ab4e6f03aa9b0b699fe2e468e9e0
Opcode Fuzzy Hash: cd664be1c0b772757745639e3559697c4ef57f31940f0d20bfe27be6ddfb0dea
Instruction Fuzzy Hash: 18313CE7149215AF9252C095777CBFE679FB7977307304426BD87C6542E2840AC9023B

Function 050109CC Relevance: 1.6, APIs: 1, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 05010B79

Memory Dump Source

Source File: 00000008.00000002.3655904541.0000000005010000.00000040.00001000.00020000.00000000.sdmp, Offset: 05010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5010000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: fc1b995a221a018fe123dfba107bc5c6fa61eabb84110220fcd0d99dd546d378
Instruction ID: ea56fc74ba6f77353769a11e67a4bf770d8894a6b70d351d8a5b54d35473bfb1
Opcode Fuzzy Hash: fc1b995a221a018fe123dfba107bc5c6fa61eabb84110220fcd0d99dd546d378
Instruction Fuzzy Hash: 20213ADB24D115BFA252D08977B8BFE565FB7D77307304026BD87C6542D2840ACA013B

Function 050109FE Relevance: 1.6, APIs: 1, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 05010B79

Memory Dump Source

Source File: 00000008.00000002.3655904541.0000000005010000.00000040.00001000.00020000.00000000.sdmp, Offset: 05010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5010000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 8935ff49197dca00b3fd88af2ad0712d182362b935ced73211df7c03266d6baf
Instruction ID: b8f9b84243562e793d3268561105e06c5e9407be7c021cc378ca791641a64745
Opcode Fuzzy Hash: 8935ff49197dca00b3fd88af2ad0712d182362b935ced73211df7c03266d6baf
Instruction Fuzzy Hash: 2821F7EB249105AFA252D08977B8BFE675FB7D77307708426BD87C6542E2840AC9013B

Function 05010AA7 Relevance: 1.6, APIs: 1, Instructions: 123
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 05010B79

Memory Dump Source

Source File: 00000008.00000002.3655904541.0000000005010000.00000040.00001000.00020000.00000000.sdmp, Offset: 05010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5010000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: bfa6dc79b85bf1c4424836e6a127db70541377974411f1471a6016617552298b
Instruction ID: 5a1d50f6ff3ae72688b03cce1f126588dd27a02dfb51b4a7dc7691279a22dfbe
Opcode Fuzzy Hash: bfa6dc79b85bf1c4424836e6a127db70541377974411f1471a6016617552298b
Instruction Fuzzy Hash: AA2137AB24D2156F9652C0993B78EFF6B6FA7D7B307304536FC87C6142E28409CA0136

Function 05010A0B Relevance: 1.6, APIs: 1, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 05010B79

Memory Dump Source

Source File: 00000008.00000002.3655904541.0000000005010000.00000040.00001000.00020000.00000000.sdmp, Offset: 05010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5010000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 61481a55eb54e04762f5e90b9a57cad582c2155a8ac3162e32372e0ac2972706
Instruction ID: 6166232df7a893efbcd05e8c0cd48afacacdfa1bdeae172e6fe6e4c7f0ea3835
Opcode Fuzzy Hash: 61481a55eb54e04762f5e90b9a57cad582c2155a8ac3162e32372e0ac2972706
Instruction Fuzzy Hash: C321F8DB249115BFA252D08977B8AFE675FB7D77307708436BC87C6542E2844ACA013A

Function 05010A28 Relevance: 1.6, APIs: 1, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 05010B79

Memory Dump Source

Source File: 00000008.00000002.3655904541.0000000005010000.00000040.00001000.00020000.00000000.sdmp, Offset: 05010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5010000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: a1100144e779f56668e3f863c4aad31304d9defbf43637139b69da04b060814c
Instruction ID: 128369822faba15b7f7cbe5af3634f3ecbb09d1ebb1bf6eb3b93e3951e021002
Opcode Fuzzy Hash: a1100144e779f56668e3f863c4aad31304d9defbf43637139b69da04b060814c
Instruction Fuzzy Hash: 6C2128EB249105BFA652C0897BB8BFEA75FB7D67347304426BC87C2542E6800ACA0136

Function 05010A3D Relevance: 1.6, APIs: 1, Instructions: 121
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 05010B79

Memory Dump Source

Source File: 00000008.00000002.3655904541.0000000005010000.00000040.00001000.00020000.00000000.sdmp, Offset: 05010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5010000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: abb5a4f9437b394f49ab3506db0b4a8904664109b48f0193d4ceeb68f15aff67
Instruction ID: c34cb98628cbd94bb6a459edcabec878d1aabb5d29f7c41804d7e841ca34032e
Opcode Fuzzy Hash: abb5a4f9437b394f49ab3506db0b4a8904664109b48f0193d4ceeb68f15aff67
Instruction Fuzzy Hash: 672127E72482557F9652D0983BB8AFF6B6FABD77703304536FC47D6142E2850ACA0136

Function 05010A20 Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 05010B79

Memory Dump Source

Source File: 00000008.00000002.3655904541.0000000005010000.00000040.00001000.00020000.00000000.sdmp, Offset: 05010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5010000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: f06a7bf0c4bc9153c59cbd4244645de42a6c937f87ca91382ec5d220a4427d9d
Instruction ID: 2dc1c1d5171a205af477516ea1bc51af4d2c8193ebcf6ab3b82e52893f0b6aa3
Opcode Fuzzy Hash: f06a7bf0c4bc9153c59cbd4244645de42a6c937f87ca91382ec5d220a4427d9d
Instruction Fuzzy Hash: 6E21F8EB249105AFA251D08977B8AFE675FB7D67307308426FC87C6142E2844ACA013A

Function 05010A6F Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 05010B79

Memory Dump Source

Source File: 00000008.00000002.3655904541.0000000005010000.00000040.00001000.00020000.00000000.sdmp, Offset: 05010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5010000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 6df16d2b60a510380a73f9f6decbc1c825bcc37d2b7dda25d027e2768c670523
Instruction ID: 88e9cf6585f491d2f833aad5cec6b301c3be44d630b3209ee69d0cf8222159d0
Opcode Fuzzy Hash: 6df16d2b60a510380a73f9f6decbc1c825bcc37d2b7dda25d027e2768c670523
Instruction Fuzzy Hash: 6F2138E7249105AF5652D09977B8AFF67AFA7DB7303304436F847C6142E6800ACA013A

Function 05010A89 Relevance: 1.6, APIs: 1, Instructions: 106COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 05010B79

Memory Dump Source

Source File: 00000008.00000002.3655904541.0000000005010000.00000040.00001000.00020000.00000000.sdmp, Offset: 05010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5010000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 356a3bc5930d08cea2df36924622653009f230239d392512fd17c212c1c2918f
Instruction ID: 64f68637873a68cb68a3224fd3081f30b243c6e59d3e17171cf17c83e0531c24
Opcode Fuzzy Hash: 356a3bc5930d08cea2df36924622653009f230239d392512fd17c212c1c2918f
Instruction Fuzzy Hash: 291124AB249105AF9652D09977B8AFFAB9FB7C77303304526FC87C6542E28446CA013A

Function 05010ADA Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 05010B79

Memory Dump Source

Source File: 00000008.00000002.3655904541.0000000005010000.00000040.00001000.00020000.00000000.sdmp, Offset: 05010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5010000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: ea00a707a0a7b3e38b2ccaee3c5cbd0e7d756e2024bebd8f669b166a8d319129
Instruction ID: 1ce767016c229b4b6b296a98fd1b663bd3cd46e9a41039ea9f10f78bc7ddaef2
Opcode Fuzzy Hash: ea00a707a0a7b3e38b2ccaee3c5cbd0e7d756e2024bebd8f669b166a8d319129
Instruction Fuzzy Hash: CE113AA724D245AF9252D0987778EFF6B9FBB977343344466FC87C6542D2840ACA0126

Function 05010ABF Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 05010B79

Memory Dump Source

Source File: 00000008.00000002.3655904541.0000000005010000.00000040.00001000.00020000.00000000.sdmp, Offset: 05010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5010000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 8905929f652ab09c7d5b48250e118a7974985b58db05988dc1277f3c2e5d8a59
Instruction ID: 68dfcb86a42f5d60b7cbfd9f12dadba67ec71cc78948a364605ee442787d5a38
Opcode Fuzzy Hash: 8905929f652ab09c7d5b48250e118a7974985b58db05988dc1277f3c2e5d8a59
Instruction Fuzzy Hash: 3F113AE72481046F8652D09977B8AFFAB9FA7877347304566BC87D6542E2800ACA0126

Function 05010AF8 Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 05010B79

Memory Dump Source

Source File: 00000008.00000002.3655904541.0000000005010000.00000040.00001000.00020000.00000000.sdmp, Offset: 05010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5010000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: fbaea91e90591215fba1917ac5a86bac5737a27d72898ac31d59d07bd581e84c
Instruction ID: b9792d33e8d209a726c3faa5de46ac7c04fc0c348fbc83f9e906a80702cc7383
Opcode Fuzzy Hash: fbaea91e90591215fba1917ac5a86bac5737a27d72898ac31d59d07bd581e84c
Instruction Fuzzy Hash: 421148E73482456F975295D93BA8EFEBB9FAAC7B30334057AE847C7543D280098A0132

Function 05010B22 Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 05010B79

Memory Dump Source

Source File: 00000008.00000002.3655904541.0000000005010000.00000040.00001000.00020000.00000000.sdmp, Offset: 05010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5010000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 29526935562b079f82782e1255e24172fd31785867202824dc04755c2272abf8
Instruction ID: 742f5a38dc856a7ab2fab367147dbf4b24048e7dfb7e24ce9cbe84433c4a377e
Opcode Fuzzy Hash: 29526935562b079f82782e1255e24172fd31785867202824dc04755c2272abf8
Instruction Fuzzy Hash: 1E01F9DB2481456E555190D937BCAFEA79FA7C77743305836AC47C7542E28149CA1036

Function 00748DFF Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,00748CE6,00000000,?,0087A178,0000000C,00748DA2,?,?,?), ref: 00748E55

Memory Dump Source

Source File: 00000008.00000002.3637104339.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 00000008.00000002.3636972290.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3637104339.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639571615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3644661506.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645069719.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645245904.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_700000_RageMP131.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 536498d49ec86c6e2b95cfe8ccb3dc14c3e30f72aa650358f229d2a9e8886776
Instruction ID: 8a93e7be60c039976235b4924f86656230e3f4acc5f1f52f616892f469f7dd19
Opcode Fuzzy Hash: 536498d49ec86c6e2b95cfe8ccb3dc14c3e30f72aa650358f229d2a9e8886776
Instruction Fuzzy Hash: A6116B33645138A9D6A522349C45B7E27495F82B38F29065DFA189B1C3DF7CDC814253

Function 05010B3D Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 05010B79

Memory Dump Source

Source File: 00000008.00000002.3655904541.0000000005010000.00000040.00001000.00020000.00000000.sdmp, Offset: 05010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5010000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: d8fbd1a62062d756ab7918821d3843ce6a99af0aad12d2791cc896abe19f870c
Instruction ID: dd0f94476a8b85320ae2bc274107c5c334daf79dc3625f9d67c49d0230b85fd6
Opcode Fuzzy Hash: d8fbd1a62062d756ab7918821d3843ce6a99af0aad12d2791cc896abe19f870c
Instruction Fuzzy Hash: 22F0F9EB2442452E565191D93768BFEA7DFAAC7B703305476E847C7542E28109CA0036

Function 05010B4C Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 05010B79

Memory Dump Source

Source File: 00000008.00000002.3655904541.0000000005010000.00000040.00001000.00020000.00000000.sdmp, Offset: 05010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5010000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: aff5a52a26ab11a46bffb16359168e18d508a8a34c1b28ac00a91ab2daac5afe
Instruction ID: b5db24eeb6e16ffbdb0d3748b4fde557d5435a530fa2b3770d6fd7d290555220
Opcode Fuzzy Hash: aff5a52a26ab11a46bffb16359168e18d508a8a34c1b28ac00a91ab2daac5afe
Instruction Fuzzy Hash: 5AF07DD73441053E566696DD7768AFEA79FAAC3B703345836E847C7542E681098A0131

Function 0074251C Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,?,?,?,?,?,00000000,?,?,?,00742626,?,?,?,?,?), ref: 00742558

Memory Dump Source

Source File: 00000008.00000002.3637104339.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 00000008.00000002.3636972290.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3637104339.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639571615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3644661506.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645069719.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645245904.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_700000_RageMP131.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: a54e8fcdb1e433da01db46ba16628cba6b3c584538a9bfd27e388ed6c3222506
Instruction ID: 32c83be09749dbcc0109b8461a694c7f2eca3c25f5c3190ddc72c4bb74c896db
Opcode Fuzzy Hash: a54e8fcdb1e433da01db46ba16628cba6b3c584538a9bfd27e388ed6c3222506
Instruction Fuzzy Hash: 23012632640205AFDF09DF58CC1599E7B5AEF85334B740148F8009B2A2EB75EE628B90

Function 007032D0 Relevance: 1.5, APIs: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0070331F

Memory Dump Source

Source File: 00000008.00000002.3637104339.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 00000008.00000002.3636972290.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3637104339.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639571615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3644661506.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645069719.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645245904.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_700000_RageMP131.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 0fd589d96c9d07b1efa01aec19e4ff46bb0766daf2056f60d33bc81ca57302d3
Instruction ID: b0c8b54aa5119038eca5a3f40fd27af841f501c10120a90a989f32cce8d20edd
Opcode Fuzzy Hash: 0fd589d96c9d07b1efa01aec19e4ff46bb0766daf2056f60d33bc81ca57302d3
Instruction Fuzzy Hash: DBF0B472100104DBDB246F64D45A9E9F3ECDF24362B500A7AF88DC7293EB2EDA518790

Function 0074A65A Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000001,?,00749FE0,00000001,00000364,00000001,00000006,000000FF,?,00734B3F,?,?,76A923A0,?), ref: 0074A69B

Memory Dump Source

Source File: 00000008.00000002.3637104339.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 00000008.00000002.3636972290.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3637104339.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639571615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3644661506.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645069719.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645245904.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_700000_RageMP131.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: cb2551f1573546ded665d4f8036a8ae9fc540f2aadc1d23b0276159e3c1f9849
Instruction ID: 3837855a0291023b9a9bf71b7c1806b9148bdeebfa97ce22b5571a731702fdf0
Opcode Fuzzy Hash: cb2551f1573546ded665d4f8036a8ae9fc540f2aadc1d23b0276159e3c1f9849
Instruction Fuzzy Hash: B1F0E2322D1624BBDB216A66DC05A6A374DAF427A0F2F8121EC44EB080CF3CDC0086E7

Function 05010B8F Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 05010B79

Memory Dump Source

Source File: 00000008.00000002.3655904541.0000000005010000.00000040.00001000.00020000.00000000.sdmp, Offset: 05010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5010000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: aa7629199adaf569408385286e38468d77a35679dc2d95c765451ca1c47d3485
Instruction ID: 6368df24fa6e32284978a28e3cb96be76947aad5397f4238f5703541c4120cda
Opcode Fuzzy Hash: aa7629199adaf569408385286e38468d77a35679dc2d95c765451ca1c47d3485
Instruction Fuzzy Hash: 63E055BB2882052F4A52A2DC33B8AFD6B8A5F86A71334083ADC43C7042E58148820066

Function 0074B094 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000001,?,?,00734B3F,?,?,76A923A0,?,?,00703522,?,?), ref: 0074B0C7

Memory Dump Source

Source File: 00000008.00000002.3637104339.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 00000008.00000002.3636972290.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3637104339.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639571615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3644661506.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645069719.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645245904.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_700000_RageMP131.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 71e0f1aaf1fc3e1c52e3de70cebeaf19a73d8a893111046aa711551c2655875c
Instruction ID: ff54522689e4b6e0404aa64cd3400cc913fe423bf423cea89047968b592bf3e5
Opcode Fuzzy Hash: 71e0f1aaf1fc3e1c52e3de70cebeaf19a73d8a893111046aa711551c2655875c
Instruction Fuzzy Hash: AFE09231245625AAEF3136A59C15B6B764DAF423A2F994210EC35A61E1DF6CCC1082F6

Function 05020215 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3655956058.0000000005020000.00000040.00001000.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5020000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28802a8de6452dbffcfe14cdd72ac9606faec8aaafcc1e6510cf5f9b0056a95b
Instruction ID: efd7f1d7f75291f411f6131b1623c5832b38878e33861bbead94f3bdda4bf1cf
Opcode Fuzzy Hash: 28802a8de6452dbffcfe14cdd72ac9606faec8aaafcc1e6510cf5f9b0056a95b
Instruction Fuzzy Hash: FC11E3E754C230BDF102C5613AB8AFE6B6EF6D2B30331886BF846C6606E15A594E5871

Function 050201BA Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3655956058.0000000005020000.00000040.00001000.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5020000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32eb19bda7431e9e6ecb671fa70323d64f4385bb961008c279a37c0c38d71b5b
Instruction ID: 092707a3b5ad238c4059279dc6ee2a591f01c7a745e9d1717bde8c65c564587c
Opcode Fuzzy Hash: 32eb19bda7431e9e6ecb671fa70323d64f4385bb961008c279a37c0c38d71b5b
Instruction Fuzzy Hash: 5611C1F754C320AEF202D1617AB8AFE6BAFE6D6730331896BF442C6502D29A594E4534

Function 050201DA Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3655956058.0000000005020000.00000040.00001000.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5020000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd1bc6493d6de96afd22a31a853d9e99fb034fdfcb2dc26feb7c705ffb353f28
Instruction ID: a18a357c37f8b7bfd68f5e3302819c30f1f200018ae6585037d1a7e7ad16c1e5
Opcode Fuzzy Hash: bd1bc6493d6de96afd22a31a853d9e99fb034fdfcb2dc26feb7c705ffb353f28
Instruction Fuzzy Hash: 5611E7FB54C330ADB201D1613AB8AFE7B6FE5D6730331886BF846D6102D25A594D4874

Function 0502019B Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3655956058.0000000005020000.00000040.00001000.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5020000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03ddbd2d54fe6cae97931f30a49154ef19235cb2562adcc561b7b081f541e505
Instruction ID: ca814612d8c7cf4d1a56f43a241812e585c341f76a2541e2be1b9ad044431ccf
Opcode Fuzzy Hash: 03ddbd2d54fe6cae97931f30a49154ef19235cb2562adcc561b7b081f541e505
Instruction Fuzzy Hash: EC018BFB54C330BEB106C5927A789FE6B6FE6D6730330885BF807C2502D2A99A4D1834

Function 050201F6 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3655956058.0000000005020000.00000040.00001000.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5020000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acbb8d69e8312f9970f29bb821349ed68671327d3ec2bbbda34d650d29c5792d
Instruction ID: bfbd6a22fe3da04f03628079bfa3813f05fd0a6415deef9f65eea065187fb8c4
Opcode Fuzzy Hash: acbb8d69e8312f9970f29bb821349ed68671327d3ec2bbbda34d650d29c5792d
Instruction Fuzzy Hash: F201B5FB54C320BEF101D5513E78AFF67AEE2D2730731896BF846C2102D299594E5834

Function 0502023A Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3655956058.0000000005020000.00000040.00001000.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5020000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b24de7ec6f52039e2cc2031cb75a94ae2de1e6e8af8a28c22cff12ecb9d8d8c6
Instruction ID: 2b3eafa5ff28141f9506aa290c5fd3494b27d4485145d61e56bb49dbaa3d91a5
Opcode Fuzzy Hash: b24de7ec6f52039e2cc2031cb75a94ae2de1e6e8af8a28c22cff12ecb9d8d8c6
Instruction Fuzzy Hash: BCF0C2FB24C3307EB105D5913A68AFFAB6EE5D2730331C86BF842C2503D699594D1434

Function 05020252 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3655956058.0000000005020000.00000040.00001000.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5020000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af90cfe476125b76680fe22560c04392c802986cca9338203fb64bf12a809418
Instruction ID: 54d0787d3cae03f778fa7ed89fed00600a248e635f27a470f434c50bc27c748c
Opcode Fuzzy Hash: af90cfe476125b76680fe22560c04392c802986cca9338203fb64bf12a809418
Instruction Fuzzy Hash: 1EF0C8B764C2306FB204D5527A68AFF67AAE6D2730331847FF442C3106C61A995E5434

Non-executed Functions

Function 0073C960 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3637104339.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 00000008.00000002.3636972290.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3637104339.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639571615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3644661506.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645069719.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645245904.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_700000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 333d4b6d5425d6f9d03797ee82114c3711da98524c03317fffdb5ec62fb2b380
Instruction ID: a3b7b9fd0d1b82f2c9f6240b838cbf48d578130d2754f3a5d9c04f6e5488bac0
Opcode Fuzzy Hash: 333d4b6d5425d6f9d03797ee82114c3711da98524c03317fffdb5ec62fb2b380
Instruction Fuzzy Hash: 6C023B71E012199BEF15CFA9C9806AEFBB1FF48314F248269E919F7341D735A941CB90

Function 0071A060 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0071A09D
std::_Lockit::_Lockit.LIBCPMT ref: 0071A0BF
std::_Lockit::~_Lockit.LIBCPMT ref: 0071A0E7
__Getctype.LIBCPMT ref: 0071A1C5
std::_Facet_Register.LIBCPMT ref: 0071A1F9
std::_Lockit::~_Lockit.LIBCPMT ref: 0071A223

Strings

PDp, xrefs: 0071A19A
Ep, xrefs: 0071A1AE
PGp, xrefs: 0071A1BF

Memory Dump Source

Source File: 00000008.00000002.3637104339.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 00000008.00000002.3636972290.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3637104339.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639571615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3644661506.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645069719.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645245904.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_700000_RageMP131.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID: PDp$PGp$Ep
API String ID: 1102183713-1397274705
Opcode ID: cecce58ad121800b8bc16797ad0b8871fe73ee9bd516f67570fc1d2f691aa78d
Instruction ID: db456769c6ff670067cd7d30ba1b5f659ee4502f9e269b6fb1b4c37fa38b398a
Opcode Fuzzy Hash: cecce58ad121800b8bc16797ad0b8871fe73ee9bd516f67570fc1d2f691aa78d
Instruction Fuzzy Hash: 1D51BBB0D01249EFDB10CF98C9457AEBBF0FB10710F148258D855AB392E778AE85CB92

Function 007372D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00737307
___except_validate_context_record.LIBVCRUNTIME ref: 0073730F
_ValidateLocalCookies.LIBCMT ref: 00737398
__IsNonwritableInCurrentImage.LIBCMT ref: 007373C3
_ValidateLocalCookies.LIBCMT ref: 00737418

Strings

csm, xrefs: 007373AD
`-p, xrefs: 007373DC

Memory Dump Source

Source File: 00000008.00000002.3637104339.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 00000008.00000002.3636972290.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3637104339.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639571615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3644661506.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645069719.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645245904.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_700000_RageMP131.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: `-p$csm
API String ID: 1170836740-1528604419
Opcode ID: aa444dcea41644ab0e155018e3ac687948ea9e1877ca9f702021f2d130b610ea
Instruction ID: dcd07bd1f41f0ce05acd2b5c89e422495001d819e37028ee29f906b922224844
Opcode Fuzzy Hash: aa444dcea41644ab0e155018e3ac687948ea9e1877ca9f702021f2d130b610ea
Instruction Fuzzy Hash: B141D170A04249DBDF24DF68C885A9EBBA5FF05324F148055FC14AB353DB39EA15CB91

Function 0071C430 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0071C45A
std::_Lockit::_Lockit.LIBCPMT ref: 0071C47C
std::_Lockit::~_Lockit.LIBCPMT ref: 0071C4A4
std::_Facet_Register.LIBCPMT ref: 0071C59A
std::_Lockit::~_Lockit.LIBCPMT ref: 0071C5C4

Strings

Ep, xrefs: 0071C562
PDp, xrefs: 0071C54E

Memory Dump Source

Source File: 00000008.00000002.3637104339.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 00000008.00000002.3636972290.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3637104339.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639571615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3644661506.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645069719.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645245904.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_700000_RageMP131.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: Ep$PDp
API String ID: 459529453-1936355350
Opcode ID: c9a889b7cfaa2132e44a0de6192cb1ddad7c37b2fa00d58de874dffdbb54e4bb
Instruction ID: 901f1b06eeb6dbcc61c283b4a73c4069b4416178bd86934a34ba299860b6f841
Opcode Fuzzy Hash: c9a889b7cfaa2132e44a0de6192cb1ddad7c37b2fa00d58de874dffdbb54e4bb
Instruction Fuzzy Hash: 9551C0B0940299DFDB12DF9CD445BAEBBF0FB00314F244158E846AB382D779AE45CB91

Function 0074BB66 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0074BBEC

Memory Dump Source

Source File: 00000008.00000002.3637104339.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 00000008.00000002.3636972290.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3637104339.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639571615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3644661506.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645069719.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645245904.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_700000_RageMP131.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 785c90e8ff89e0f1a3d98e37725974d6f6ea20f06d45e48120c47f1ca5a82ffe
Instruction ID: 8b43c38b1da8c180fc17f08d95a24be19d0740e30fd19ea47d0696e2f565d762
Opcode Fuzzy Hash: 785c90e8ff89e0f1a3d98e37725974d6f6ea20f06d45e48120c47f1ca5a82ffe
Instruction Fuzzy Hash: C8B12672E002A5DFDB158F68CC82BEE7BA5EF59310F1445A5E904AF282D778DD01CBA1

Function 00732729 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00732730
std::_Lockit::_Lockit.LIBCPMT ref: 0073273B
std::_Lockit::~_Lockit.LIBCPMT ref: 007327A9

Part of subcall function 0073288C: std::locale::_Locimp::_Locimp.LIBCPMT ref: 007328A4

std::locale::_Setgloballocale.LIBCPMT ref: 00732756

Strings

`-p, xrefs: 00732778, 0073279C

Memory Dump Source

Source File: 00000008.00000002.3637104339.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 00000008.00000002.3636972290.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3637104339.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639571615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3644661506.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645069719.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645245904.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_700000_RageMP131.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_Setgloballocale
String ID: `-p
API String ID: 677527491-3350804961
Opcode ID: 91d894926f0e56141dd8bcf1139b1847ce3ab0d4eeba6e4329a0dab96490db17
Instruction ID: 4d3d98dcde64b0c22fcde46be1fde036348e5cb5a7f9287d0b7228e2a9ce8125
Opcode Fuzzy Hash: 91d894926f0e56141dd8bcf1139b1847ce3ab0d4eeba6e4329a0dab96490db17
Instruction Fuzzy Hash: A701BC75A00211DBEB0AEB24D8495BD7BB1FF84790F544009E81157393CF3CAE02CB81

Function 00707350 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 158COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 0070750C
___std_exception_destroy.LIBVCRUNTIME ref: 00707522

Strings

)p, xrefs: 00707502, 0070751C
[json.exception., xrefs: 007073A1

Memory Dump Source

Source File: 00000008.00000002.3637104339.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 00000008.00000002.3636972290.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3637104339.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639571615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3644661506.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645069719.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645245904.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_700000_RageMP131.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: )p$[json.exception.
API String ID: 4194217158-3132663411
Opcode ID: 3d57e618cc71cbfba58d894cfdf6283a02c9c1a7e36220c00abeee73f90acc70
Instruction ID: 4d17704e4d88e7a98c2d35d73eaad80d8fc811fd3228886ba081f2a785ff4a7a
Opcode Fuzzy Hash: 3d57e618cc71cbfba58d894cfdf6283a02c9c1a7e36220c00abeee73f90acc70
Instruction Fuzzy Hash: 2251BCB1D05648DBDB10DFA8C90AB9EBBB4EF11314F144259E850AB3C2E7B85A48C7A1

Function 00704900 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0070499F

Strings

ios_base::failbit set, xrefs: 00704828, 00704941
ios_base::eofbit set, xrefs: 00704946
ios_base::badbit set, xrefs: 00704937, 00704962

Memory Dump Source

Source File: 00000008.00000002.3637104339.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 00000008.00000002.3636972290.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3637104339.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639571615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3644661506.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645069719.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645245904.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_700000_RageMP131.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 323602529-1866435925
Opcode ID: df6351e3c59e3902678d7487d41b6f05886859086c11ab2d9090ce2e71a5e5e0
Instruction ID: 77e18022b6fbae2ec19d66e4703558513dff3908359a9cb4e7db221228f0dde9
Opcode Fuzzy Hash: df6351e3c59e3902678d7487d41b6f05886859086c11ab2d9090ce2e71a5e5e0
Instruction Fuzzy Hash: 6B1106B2914A48EBC710DB98DC06BAA73D8E705721F044769BF58D76C2EB3DA9048792

Function 007036E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 178COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00703819
___std_exception_destroy.LIBVCRUNTIME ref: 007038F0

Strings

)p, xrefs: 007037ED, 007038EA

Memory Dump Source

Source File: 00000008.00000002.3637104339.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 00000008.00000002.3636972290.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3637104339.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639571615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3644661506.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645069719.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645245904.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_700000_RageMP131.jbxd

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: )p
API String ID: 2970364248-3545198885
Opcode ID: ba8e1a32c45ce6e8c5669b59a01214893058d1cad32ad68e5ea903c368664d8b
Instruction ID: ebec340246e471854b231da571580e7d7d8c92468d8cc6946db5f42d55d9a3df
Opcode Fuzzy Hash: ba8e1a32c45ce6e8c5669b59a01214893058d1cad32ad68e5ea903c368664d8b
Instruction Fuzzy Hash: E4617AB1C01648DFDB10CF98C849B9DFBB5FF18324F148259E824AB282D7B95A44CBA1

Function 007047F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 153COMMONLIBRARYCODE

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0070499F

Strings

ios_base::failbit set, xrefs: 00704828
ios_base::badbit set, xrefs: 00704937, 00704962

Memory Dump Source

Source File: 00000008.00000002.3637104339.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 00000008.00000002.3636972290.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3637104339.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639571615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3644661506.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645069719.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645245904.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_700000_RageMP131.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: ios_base::badbit set$ios_base::failbit set
API String ID: 323602529-1240500531
Opcode ID: 62002893a2814e2ef0411259a54f3ec052d151585fec47ac9d962e831ca23cf5
Instruction ID: abae7e67593740b6a7d8b8044a44e1e7758f56fead20c2c6780ee6c194409ebf
Opcode Fuzzy Hash: 62002893a2814e2ef0411259a54f3ec052d151585fec47ac9d962e831ca23cf5
Instruction Fuzzy Hash: F84104B1801248EBDB04DF58C845BAEBBF8FB05710F148359FA54A73C2D779AA04CBA1

Function 00704040 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00704061
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 007040C4

Strings

bad locale name, xrefs: 007040E6

Memory Dump Source

Source File: 00000008.00000002.3637104339.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 00000008.00000002.3636972290.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3637104339.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639571615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3644661506.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645069719.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645245904.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_700000_RageMP131.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 67e06a9f303b7905680c5c49926e888001f3dfaee11546a3af7d0f308ec93c66
Instruction ID: 2ad1211e3405dbc273b893a12774b3a8bee0869fa82dce734be6797cb6f20d31
Opcode Fuzzy Hash: 67e06a9f303b7905680c5c49926e888001f3dfaee11546a3af7d0f308ec93c66
Instruction Fuzzy Hash: 9711E670805BC4EED721CF68C50474BBFF4AF15714F14869DD09597782D3B99A04CB91

Function 00716590 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 007165C9
___std_exception_copy.LIBVCRUNTIME ref: 007165FC

Strings

)p, xrefs: 007165BA, 007165ED

Memory Dump Source

Source File: 00000008.00000002.3637104339.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 00000008.00000002.3636972290.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3637104339.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639571615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3644661506.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645069719.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645245904.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_700000_RageMP131.jbxd

Similarity

API ID: ___std_exception_copy
String ID: )p
API String ID: 2659868963-3545198885
Opcode ID: 630a6c79c938eb8d928773ed8b0c97b11c94cb266c961e10319d24db61b2f4fd
Instruction ID: 0e5bd00e04a788024648b20155c92e4d422f3bdd4b9ce78739d3ab3ada1d36d9
Opcode Fuzzy Hash: 630a6c79c938eb8d928773ed8b0c97b11c94cb266c961e10319d24db61b2f4fd
Instruction Fuzzy Hash: EA111CB1910749EBCB11CF99C980A86F7B9FB09720F10876AE924D7741E774A5448BA0

Function 00707A20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00707A5C
___std_exception_destroy.LIBVCRUNTIME ref: 00707A72

Strings

)p, xrefs: 00707A52, 00707A6C

Memory Dump Source

Source File: 00000008.00000002.3637104339.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 00000008.00000002.3636972290.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3637104339.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639571615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3639684463.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3644661506.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645069719.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3645245904.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_700000_RageMP131.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: )p
API String ID: 4194217158-3545198885
Opcode ID: a959c2b73be5e78f721e260a98346c237df604ce76cf52bc12c8fcf291edd5d1
Instruction ID: 0596226daafd55dc6a774d47b60a711b51628e5f66f5493c6213f7918bf96e72
Opcode Fuzzy Hash: a959c2b73be5e78f721e260a98346c237df604ce76cf52bc12c8fcf291edd5d1
Instruction Fuzzy Hash: D5F06DB1804748EFD720DF98C90178DFBF8FB05724F50466AE824E3781E3B966088BA1

Analysis Process: RageMP131.exePID: 7692, Parent PID: 1028COMMON

Executed Functions

Function 007C7B00 Relevance: 16.8, APIs: 11, Instructions: 284
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(000003E4,0000FFFF,00001006,?,00000008), ref: 007C7BA6
recv.WS2_32(?,00000004,00000002), ref: 007C7BC1
recv.WS2_32(00000000,0000000C,00000002,00000000), ref: 007C7C43
recv.WS2_32(00000000,0000000C,00000008), ref: 007C7C64
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?,00000000), ref: 007C7D00

Part of subcall function 007C8590: WSAStartup.WS2_32 ref: 007C85BA
Part of subcall function 007C8590: socket.WS2_32(?,?,?,?,?,?,00889328,?,?), ref: 007C865E
Part of subcall function 007C8590: connect.WS2_32(00000000,00859BFC,?,?,?,?,00889328,?,?), ref: 007C8672
Part of subcall function 007C8590: closesocket.WS2_32(00000000), ref: 007C867D

recv.WS2_32(00000000,?,00000008), ref: 007C7D1B
recv.WS2_32(?,00000004,00000008), ref: 007C7E23
__Xtime_get_ticks.LIBCPMT ref: 007C7E2A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007C7E38
Sleep.KERNELBASE(00000001,00000000,?,00002710,00000000), ref: 007C7EB1
Sleep.KERNELBASE(00000064,?,00002710,00000000), ref: 007C7EB9

Memory Dump Source

Source File: 0000000A.00000002.3636873038.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 0000000A.00000002.3636797458.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3636873038.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639383615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3644544074.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645392207.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645494287.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_700000_RageMP131.jbxd

Similarity

API ID: recv$Sleepsetsockopt$StartupUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@closesocketconnectsocket
String ID:
API String ID: 301102601-0
Opcode ID: 22ad193affe45841c9a9c3d8549fefaec1958e7011776eb2bfd3441f9f23921c
Instruction ID: 6f09d6a66ecf03ff71e90ecf2dbd4944e8bca054afcf78ab9ecdfb74a106aa69
Opcode Fuzzy Hash: 22ad193affe45841c9a9c3d8549fefaec1958e7011776eb2bfd3441f9f23921c
Instruction Fuzzy Hash: 02B19C71D04308DBEB24DBA8CC49BADBBB5BB54314F24425CE454AB2D2DBB85D84CB91

Function 007C8590 Relevance: 6.1, APIs: 4, Instructions: 99
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 007C85BA
socket.WS2_32(?,?,?,?,?,?,00889328,?,?), ref: 007C865E
connect.WS2_32(00000000,00859BFC,?,?,?,?,00889328,?,?), ref: 007C8672
closesocket.WS2_32(00000000), ref: 007C867D

Memory Dump Source

Source File: 0000000A.00000002.3636873038.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 0000000A.00000002.3636797458.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3636873038.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639383615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3644544074.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645392207.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645494287.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_700000_RageMP131.jbxd

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: 03709401fa358d0295fcb52bb97f4f6a4e940db25f9d42b89dcb1570e120791f
Instruction ID: 395ffa538c814681ece10215ce6d846ab9318e02417a3233bd254cd5d1682f72
Opcode Fuzzy Hash: 03709401fa358d0295fcb52bb97f4f6a4e940db25f9d42b89dcb1570e120791f
Instruction Fuzzy Hash: 6A3104725053416BC7208E288C44B2FB7E4FB89328F015F1DFAA8A21E1E775980486A3

Function 00709280 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 383
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASend.WS2_32(?,?,00000001,00000000,00000000,00000000,00000000,?,?,?,?,0084D15C,00000000,76A923A0,-00889880), ref: 007096C9

Strings

Ws2_32.dll, xrefs: 0070969A

Memory Dump Source

Source File: 0000000A.00000002.3636873038.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 0000000A.00000002.3636797458.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3636873038.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639383615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3644544074.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645392207.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645494287.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_700000_RageMP131.jbxd

Similarity

API ID: Send
String ID: Ws2_32.dll
API String ID: 121738739-3093949381
Opcode ID: 545565180ca59419fbb7bf9bcaf87a2e8aa25a3570951e431b143868da0ca9eb
Instruction ID: 82b5d2ead416b43b37e42330c5b134c6cd3520a4a148f7b2ceed63358f45af75
Opcode Fuzzy Hash: 545565180ca59419fbb7bf9bcaf87a2e8aa25a3570951e431b143868da0ca9eb
Instruction Fuzzy Hash: 1802CE70D04298DFDF25CFA8C8947ADBBB0EF59304F244289E4856B2C7D7781986CB92

Function 00749789 Relevance: 1.7, APIs: 1, Instructions: 198
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0074990E

Memory Dump Source

Source File: 0000000A.00000002.3636873038.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 0000000A.00000002.3636797458.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3636873038.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639383615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3644544074.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645392207.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645494287.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_700000_RageMP131.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: e0fba05bcae9207652d16eedc8fc18c663470152c436f3362940d7c37b8b7a7d
Instruction ID: 5f74562eed470f83f570b102daee3e3a2b70dc1630ef5a43dc17cfc84e313a1b
Opcode Fuzzy Hash: e0fba05bcae9207652d16eedc8fc18c663470152c436f3362940d7c37b8b7a7d
Instruction Fuzzy Hash: 98619371D04119BFDF11DFA8C884AEFBBB9BF4A304F140149EA04A7256D73AD951CBA1

Function 04FA09D9 Relevance: 1.7, APIs: 1, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.3655698634.0000000004FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4fa0000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: f2253642320090ea4e10be3a5ae27872dc9742ea4261867ca7c91de018bad808
Instruction ID: bce37532b2db7d523b95450236acea2f013a3a7315272d4e795e969c40b9d6ea
Opcode Fuzzy Hash: f2253642320090ea4e10be3a5ae27872dc9742ea4261867ca7c91de018bad808
Instruction Fuzzy Hash: 3D3116E734D1107DB14289917B50AFA67AEE6C67307308466F407C6602FA942E6F2132

Function 04FA0ADB Relevance: 1.6, APIs: 1, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.3655698634.0000000004FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4fa0000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 625944ab36e2c6f19d1801724d660f626c01c042f0b29ff5827f61bd2c3413a0
Instruction ID: af223df9119e8b72327df361c811d804032c8a29f961a7ea5b2e513f904a46f2
Opcode Fuzzy Hash: 625944ab36e2c6f19d1801724d660f626c01c042f0b29ff5827f61bd2c3413a0
Instruction Fuzzy Hash: 6C214BEB30D2157DB20298913F60EFAA3ADD6C5774730886AF802C6505EB941E9F6132

Function 04FA0AEE Relevance: 1.6, APIs: 1, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.3655698634.0000000004FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4fa0000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: f30b2ae58062cad5133a73a3cc66f77b0b44ab99243e401a35bef05b1c8ddf3d
Instruction ID: 6f265279cddcf77e9ab3bee013fa9d01d23698b42e4d86f954ef8a45f085ed98
Opcode Fuzzy Hash: f30b2ae58062cad5133a73a3cc66f77b0b44ab99243e401a35bef05b1c8ddf3d
Instruction Fuzzy Hash: 82215CEB30D2257D720295923F60EFBA36DD6C5774730886AF807C6506EB842E9F2132

Function 04FA0B23 Relevance: 1.6, APIs: 1, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04FA0BEE

Memory Dump Source

Source File: 0000000A.00000002.3655698634.0000000004FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4fa0000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 5afddca91f2bdf10ae89c127b645149314f092d6527fdda5fde19bbbda1c6f5e
Instruction ID: 87b327d3ac8f026bba574bcde474dbd1c5d7bc74b660c77cfdbfff6f8cdb3c6f
Opcode Fuzzy Hash: 5afddca91f2bdf10ae89c127b645149314f092d6527fdda5fde19bbbda1c6f5e
Instruction Fuzzy Hash: A221D1FB30D2507DB20295513F60EFAB76DDAC673473088AAF802C6101EB952E5F5132

Function 04FA0B0F Relevance: 1.6, APIs: 1, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.3655698634.0000000004FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4fa0000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 7013d719818df52fcb67ab3fe0af9d0d336416034c550ec13a51d3a6feae89b2
Instruction ID: 2b93cd4349b2efa4f5f1041975ca1a77148e7d5bc547a47487e320908bd513a1
Opcode Fuzzy Hash: 7013d719818df52fcb67ab3fe0af9d0d336416034c550ec13a51d3a6feae89b2
Instruction Fuzzy Hash: 6F215EFB30D2157D720295913F60EFAA3ADD6C67707308866F806C6501EB856E9F5172

Function 04FA0B7B Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.3655698634.0000000004FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4fa0000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 81d5636a3eeae68dee0ee649eb079e413386bec4225e0f38a0ef9236d5ecdc03
Instruction ID: d25c4bc618c32e5b71e76f93e431e8d389d7dc9673ff1f40d246d58100077944
Opcode Fuzzy Hash: 81d5636a3eeae68dee0ee649eb079e413386bec4225e0f38a0ef9236d5ecdc03
Instruction Fuzzy Hash: DF11A0FB30D2157EB20299513FA0AFBB3ACDAC57307308476F942C6205EB542E5B5271

Function 04FA0B66 Relevance: 1.6, APIs: 1, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.3655698634.0000000004FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4fa0000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: daf2c3fe81f633070ce603fcbed568424e92a854b9b1a6e830a7e7f2918b135d
Instruction ID: 7712ad6fd03f2ad56f79859c2bc22e53dfb86b5f057a56dda27c26755b474015
Opcode Fuzzy Hash: daf2c3fe81f633070ce603fcbed568424e92a854b9b1a6e830a7e7f2918b135d
Instruction Fuzzy Hash: 5D1170E734D2517DB20295613F60EFAA76DDAC5730730846AF803C6205EB446D5F5271

Function 04FA0BA7 Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04FA0BEE

Memory Dump Source

Source File: 0000000A.00000002.3655698634.0000000004FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4fa0000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: f9b97642e3d0d06e2fc950e9ab22ea16f443cae94b3e0c2899de46668d7f9eea
Instruction ID: 3da16663d1c9b87fd80013f6b8931a28f29cd58512eef5a85225eb9085125515
Opcode Fuzzy Hash: f9b97642e3d0d06e2fc950e9ab22ea16f443cae94b3e0c2899de46668d7f9eea
Instruction Fuzzy Hash: 36014BF730D2157D720199523F60EFA636CDAC5730730886AF807C6205EB542E5B2132

Function 00748DFF Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,00748CE6,00000000,?,0087A178,0000000C,00748DA2,?,?,?), ref: 00748E55

Memory Dump Source

Source File: 0000000A.00000002.3636873038.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 0000000A.00000002.3636797458.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3636873038.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639383615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3644544074.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645392207.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645494287.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_700000_RageMP131.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 842e4bf3b9112a4be26abc66523de50bc6222d1762278162730521a27fa69cbb
Instruction ID: 50be0e9a6ee7a204f5d9b5ffa7e7eea63ab446f1a39afafeb4c527351d9156c2
Opcode Fuzzy Hash: 842e4bf3b9112a4be26abc66523de50bc6222d1762278162730521a27fa69cbb
Instruction Fuzzy Hash: 79112B33645138AAD6A522349845B7E27495B82B38F29065DF9189B1C3DF7DDC814253

Function 04FA0BDD Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04FA0BEE

Memory Dump Source

Source File: 0000000A.00000002.3655698634.0000000004FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4fa0000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 905fc52dc95b408667ab7f09a3025a6e27a10655b1c6b5631f74ff05609177ef
Instruction ID: 689ba92917fcbe9a4a1f5425ee42cc609600a0626d731511a1073dca751670db
Opcode Fuzzy Hash: 905fc52dc95b408667ab7f09a3025a6e27a10655b1c6b5631f74ff05609177ef
Instruction Fuzzy Hash: 7D01D6F2309315AEA3119D613B50AFA73A8EBC5730B208479E406C7204FF507D5B1536

Function 0074251C Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(00000000,?,?,?,?,?,00000000,?,?,?,00742626,?,?,?,?,?), ref: 00742558

Memory Dump Source

Source File: 0000000A.00000002.3636873038.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 0000000A.00000002.3636797458.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3636873038.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639383615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3644544074.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645392207.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645494287.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_700000_RageMP131.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 6ace1fc92d52ad9316f8127ec2fd593be373721d8ffb4500e58b7f267905a781
Instruction ID: defb5f97ed042c217765bdcd415aae3db3c9f84ab561d46ce2d6cbe1f7be8858
Opcode Fuzzy Hash: 6ace1fc92d52ad9316f8127ec2fd593be373721d8ffb4500e58b7f267905a781
Instruction Fuzzy Hash: 41012632640104AFCF099F58CC1599E7B59EB85334B340148F8109B2A2EB75ED628B90

Function 04FA0BC7 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04FA0BEE

Memory Dump Source

Source File: 0000000A.00000002.3655698634.0000000004FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4fa0000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: d20b4b197c510768f8f60e736abfff685e6e002e96c14d6c79ca6e26fd47b1ef
Instruction ID: 0a90178f7ff9ec9ce05be69827fa596bd29970a6c9b9e1aeae4e5cd42eead8b8
Opcode Fuzzy Hash: d20b4b197c510768f8f60e736abfff685e6e002e96c14d6c79ca6e26fd47b1ef
Instruction Fuzzy Hash: C2F0F6F730D2156EB3029A213E60AFAB36CDAC5720B308465F807CB200FF506D5B5532

Function 007032D0 Relevance: 1.5, APIs: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0070331F

Memory Dump Source

Source File: 0000000A.00000002.3636873038.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 0000000A.00000002.3636797458.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3636873038.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639383615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3644544074.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645392207.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645494287.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_700000_RageMP131.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 0fd589d96c9d07b1efa01aec19e4ff46bb0766daf2056f60d33bc81ca57302d3
Instruction ID: b0c8b54aa5119038eca5a3f40fd27af841f501c10120a90a989f32cce8d20edd
Opcode Fuzzy Hash: 0fd589d96c9d07b1efa01aec19e4ff46bb0766daf2056f60d33bc81ca57302d3
Instruction Fuzzy Hash: DBF0B472100104DBDB246F64D45A9E9F3ECDF24362B500A7AF88DC7293EB2EDA518790

Function 0074A65A Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000001,?,00749FE0,00000001,00000364,00000001,00000006,000000FF,?,00734B3F,?,?,76A923A0,?), ref: 0074A69C

Memory Dump Source

Source File: 0000000A.00000002.3636873038.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 0000000A.00000002.3636797458.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3636873038.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639383615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3644544074.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645392207.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645494287.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_700000_RageMP131.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6579fe915f2cd0672075ebb751da3f22c9db951e87fd6714a52fabf83de92e2b
Instruction ID: 857077a5cc11fb44b06c7e91c3bae2072b1520b46ed4af100436ccdbcecbff23
Opcode Fuzzy Hash: 6579fe915f2cd0672075ebb751da3f22c9db951e87fd6714a52fabf83de92e2b
Instruction Fuzzy Hash: 2AF08232691625BFDB216A669C05A6A774DAF427A0F1F8161EC44EA180DF3CDC0086E7

Function 0074B094 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000001,?,?,00734B3F,?,?,76A923A0,?,?,00703522,?,?), ref: 0074B0C6

Memory Dump Source

Source File: 0000000A.00000002.3636873038.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 0000000A.00000002.3636797458.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3636873038.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639383615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3644544074.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645392207.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645494287.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_700000_RageMP131.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 760ba64607baea4f73bdc427d5fa22c20294988743279f6215ede2484df37c29
Instruction ID: df97458739eeb35bd67a80caea119111ab79e39fd86ac76232dc69a28884a293
Opcode Fuzzy Hash: 760ba64607baea4f73bdc427d5fa22c20294988743279f6215ede2484df37c29
Instruction Fuzzy Hash: 75E09B312456245AEF3136A59C15B6B764D9F413A2F994210EC75A61F1DF6CCC1082B6

Function 04FB0216 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3655789594.0000000004FB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4fb0000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ecbb3fd82d6ebd8b18780d7b0799b32e4a6418d847adeadf4aa5210c0bfb6cf
Instruction ID: 48caa68f09ec9c6e6a67b3e56194400e0eedf69b730a6a849f4ca3a87882c6bc
Opcode Fuzzy Hash: 3ecbb3fd82d6ebd8b18780d7b0799b32e4a6418d847adeadf4aa5210c0bfb6cf
Instruction Fuzzy Hash: 6531E5EB24C214BEB14296926F199F77B3DE6C3730334C536F882D6502E6981B4F61B1

Function 04FB01F6 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3655789594.0000000004FB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4fb0000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 159d38f4d39e07b6b48e7eb59fc72668524bbb3a5af734a8f9c3fafe7b87d73e
Instruction ID: 62c10aea871ad6276150d1d1c5be566c1db85c514d0b1b24f5bc83e28dba0b78
Opcode Fuzzy Hash: 159d38f4d39e07b6b48e7eb59fc72668524bbb3a5af734a8f9c3fafe7b87d73e
Instruction Fuzzy Hash: C831B0EB24C214BEB14291826B189F77B2DE6C37303318536F886D6502FA941A4F61B1

Function 04FB020C Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3655789594.0000000004FB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4fb0000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e485632a01d960f9e8cb6dd287a23744b8e3b95ebfa25a7b3b0724da711c43c
Instruction ID: 743a4f1cbef9dbcca844c02cdf3051b32ee7bd754c020d03067aefca6f7be3bd
Opcode Fuzzy Hash: 6e485632a01d960f9e8cb6dd287a23744b8e3b95ebfa25a7b3b0724da711c43c
Instruction Fuzzy Hash: CE31D1EB24C214BEB14292926F18AF77B3DE6C3730330C536F882D6502F6941A4F61B2

Function 04FB02A6 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3655789594.0000000004FB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4fb0000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cf443bda3be81fff9be7a574b072e228f8bdcd8504a40bf7bc1768abc1e1c27
Instruction ID: a6256493c7db14f72ec15e8cfcc909099373bc9185d45b17683bf91cb7325447
Opcode Fuzzy Hash: 9cf443bda3be81fff9be7a574b072e228f8bdcd8504a40bf7bc1768abc1e1c27
Instruction Fuzzy Hash: 9731E8EB24C2147EB24292922B1CAF76B2DE6C3730730C537F886D5442F6D51E4E6172

Function 04FB0248 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3655789594.0000000004FB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4fb0000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c53e1e8480ae0d4389115e0fb9a068e7f60cd50e0b8142c056caca7bfe67c7d
Instruction ID: 0054c74babc50221f1ced12f763c1bbbfd1d1fd47bb022a9c4d47bced8e4866c
Opcode Fuzzy Hash: 1c53e1e8480ae0d4389115e0fb9a068e7f60cd50e0b8142c056caca7bfe67c7d
Instruction Fuzzy Hash: C921B6FB24C2147EB24192922B1CAF7AB6DE6C7730730C937F842D5442F6D51A4E61B2

Function 04FB02CD Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3655789594.0000000004FB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4fb0000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1db770bea799ea89b802b42b52d3cd9adbea3c5014af9c774793614f2f987ce
Instruction ID: f078d08fe6d9f719d30b36366990d40ce49f944dcdd08fc4fcf034977cf0c52a
Opcode Fuzzy Hash: d1db770bea799ea89b802b42b52d3cd9adbea3c5014af9c774793614f2f987ce
Instruction Fuzzy Hash: 612192EB2482157D750296926B1CEFB6B2DE2C3770331C93BF886D4442F6981E4F6171

Function 04FB0275 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3655789594.0000000004FB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4fb0000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d935f524d7f1936509029f95dd83f94c8910c059aea6513de065d023b8289cf
Instruction ID: cc9ca53620113975823e9d61f26beca65afdc52a6a0d8f44db005856e792b16a
Opcode Fuzzy Hash: 9d935f524d7f1936509029f95dd83f94c8910c059aea6513de065d023b8289cf
Instruction Fuzzy Hash: 4B217FEB2482157EB54191922F18AFB6B3DE1C3730334C53AF882D5542E6951B4F6172

Function 04FB0269 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3655789594.0000000004FB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4fb0000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44ad2f7a2aa0314d2caf90849a4a78f35e33876311e9f6aaa64b43463c5cd733
Instruction ID: 942debde924cd8d27bd934029e2a970eec050c1bfc89f4d6829e69a056ec4777
Opcode Fuzzy Hash: 44ad2f7a2aa0314d2caf90849a4a78f35e33876311e9f6aaa64b43463c5cd733
Instruction Fuzzy Hash: 7E213DEB24C2147EB14291922B18EFB6B2DE6C3730334C936F886D5942F6D91A4E6172

Function 04FB028E Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3655789594.0000000004FB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4fb0000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e71b327c28e684708ef8594f1d14f505f051c70b1cd55511dec0b728f73deba
Instruction ID: ee2bc3b4f2f55760896468da7d353d1c80529fca1f4ddd2cc07b3699409c51a3
Opcode Fuzzy Hash: 7e71b327c28e684708ef8594f1d14f505f051c70b1cd55511dec0b728f73deba
Instruction Fuzzy Hash: 822130EB2482147E714191922F1CEFB6B2DE1C3B70335C936F846D5842F6D55A4E6172

Function 04FB0308 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3655789594.0000000004FB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4fb0000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b3f993597bc8e7f49ce8fc9804162400e3be5f0d06346430ea945bb8f43ba38
Instruction ID: 8a9935c85a12c328306c4c0e2b3946684962a4bebcce3f1e44a338720bd20871
Opcode Fuzzy Hash: 7b3f993597bc8e7f49ce8fc9804162400e3be5f0d06346430ea945bb8f43ba38
Instruction Fuzzy Hash: 950144EB28C2157E7141A1922B6CAF7A76DE2C37303348567F882E5442F5C91A4F6071

Function 04FB031A Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3655789594.0000000004FB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4fb0000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e6767c55e3800f8c967d1ba76002947553c75530d536471b942632fd7f12298
Instruction ID: 93520701fb9b82d80374055376b070d9a1fe85404769854a5909590d4fb015b9
Opcode Fuzzy Hash: 4e6767c55e3800f8c967d1ba76002947553c75530d536471b942632fd7f12298
Instruction Fuzzy Hash: AE0184FB64C3156EB141A1922B6CAFB77ADE6C3730330852AF882D5442E6991A4A6071

Function 04FB03F5 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3655789594.0000000004FB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4fb0000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59a1ff4173da102986e4dac38cf0b1d1a8450892bf4c59ea3336ae94ab36b82c
Instruction ID: e738403a2dcb709c2eed25adae91c3829d3350bfd04b388e2611d0669f85589d
Opcode Fuzzy Hash: 59a1ff4173da102986e4dac38cf0b1d1a8450892bf4c59ea3336ae94ab36b82c
Instruction Fuzzy Hash: 7DF086EB28C214EEA110A6877B186FB7B2DF6C37313318527F493C8842F694564F65B1

Function 04FB0335 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3655789594.0000000004FB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4fb0000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 790e2ccc0080fabc1e4e106194fb13384a792f4479cdf4574cd8f1de5dacef73
Instruction ID: 22583f861b334753e9ccac3eedcdecf079a214a33f1b357e0c69a14504e7e106
Opcode Fuzzy Hash: 790e2ccc0080fabc1e4e106194fb13384a792f4479cdf4574cd8f1de5dacef73
Instruction Fuzzy Hash: 85F0C8FB248318BF7141A1922B6CAFB676DE6C3730331C567F882D5542E6890A4E61B1

Function 04FB035F Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3655789594.0000000004FB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4fb0000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4460ac463df648136bbe02a8fcffa22d7fe401ed19a1cf23bbf6ee30a7a733bf
Instruction ID: 9ed419b2af8eb9146a5e8cf80c995953e56cdd7d0eb41eac6e69d6f8f952da50
Opcode Fuzzy Hash: 4460ac463df648136bbe02a8fcffa22d7fe401ed19a1cf23bbf6ee30a7a733bf
Instruction Fuzzy Hash: 4BF02BAB58C744AFB10053A2261D6FABB6DEBD3334334852AE4C297102D5640516A1B1

Function 04FB0399 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3655789594.0000000004FB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4fb0000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3738fdf1bda99de331c168c962baf6413ea3eb35721a98580183a1b4c7c27095
Instruction ID: ea92a59feed07eced591a3b1464b348f6e8bb780e7c96ade9f3d1724c62f1820
Opcode Fuzzy Hash: 3738fdf1bda99de331c168c962baf6413ea3eb35721a98580183a1b4c7c27095
Instruction Fuzzy Hash: 7BD09EAF288114AD708191D2371C5BAA738E2D37303348563F482D0441E5945A1E7071

Non-executed Functions

Function 0073C960 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3636873038.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 0000000A.00000002.3636797458.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3636873038.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639383615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3644544074.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645392207.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645494287.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_700000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 333d4b6d5425d6f9d03797ee82114c3711da98524c03317fffdb5ec62fb2b380
Instruction ID: a3b7b9fd0d1b82f2c9f6240b838cbf48d578130d2754f3a5d9c04f6e5488bac0
Opcode Fuzzy Hash: 333d4b6d5425d6f9d03797ee82114c3711da98524c03317fffdb5ec62fb2b380
Instruction Fuzzy Hash: 6C023B71E012199BEF15CFA9C9806AEFBB1FF48314F248269E919F7341D735A941CB90

Function 0071A060 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0071A09D
std::_Lockit::_Lockit.LIBCPMT ref: 0071A0BF
std::_Lockit::~_Lockit.LIBCPMT ref: 0071A0E7
__Getctype.LIBCPMT ref: 0071A1C5
std::_Facet_Register.LIBCPMT ref: 0071A1F9
std::_Lockit::~_Lockit.LIBCPMT ref: 0071A223

Strings

Ep, xrefs: 0071A1AE
PDp, xrefs: 0071A19A
PGp, xrefs: 0071A1BF

Memory Dump Source

Source File: 0000000A.00000002.3636873038.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 0000000A.00000002.3636797458.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3636873038.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639383615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3644544074.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645392207.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645494287.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_700000_RageMP131.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID: PDp$PGp$Ep
API String ID: 1102183713-1397274705
Opcode ID: cecce58ad121800b8bc16797ad0b8871fe73ee9bd516f67570fc1d2f691aa78d
Instruction ID: db456769c6ff670067cd7d30ba1b5f659ee4502f9e269b6fb1b4c37fa38b398a
Opcode Fuzzy Hash: cecce58ad121800b8bc16797ad0b8871fe73ee9bd516f67570fc1d2f691aa78d
Instruction Fuzzy Hash: 1D51BBB0D01249EFDB10CF98C9457AEBBF0FB10710F148258D855AB392E778AE85CB92

Function 007372D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00737307
___except_validate_context_record.LIBVCRUNTIME ref: 0073730F
_ValidateLocalCookies.LIBCMT ref: 00737398
__IsNonwritableInCurrentImage.LIBCMT ref: 007373C3
_ValidateLocalCookies.LIBCMT ref: 00737418

Strings

csm, xrefs: 007373AD
`-p, xrefs: 007373DC

Memory Dump Source

Source File: 0000000A.00000002.3636873038.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 0000000A.00000002.3636797458.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3636873038.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639383615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3644544074.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645392207.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645494287.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_700000_RageMP131.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: `-p$csm
API String ID: 1170836740-1528604419
Opcode ID: aa444dcea41644ab0e155018e3ac687948ea9e1877ca9f702021f2d130b610ea
Instruction ID: dcd07bd1f41f0ce05acd2b5c89e422495001d819e37028ee29f906b922224844
Opcode Fuzzy Hash: aa444dcea41644ab0e155018e3ac687948ea9e1877ca9f702021f2d130b610ea
Instruction Fuzzy Hash: B141D170A04249DBDF24DF68C885A9EBBA5FF05324F148055FC14AB353DB39EA15CB91

Function 0071C430 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0071C45A
std::_Lockit::_Lockit.LIBCPMT ref: 0071C47C
std::_Lockit::~_Lockit.LIBCPMT ref: 0071C4A4
std::_Facet_Register.LIBCPMT ref: 0071C59A
std::_Lockit::~_Lockit.LIBCPMT ref: 0071C5C4

Strings

Ep, xrefs: 0071C562
PDp, xrefs: 0071C54E

Memory Dump Source

Source File: 0000000A.00000002.3636873038.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 0000000A.00000002.3636797458.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3636873038.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639383615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3644544074.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645392207.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645494287.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_700000_RageMP131.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: Ep$PDp
API String ID: 459529453-1936355350
Opcode ID: c9a889b7cfaa2132e44a0de6192cb1ddad7c37b2fa00d58de874dffdbb54e4bb
Instruction ID: 901f1b06eeb6dbcc61c283b4a73c4069b4416178bd86934a34ba299860b6f841
Opcode Fuzzy Hash: c9a889b7cfaa2132e44a0de6192cb1ddad7c37b2fa00d58de874dffdbb54e4bb
Instruction Fuzzy Hash: 9551C0B0940299DFDB12DF9CD445BAEBBF0FB00314F244158E846AB382D779AE45CB91

Function 0074BB66 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0074BBEC

Memory Dump Source

Source File: 0000000A.00000002.3636873038.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 0000000A.00000002.3636797458.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3636873038.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639383615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3644544074.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645392207.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645494287.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_700000_RageMP131.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 785c90e8ff89e0f1a3d98e37725974d6f6ea20f06d45e48120c47f1ca5a82ffe
Instruction ID: 8b43c38b1da8c180fc17f08d95a24be19d0740e30fd19ea47d0696e2f565d762
Opcode Fuzzy Hash: 785c90e8ff89e0f1a3d98e37725974d6f6ea20f06d45e48120c47f1ca5a82ffe
Instruction Fuzzy Hash: C8B12672E002A5DFDB158F68CC82BEE7BA5EF59310F1445A5E904AF282D778DD01CBA1

Function 00732729 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00732730
std::_Lockit::_Lockit.LIBCPMT ref: 0073273B
std::_Lockit::~_Lockit.LIBCPMT ref: 007327A9

Part of subcall function 0073288C: std::locale::_Locimp::_Locimp.LIBCPMT ref: 007328A4

std::locale::_Setgloballocale.LIBCPMT ref: 00732756

Strings

`-p, xrefs: 00732778, 0073279C

Memory Dump Source

Source File: 0000000A.00000002.3636873038.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 0000000A.00000002.3636797458.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3636873038.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639383615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3644544074.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645392207.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645494287.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_700000_RageMP131.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_Setgloballocale
String ID: `-p
API String ID: 677527491-3350804961
Opcode ID: 91d894926f0e56141dd8bcf1139b1847ce3ab0d4eeba6e4329a0dab96490db17
Instruction ID: 4d3d98dcde64b0c22fcde46be1fde036348e5cb5a7f9287d0b7228e2a9ce8125
Opcode Fuzzy Hash: 91d894926f0e56141dd8bcf1139b1847ce3ab0d4eeba6e4329a0dab96490db17
Instruction Fuzzy Hash: A701BC75A00211DBEB0AEB24D8495BD7BB1FF84790F544009E81157393CF3CAE02CB81

Function 00707350 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 158COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 0070750C
___std_exception_destroy.LIBVCRUNTIME ref: 00707522

Strings

[json.exception., xrefs: 007073A1
)p, xrefs: 00707502, 0070751C

Memory Dump Source

Source File: 0000000A.00000002.3636873038.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 0000000A.00000002.3636797458.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3636873038.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639383615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3644544074.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645392207.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645494287.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_700000_RageMP131.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: )p$[json.exception.
API String ID: 4194217158-3132663411
Opcode ID: 3d57e618cc71cbfba58d894cfdf6283a02c9c1a7e36220c00abeee73f90acc70
Instruction ID: 4d17704e4d88e7a98c2d35d73eaad80d8fc811fd3228886ba081f2a785ff4a7a
Opcode Fuzzy Hash: 3d57e618cc71cbfba58d894cfdf6283a02c9c1a7e36220c00abeee73f90acc70
Instruction Fuzzy Hash: 2251BCB1D05648DBDB10DFA8C90AB9EBBB4EF11314F144259E850AB3C2E7B85A48C7A1

Function 00704900 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0070499F

Strings

ios_base::eofbit set, xrefs: 00704946
ios_base::badbit set, xrefs: 00704937, 00704962
ios_base::failbit set, xrefs: 00704828, 00704941

Memory Dump Source

Source File: 0000000A.00000002.3636873038.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 0000000A.00000002.3636797458.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3636873038.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639383615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3644544074.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645392207.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645494287.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_700000_RageMP131.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 323602529-1866435925
Opcode ID: df6351e3c59e3902678d7487d41b6f05886859086c11ab2d9090ce2e71a5e5e0
Instruction ID: 77e18022b6fbae2ec19d66e4703558513dff3908359a9cb4e7db221228f0dde9
Opcode Fuzzy Hash: df6351e3c59e3902678d7487d41b6f05886859086c11ab2d9090ce2e71a5e5e0
Instruction Fuzzy Hash: 6B1106B2914A48EBC710DB98DC06BAA73D8E705721F044769BF58D76C2EB3DA9048792

Function 007036E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 178COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00703819
___std_exception_destroy.LIBVCRUNTIME ref: 007038F0

Strings

)p, xrefs: 007037ED, 007038EA

Memory Dump Source

Source File: 0000000A.00000002.3636873038.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 0000000A.00000002.3636797458.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3636873038.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639383615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3644544074.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645392207.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645494287.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_700000_RageMP131.jbxd

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: )p
API String ID: 2970364248-3545198885
Opcode ID: ba8e1a32c45ce6e8c5669b59a01214893058d1cad32ad68e5ea903c368664d8b
Instruction ID: ebec340246e471854b231da571580e7d7d8c92468d8cc6946db5f42d55d9a3df
Opcode Fuzzy Hash: ba8e1a32c45ce6e8c5669b59a01214893058d1cad32ad68e5ea903c368664d8b
Instruction Fuzzy Hash: E4617AB1C01648DFDB10CF98C849B9DFBB5FF18324F148259E824AB282D7B95A44CBA1

Function 007047F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 153COMMONLIBRARYCODE

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0070499F

Strings

ios_base::badbit set, xrefs: 00704937, 00704962
ios_base::failbit set, xrefs: 00704828

Memory Dump Source

Source File: 0000000A.00000002.3636873038.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 0000000A.00000002.3636797458.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3636873038.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639383615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3644544074.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645392207.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645494287.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_700000_RageMP131.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: ios_base::badbit set$ios_base::failbit set
API String ID: 323602529-1240500531
Opcode ID: 5d90170d8e8870d9a8c89d992fd6d2beabd54258609ae0d6938f4579b1b40766
Instruction ID: abae7e67593740b6a7d8b8044a44e1e7758f56fead20c2c6780ee6c194409ebf
Opcode Fuzzy Hash: 5d90170d8e8870d9a8c89d992fd6d2beabd54258609ae0d6938f4579b1b40766
Instruction Fuzzy Hash: F84104B1801248EBDB04DF58C845BAEBBF8FB05710F148359FA54A73C2D779AA04CBA1

Function 00704040 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00704061
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 007040C4

Strings

bad locale name, xrefs: 007040E6

Memory Dump Source

Source File: 0000000A.00000002.3636873038.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 0000000A.00000002.3636797458.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3636873038.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639383615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3644544074.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645392207.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645494287.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_700000_RageMP131.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 67e06a9f303b7905680c5c49926e888001f3dfaee11546a3af7d0f308ec93c66
Instruction ID: 2ad1211e3405dbc273b893a12774b3a8bee0869fa82dce734be6797cb6f20d31
Opcode Fuzzy Hash: 67e06a9f303b7905680c5c49926e888001f3dfaee11546a3af7d0f308ec93c66
Instruction Fuzzy Hash: 9711E670805BC4EED721CF68C50474BBFF4AF15714F14869DD09597782D3B99A04CB91

Function 00716590 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 007165C9
___std_exception_copy.LIBVCRUNTIME ref: 007165FC

Strings

)p, xrefs: 007165BA, 007165ED

Memory Dump Source

Source File: 0000000A.00000002.3636873038.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 0000000A.00000002.3636797458.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3636873038.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639383615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3644544074.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645392207.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645494287.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_700000_RageMP131.jbxd

Similarity

API ID: ___std_exception_copy
String ID: )p
API String ID: 2659868963-3545198885
Opcode ID: 630a6c79c938eb8d928773ed8b0c97b11c94cb266c961e10319d24db61b2f4fd
Instruction ID: 0e5bd00e04a788024648b20155c92e4d422f3bdd4b9ce78739d3ab3ada1d36d9
Opcode Fuzzy Hash: 630a6c79c938eb8d928773ed8b0c97b11c94cb266c961e10319d24db61b2f4fd
Instruction Fuzzy Hash: EA111CB1910749EBCB11CF99C980A86F7B9FB09720F10876AE924D7741E774A5448BA0

Function 00707A20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00707A5C
___std_exception_destroy.LIBVCRUNTIME ref: 00707A72

Strings

)p, xrefs: 00707A52, 00707A6C

Memory Dump Source

Source File: 0000000A.00000002.3636873038.0000000000701000.00000040.00000001.01000000.00000006.sdmp, Offset: 00700000, based on PE: true

Associated: 0000000A.00000002.3636797458.0000000000700000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3636873038.0000000000885000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639383615.000000000088A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.000000000088D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000A0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000AEF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3639511163.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3644544074.0000000000B43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645392207.0000000000CD9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3645494287.0000000000CDB000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_700000_RageMP131.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: )p
API String ID: 4194217158-3545198885
Opcode ID: a959c2b73be5e78f721e260a98346c237df604ce76cf52bc12c8fcf291edd5d1
Instruction ID: 0596226daafd55dc6a774d47b60a711b51628e5f66f5493c6213f7918bf96e72
Opcode Fuzzy Hash: a959c2b73be5e78f721e260a98346c237df604ce76cf52bc12c8fcf291edd5d1
Instruction Fuzzy Hash: D5F06DB1804748EFD720DF98C90178DFBF8FB05724F50466AE824E3781E3B966088BA1

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Ke5ufWcgxp.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\MPGPH131\MPGPH131.exe

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
Ke5ufWcgxp.exe

Function 00589280 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 383
networkCOMMON

Function 052C0049 Relevance: 1.8, APIs: 1, Instructions: 318
COMMON

Function 00647B00 Relevance: 16.8, APIs: 11, Instructions: 284
networksleepCOMMON

Function 00648590 Relevance: 6.1, APIs: 4, Instructions: 99
networkCOMMON

Function 052C0037 Relevance: 1.8, APIs: 1, Instructions: 349
COMMON

Function 052C0072 Relevance: 1.8, APIs: 1, Instructions: 316
COMMON

Function 052C00B4 Relevance: 1.8, APIs: 1, Instructions: 306
COMMON

Function 052C0144 Relevance: 1.8, APIs: 1, Instructions: 287
COMMON

Function 052C00EA Relevance: 1.8, APIs: 1, Instructions: 285
COMMON

Function 052C0128 Relevance: 1.8, APIs: 1, Instructions: 270
COMMON

Function 052C0194 Relevance: 1.8, APIs: 1, Instructions: 259
COMMON

Function 052C0176 Relevance: 1.8, APIs: 1, Instructions: 254
COMMON

Function 052C015D Relevance: 1.8, APIs: 1, Instructions: 253
COMMON

Function 052C0164 Relevance: 1.8, APIs: 1, Instructions: 252
COMMON

Function 052C01AA Relevance: 1.7, APIs: 1, Instructions: 247
COMMON