Edit tour

Windows Analysis Report
LisectAVT_2403002A_224.exe

Overview

General Information

Sample name:	LisectAVT_2403002A_224.exe
Analysis ID:	1481004
MD5:	cc4a3a36d266e313523feb9146c56df6
SHA1:	094ef8de8465d13ea82a0f9daf13474f4f11bc17
SHA256:	721a20928239475312d70ee30d402768348d81e72f67363a92e34ed087a545e7
Tags:	exe
Infos:

Detection

RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected RisePro Stealer

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Potentially malicious time measurement code found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Uses schtasks.exe or at.exe to add and modify task schedules

Abnormal high CPU Usage

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to read the PEB

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

LisectAVT_2403002A_224.exe (PID: 6816 cmdline: "C:\Users\user\Desktop\LisectAVT_2403002A_224.exe" MD5: CC4A3A36D266E313523FEB9146C56DF6)

schtasks.exe (PID: 6892 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 6240 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MPGPH131.exe (PID: 7188 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: CC4A3A36D266E313523FEB9146C56DF6)

MPGPH131.exe (PID: 7196 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: CC4A3A36D266E313523FEB9146C56DF6)

RageMP131.exe (PID: 7512 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: CC4A3A36D266E313523FEB9146C56DF6)

RageMP131.exe (PID: 7820 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: CC4A3A36D266E313523FEB9146C56DF6)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000009.00000003.1904982936.00000000048F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000003.1673549400.0000000004A30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000005.00000003.1734673045.0000000005330000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000007.00000003.1822511495.0000000004960000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000006.00000003.1735290637.0000000005330000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: LisectAVT_2403002A_224.exe PID: 6816	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 7188	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 7196	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 7512	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 7820	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe, ProcessId: 6816, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T02:46:49.373342+0200
SID:	2046269
Source Port:	49731
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE RisePro TCP Heartbeat Packet - Source IP: 192.168.2.4 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T02:46:46.402445+0200
SID:	2049060
Source Port:	49731
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T02:46:49.373471+0200
SID:	2046269
Source Port:	49732
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE RisePro TCP Heartbeat Packet - Source IP: 192.168.2.4 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T02:46:39.895152+0200
SID:	2049060
Source Port:	49730
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T02:47:04.634108+0200
SID:	2046269
Source Port:	49740
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T02:46:57.571611+0200
SID:	2046269
Source Port:	49734
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.114.59.183 - Destination IP: 192.168.2.4

Timestamp:	2024-07-25T02:46:56.137355+0200
SID:	2022930
Source Port:	443
Destination Port:	49733
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.114.59.183 - Destination IP: 192.168.2.4

Timestamp:	2024-07-25T02:47:34.333582+0200
SID:	2022930
Source Port:	443
Destination Port:	49741
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T02:46:42.884945+0200
SID:	2046269
Source Port:	49730
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: LisectAVT_2403002A_224.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Avira: detection malicious, Label: TR/Scar.vkkgx
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Avira: detection malicious, Label: TR/Scar.vkkgx

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	ReversingLabs: Detection: 66%
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Virustotal: Detection: 63%	Perma Link
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	ReversingLabs: Detection: 66%
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Virustotal: Detection: 63%	Perma Link

Multi AV Scanner detection for submitted file

Source: LisectAVT_2403002A_224.exe	ReversingLabs: Detection: 66%
Source: LisectAVT_2403002A_224.exe	Virustotal: Detection: 63%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: LisectAVT_2403002A_224.exe

Joe Sandbox ML: detected

Source: LisectAVT_2403002A_224.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 193.233.132.74 ports 0,5,7,8,58709,9

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 193.233.132.74:58709

Source: Joe Sandbox View

IP Address: 193.233.132.74 193.233.132.74

Source: Joe Sandbox View

ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU

Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74

Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe

Code function: 0_2_0018E0A0 recv,setsockopt,WSAStartup,closesocket,socket,connect,closesocket,

0_2_0018E0A0

Source: LisectAVT_2403002A_224.exe, 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, LisectAVT_2403002A_224.exe, 00000000.00000003.1673549400.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000005.00000003.1734673045.0000000005330000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000006.00000003.1735290637.0000000005330000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000007.00000003.1822511495.0000000004960000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000003.1904982936.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: LisectAVT_2403002A_224.exe, 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, LisectAVT_2403002A_224.exe, 00000000.00000003.1673549400.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000005.00000003.1734673045.0000000005330000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000006.00000003.1735290637.0000000005330000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000007.00000003.1822511495.0000000004960000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000003.1904982936.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: LisectAVT_2403002A_224.exe, 00000000.00000002.4115340739.0000000000E5E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.4115259179.000000000148D000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.4115189261.000000000166A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.4115609037.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000002.4115337931.0000000000CBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: LisectAVT_2403002A_224.exe, 00000000.00000002.4115340739.0000000000E5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTX
Source: RageMP131.exe, 00000009.00000002.4115337931.0000000000CBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTbYE

System Summary

PE file contains section with special chars

Source: LisectAVT_2403002A_224.exe	Static PE information: section name:
Source: LisectAVT_2403002A_224.exe	Static PE information: section name: .idata
Source: LisectAVT_2403002A_224.exe	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name: .idata
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name: .idata
Source: MPGPH131.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_00269824	0_2_00269824
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_001F9880	0_2_001F9880
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_001E50B0	0_2_001E50B0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_001791A0	0_2_001791A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_001E73F0	0_2_001E73F0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_0025646A	0_2_0025646A
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_002584A0	0_2_002584A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_00252CE0	0_2_00252CE0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_001724F0	0_2_001724F0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_001F6550	0_2_001F6550
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_00178D70	0_2_00178D70
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_001F55B0	0_2_001F55B0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_0025BEAF	0_2_0025BEAF
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_00189F50	0_2_00189F50
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_0026F771	0_2_0026F771
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00AE50B0	5_2_00AE50B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00AF9880	5_2_00AF9880
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00B69824	5_2_00B69824
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00A791A0	5_2_00A791A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00AE73F0	5_2_00AE73F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00B584A0	5_2_00B584A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00B52CE0	5_2_00B52CE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00A724F0	5_2_00A724F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00B5646A	5_2_00B5646A
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00AF55B0	5_2_00AF55B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00A78D70	5_2_00A78D70
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00AF6550	5_2_00AF6550
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00B5BEAF	5_2_00B5BEAF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00B6F771	5_2_00B6F771
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00A89F50	5_2_00A89F50
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00AE50B0	6_2_00AE50B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00AF9880	6_2_00AF9880
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00B69824	6_2_00B69824
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00A791A0	6_2_00A791A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00AE73F0	6_2_00AE73F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00B584A0	6_2_00B584A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00B52CE0	6_2_00B52CE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00A724F0	6_2_00A724F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00B5646A	6_2_00B5646A
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00AF55B0	6_2_00AF55B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00A78D70	6_2_00A78D70
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00AF6550	6_2_00AF6550
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00B5BEAF	6_2_00B5BEAF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00B6F771	6_2_00B6F771
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00A89F50	6_2_00A89F50
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00319824	7_2_00319824
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_002950B0	7_2_002950B0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_002A9880	7_2_002A9880
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_002291A0	7_2_002291A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_002973F0	7_2_002973F0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_0030646A	7_2_0030646A
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_003084A0	7_2_003084A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00302CE0	7_2_00302CE0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_002224F0	7_2_002224F0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00228D70	7_2_00228D70
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_002A6550	7_2_002A6550
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_002A55B0	7_2_002A55B0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_0030BEAF	7_2_0030BEAF
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_0031F771	7_2_0031F771
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00239F50	7_2_00239F50
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 9_2_00319824	9_2_00319824
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 9_2_002950B0	9_2_002950B0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 9_2_002A9880	9_2_002A9880
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 9_2_002291A0	9_2_002291A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 9_2_002973F0	9_2_002973F0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 9_2_0030646A	9_2_0030646A
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 9_2_003084A0	9_2_003084A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 9_2_00302CE0	9_2_00302CE0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 9_2_002224F0	9_2_002224F0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 9_2_00228D70	9_2_00228D70
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 9_2_002A6550	9_2_002A6550
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 9_2_002A55B0	9_2_002A55B0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 9_2_0030BEAF	9_2_0030BEAF
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 9_2_0031F771	9_2_0031F771
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 9_2_00239F50	9_2_00239F50

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: String function: 002FFED0 appears 52 times
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 00B4FED0 appears 52 times

Source: LisectAVT_2403002A_224.exe, 00000000.00000002.4118399424.0000000004A30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefilezilla.exe4 vs LisectAVT_2403002A_224.exe
Source: LisectAVT_2403002A_224.exe, 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamefilezilla.exe4 vs LisectAVT_2403002A_224.exe
Source: LisectAVT_2403002A_224.exe	Binary or memory string: OriginalFilenamefilezilla.exe4 vs LisectAVT_2403002A_224.exe

Source: LisectAVT_2403002A_224.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: LisectAVT_2403002A_224.exe	Static PE information: Section: ZLIB complexity 0.9991950757575757
Source: LisectAVT_2403002A_224.exe	Static PE information: Section: eyjsffgc ZLIB complexity 0.9903292147954679
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9991950757575757
Source: RageMP131.exe.0.dr	Static PE information: Section: eyjsffgc ZLIB complexity 0.9903292147954679
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9991950757575757
Source: MPGPH131.exe.0.dr	Static PE information: Section: eyjsffgc ZLIB complexity 0.9903292147954679

Source: classification engine

Classification label: mal100.troj.evad.winEXE@11/5@0/1

Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe

File created: C:\Users\user\AppData\Local\RageMP131

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7100:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5448:120:WilError_03

Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe

File created: C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Command line argument: nI'	0_2_002748C0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Command line argument: nI2	7_2_003248C0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Command line argument: nI2	9_2_003248C0

Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: LisectAVT_2403002A_224.exe, 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, LisectAVT_2403002A_224.exe, 00000000.00000003.1673549400.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000005.00000003.1734673045.0000000005330000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000006.00000003.1735290637.0000000005330000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000007.00000003.1822511495.0000000004960000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000003.1904982936.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: LisectAVT_2403002A_224.exe, 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, LisectAVT_2403002A_224.exe, 00000000.00000003.1673549400.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000005.00000003.1734673045.0000000005330000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000006.00000003.1735290637.0000000005330000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000007.00000003.1822511495.0000000004960000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000003.1904982936.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

Source: LisectAVT_2403002A_224.exe	ReversingLabs: Detection: 66%
Source: LisectAVT_2403002A_224.exe	Virustotal: Detection: 63%

Source: LisectAVT_2403002A_224.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: MPGPH131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: MPGPH131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: RageMP131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: RageMP131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe

File read: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe "C:\Users\user\Desktop\LisectAVT_2403002A_224.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll	Jump to behavior

Source: LisectAVT_2403002A_224.exe

Static file information: File size 2340360 > 1048576

Source: LisectAVT_2403002A_224.exe

Static PE information: Raw size of eyjsffgc is bigger than: 0x100000 < 0x1a8c00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Unpacked PE file: 0.2.LisectAVT_2403002A_224.exe.170000.0.unpack :EW;.rsrc:W;.idata :W; :EW;eyjsffgc:EW;qbcnvswu:EW; vs :ER;.rsrc:W;.idata :W; :EW;eyjsffgc:EW;qbcnvswu:EW;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 5.2.MPGPH131.exe.a70000.0.unpack :EW;.rsrc:W;.idata :W; :EW;eyjsffgc:EW;qbcnvswu:EW; vs :ER;.rsrc:W;.idata :W; :EW;eyjsffgc:EW;qbcnvswu:EW;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 6.2.MPGPH131.exe.a70000.0.unpack :EW;.rsrc:W;.idata :W; :EW;eyjsffgc:EW;qbcnvswu:EW; vs :ER;.rsrc:W;.idata :W; :EW;eyjsffgc:EW;qbcnvswu:EW;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 7.2.RageMP131.exe.220000.0.unpack :EW;.rsrc:W;.idata :W; :EW;eyjsffgc:EW;qbcnvswu:EW; vs :ER;.rsrc:W;.idata :W; :EW;eyjsffgc:EW;qbcnvswu:EW;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 9.2.RageMP131.exe.220000.0.unpack :EW;.rsrc:W;.idata :W; :EW;eyjsffgc:EW;qbcnvswu:EW; vs :ER;.rsrc:W;.idata :W; :EW;eyjsffgc:EW;qbcnvswu:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: qbcnvswu

Source: LisectAVT_2403002A_224.exe	Static PE information: real checksum: 0x24a8d6 should be: 0x24a8de
Source: RageMP131.exe.0.dr	Static PE information: real checksum: 0x24a8d6 should be: 0x24a8de
Source: MPGPH131.exe.0.dr	Static PE information: real checksum: 0x24a8d6 should be: 0x24a8de

Source: LisectAVT_2403002A_224.exe	Static PE information: section name:
Source: LisectAVT_2403002A_224.exe	Static PE information: section name: .idata
Source: LisectAVT_2403002A_224.exe	Static PE information: section name:
Source: LisectAVT_2403002A_224.exe	Static PE information: section name: eyjsffgc
Source: LisectAVT_2403002A_224.exe	Static PE information: section name: qbcnvswu
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name: .idata
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name: eyjsffgc
Source: RageMP131.exe.0.dr	Static PE information: section name: qbcnvswu
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name: .idata
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name: eyjsffgc
Source: MPGPH131.exe.0.dr	Static PE information: section name: qbcnvswu

Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_0071B03C push 3651A27Bh; mov dword ptr [esp], esi	0_2_0071B058
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_0071B03C push ebp; mov dword ptr [esp], edx	0_2_0071B0B3
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_0071B03C push eax; mov dword ptr [esp], 75F68864h	0_2_0071B0E0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_0071B03C push esi; mov dword ptr [esp], 5EEF8401h	0_2_0071B100
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_0071B03C push eax; mov dword ptr [esp], 23930DA3h	0_2_0071B137
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_0071B000 push ecx; mov dword ptr [esp], 0A515175h	0_2_0071B01A
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_0071B000 push 3651A27Bh; mov dword ptr [esp], esi	0_2_0071B058
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_0071B000 push ebp; mov dword ptr [esp], edx	0_2_0071B0B3
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_0071B000 push eax; mov dword ptr [esp], 75F68864h	0_2_0071B0E0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_0071B000 push esi; mov dword ptr [esp], 5EEF8401h	0_2_0071B100
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_0071B000 push eax; mov dword ptr [esp], 23930DA3h	0_2_0071B137
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_0071B184 push 11979A72h; mov dword ptr [esp], ecx	0_2_0071B199
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_0071B184 push ebx; mov dword ptr [esp], 4C77469Ch	0_2_0071B1BE
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_0071B184 push 5E21318Bh; mov dword ptr [esp], eax	0_2_0071B20C
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_0071B184 push 520D17D8h; mov dword ptr [esp], edi	0_2_0071B29B
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_0024FA97 push ecx; ret	0_2_0024FAAA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0101B184 push 11979A72h; mov dword ptr [esp], ecx	5_2_0101B199
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0101B184 push ebx; mov dword ptr [esp], 4C77469Ch	5_2_0101B1BE
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0101B184 push 5E21318Bh; mov dword ptr [esp], eax	5_2_0101B20C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0101B184 push 520D17D8h; mov dword ptr [esp], edi	5_2_0101B29B
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0101B000 push ecx; mov dword ptr [esp], 0A515175h	5_2_0101B01A
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0101B000 push 3651A27Bh; mov dword ptr [esp], esi	5_2_0101B058
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0101B000 push ebp; mov dword ptr [esp], edx	5_2_0101B0B3
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0101B000 push eax; mov dword ptr [esp], 75F68864h	5_2_0101B0E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0101B000 push esi; mov dword ptr [esp], 5EEF8401h	5_2_0101B100
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0101B000 push eax; mov dword ptr [esp], 23930DA3h	5_2_0101B137
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0101B03C push 3651A27Bh; mov dword ptr [esp], esi	5_2_0101B058
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0101B03C push ebp; mov dword ptr [esp], edx	5_2_0101B0B3
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0101B03C push eax; mov dword ptr [esp], 75F68864h	5_2_0101B0E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0101B03C push esi; mov dword ptr [esp], 5EEF8401h	5_2_0101B100
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0101B03C push eax; mov dword ptr [esp], 23930DA3h	5_2_0101B137

Source: LisectAVT_2403002A_224.exe	Static PE information: section name: entropy: 7.988529889235953
Source: LisectAVT_2403002A_224.exe	Static PE information: section name: eyjsffgc entropy: 7.951534972159276
Source: RageMP131.exe.0.dr	Static PE information: section name: entropy: 7.988529889235953
Source: RageMP131.exe.0.dr	Static PE information: section name: eyjsffgc entropy: 7.951534972159276
Source: MPGPH131.exe.0.dr	Static PE information: section name: entropy: 7.988529889235953
Source: MPGPH131.exe.0.dr	Static PE information: section name: eyjsffgc entropy: 7.951534972159276

Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe			Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe			Jump to dropped file

Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe

File created: C:\ProgramData\MPGPH131\MPGPH131.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: Regmonclass	Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep	graph_0-21353
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep	graph_5-18546
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep	graph_7-19002

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 2B04AC second address: 2AFD47 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F59E0FE79C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b nop 0x0000000c jne 00007F59E0FE79CEh 0x00000012 push dword ptr [ebp+122D0751h] 0x00000018 add dword ptr [ebp+122D1997h], edi 0x0000001e call dword ptr [ebp+122D1879h] 0x00000024 pushad 0x00000025 pushad 0x00000026 mov eax, dword ptr [ebp+122D3A16h] 0x0000002c mov dword ptr [ebp+122D1ADCh], ebx 0x00000032 popad 0x00000033 xor eax, eax 0x00000035 jnl 00007F59E0FE79D0h 0x0000003b mov edx, dword ptr [esp+28h] 0x0000003f sub dword ptr [ebp+122D1DE3h], ebx 0x00000045 jc 00007F59E0FE79D2h 0x0000004b jmp 00007F59E0FE79CCh 0x00000050 mov dword ptr [ebp+122D3A32h], eax 0x00000056 sub dword ptr [ebp+122D19C2h], ecx 0x0000005c mov esi, 0000003Ch 0x00000061 sub dword ptr [ebp+122D18D5h], eax 0x00000067 add esi, dword ptr [esp+24h] 0x0000006b sub dword ptr [ebp+122D18D5h], ebx 0x00000071 lodsw 0x00000073 pushad 0x00000074 mov ebx, dword ptr [ebp+122D397Ah] 0x0000007a mov edx, dword ptr [ebp+122D39B2h] 0x00000080 popad 0x00000081 add eax, dword ptr [esp+24h] 0x00000085 mov dword ptr [ebp+122D198Bh], edi 0x0000008b mov dword ptr [ebp+122D1B2Ch], edi 0x00000091 mov ebx, dword ptr [esp+24h] 0x00000095 cmc 0x00000096 nop 0x00000097 push ecx 0x00000098 push eax 0x00000099 push edx 0x0000009a push eax 0x0000009b push edx 0x0000009c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 2AFD47 second address: 2AFD4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 42D2E6 second address: 42D318 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F59E0FE79D4h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F59E0FE79D6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4372BC second address: 4372C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4372C2 second address: 4372D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F59E0FE79CDh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 437441 second address: 437446 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 43798A second address: 4379AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F59E0FE79D8h 0x0000000b popad 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 43A812 second address: 2AFD47 instructions: 0x00000000 rdtsc 0x00000002 js 00007F59E0FDFAB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e popad 0x0000000f xor dword ptr [esp], 09E90BBAh 0x00000016 mov dword ptr [ebp+122D188Dh], edx 0x0000001c push dword ptr [ebp+122D0751h] 0x00000022 mov ecx, dword ptr [ebp+122D3C0Ah] 0x00000028 call dword ptr [ebp+122D1879h] 0x0000002e pushad 0x0000002f pushad 0x00000030 mov eax, dword ptr [ebp+122D3A16h] 0x00000036 mov dword ptr [ebp+122D1ADCh], ebx 0x0000003c popad 0x0000003d xor eax, eax 0x0000003f jnl 00007F59E0FDFAC0h 0x00000045 mov edx, dword ptr [esp+28h] 0x00000049 sub dword ptr [ebp+122D1DE3h], ebx 0x0000004f jc 00007F59E0FDFAC2h 0x00000055 mov dword ptr [ebp+122D3A32h], eax 0x0000005b sub dword ptr [ebp+122D19C2h], ecx 0x00000061 mov esi, 0000003Ch 0x00000066 sub dword ptr [ebp+122D18D5h], eax 0x0000006c add esi, dword ptr [esp+24h] 0x00000070 sub dword ptr [ebp+122D18D5h], ebx 0x00000076 lodsw 0x00000078 pushad 0x00000079 mov ebx, dword ptr [ebp+122D397Ah] 0x0000007f mov edx, dword ptr [ebp+122D39B2h] 0x00000085 popad 0x00000086 add eax, dword ptr [esp+24h] 0x0000008a mov dword ptr [ebp+122D198Bh], edi 0x00000090 mov dword ptr [ebp+122D1B2Ch], edi 0x00000096 mov ebx, dword ptr [esp+24h] 0x0000009a cmc 0x0000009b nop 0x0000009c push ecx 0x0000009d push eax 0x0000009e push edx 0x0000009f push eax 0x000000a0 push edx 0x000000a1 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 43A8C0 second address: 43A8CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F59E0FE79C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 43A8CB second address: 43A8E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b jmp 00007F59E0FDFABBh 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 43A8E2 second address: 43A9B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FE79CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007F59E0FE79D0h 0x00000012 mov eax, dword ptr [eax] 0x00000014 jl 00007F59E0FE79CAh 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e jmp 00007F59E0FE79D0h 0x00000023 pop eax 0x00000024 push 00000000h 0x00000026 push ecx 0x00000027 call 00007F59E0FE79C8h 0x0000002c pop ecx 0x0000002d mov dword ptr [esp+04h], ecx 0x00000031 add dword ptr [esp+04h], 00000018h 0x00000039 inc ecx 0x0000003a push ecx 0x0000003b ret 0x0000003c pop ecx 0x0000003d ret 0x0000003e call 00007F59E0FE79D0h 0x00000043 pop edi 0x00000044 jc 00007F59E0FE79DBh 0x0000004a jl 00007F59E0FE79D5h 0x00000050 jmp 00007F59E0FE79CFh 0x00000055 push 00000003h 0x00000057 xor esi, dword ptr [ebp+122D3C4Eh] 0x0000005d push 00000000h 0x0000005f push edi 0x00000060 sub dword ptr [ebp+122D1BAAh], esi 0x00000066 pop ecx 0x00000067 push 00000003h 0x00000069 add dword ptr [ebp+122D1B2Ch], edx 0x0000006f call 00007F59E0FE79C9h 0x00000074 push eax 0x00000075 push edx 0x00000076 push eax 0x00000077 push edx 0x00000078 jmp 00007F59E0FE79D8h 0x0000007d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 43A9B0 second address: 43A9B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 43A9B6 second address: 43AA34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F59E0FE79C6h 0x00000009 jmp 00007F59E0FE79D5h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 jmp 00007F59E0FE79D2h 0x00000017 mov eax, dword ptr [esp+04h] 0x0000001b push ecx 0x0000001c jmp 00007F59E0FE79D8h 0x00000021 pop ecx 0x00000022 mov eax, dword ptr [eax] 0x00000024 jnp 00007F59E0FE79D8h 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e push eax 0x0000002f push edx 0x00000030 jng 00007F59E0FE79CCh 0x00000036 jbe 00007F59E0FE79C6h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 43AA34 second address: 43AA87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FDFAC3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a xor dword ptr [ebp+122D1820h], ebx 0x00000010 lea ebx, dword ptr [ebp+1245E73Ch] 0x00000016 call 00007F59E0FDFAC7h 0x0000001b mov edi, dword ptr [ebp+122D3C5Eh] 0x00000021 pop edi 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 jmp 00007F59E0FDFABAh 0x0000002b push edi 0x0000002c pop edi 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 43AB39 second address: 43AB5E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 jp 00007F59E0FE79D4h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 43AB5E second address: 43AB8F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F59E0FDFAB8h 0x0000000c popad 0x0000000d mov eax, dword ptr [eax] 0x0000000f jmp 00007F59E0FDFABBh 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F59E0FDFABFh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 43ACB5 second address: 43ACBF instructions: 0x00000000 rdtsc 0x00000002 jp 00007F59E0FE79C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 43ACBF second address: 43AD8D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FDFAC4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov esi, ebx 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007F59E0FDFAB8h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a sub dword ptr [ebp+122D20C7h], edi 0x00000030 jnp 00007F59E0FDFABCh 0x00000036 push 6658276Fh 0x0000003b jnc 00007F59E0FDFAC1h 0x00000041 jmp 00007F59E0FDFABBh 0x00000046 xor dword ptr [esp], 665827EFh 0x0000004d mov edi, dword ptr [ebp+122D3C7Ah] 0x00000053 push 00000003h 0x00000055 mov edi, dword ptr [ebp+122D2C9Ah] 0x0000005b push 00000000h 0x0000005d add dword ptr [ebp+122D1C4Dh], esi 0x00000063 push 00000003h 0x00000065 push 00000000h 0x00000067 push eax 0x00000068 call 00007F59E0FDFAB8h 0x0000006d pop eax 0x0000006e mov dword ptr [esp+04h], eax 0x00000072 add dword ptr [esp+04h], 0000001Ch 0x0000007a inc eax 0x0000007b push eax 0x0000007c ret 0x0000007d pop eax 0x0000007e ret 0x0000007f sbb edx, 6C2D5A01h 0x00000085 push FD4A3680h 0x0000008a push eax 0x0000008b push edx 0x0000008c jmp 00007F59E0FDFAC3h 0x00000091 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 45AB1C second address: 45AB30 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F59E0FE79C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F59E0FE79CAh 0x00000010 pushad 0x00000011 popad 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 424D6C second address: 424DB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jmp 00007F59E0FDFABFh 0x00000011 popad 0x00000012 jmp 00007F59E0FDFAC8h 0x00000017 jmp 00007F59E0FDFABEh 0x0000001c popad 0x0000001d push ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 push esi 0x00000021 pop esi 0x00000022 push esi 0x00000023 pop esi 0x00000024 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 458A30 second address: 458A50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FE79CFh 0x00000007 jp 00007F59E0FE79C8h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 458A50 second address: 458A61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jbe 00007F59E0FDFABCh 0x0000000b jl 00007F59E0FDFAB6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 458A61 second address: 458A66 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4590FD second address: 45911B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F59E0FDFAC5h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4596D5 second address: 4596DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 459B01 second address: 459B16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F59E0FDFAB6h 0x0000000a jmp 00007F59E0FDFABBh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 459B16 second address: 459B1F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 429DA6 second address: 429DAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 429DAC second address: 429DC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 je 00007F59E0FE79D6h 0x0000000c push edi 0x0000000d jp 00007F59E0FE79C6h 0x00000013 pop edi 0x00000014 push ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 459C58 second address: 459C5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 459C5C second address: 459C6E instructions: 0x00000000 rdtsc 0x00000002 jne 00007F59E0FE79C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 459C6E second address: 459C72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 45A3A3 second address: 45A3A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 45A3A7 second address: 45A3C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F59E0FDFAB6h 0x0000000a jmp 00007F59E0FDFAC3h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 45A3C4 second address: 45A3CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 45A3CA second address: 45A3E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F59E0FDFAC3h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 45F36A second address: 45F38F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F59E0FE79E1h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 461593 second address: 461599 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 461599 second address: 46159E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 462464 second address: 462472 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FDFABAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 462472 second address: 462478 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 462478 second address: 462486 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 462486 second address: 46248A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 46248A second address: 4624C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FDFABDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F59E0FDFABCh 0x0000000f popad 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F59E0FDFAC7h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4624C5 second address: 4624CA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4624CA second address: 4624D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4624D7 second address: 4624F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F59E0FE79D0h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4624F0 second address: 4624F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4624F4 second address: 4624F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 46264A second address: 462661 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jc 00007F59E0FDFAC4h 0x0000000f push eax 0x00000010 push edx 0x00000011 jp 00007F59E0FDFAB6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 465C05 second address: 465C09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 465C09 second address: 465C16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pushad 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 465D55 second address: 465D59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 465D59 second address: 465D65 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F59E0FDFAB6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 465F06 second address: 465F16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F59E0FE79C6h 0x0000000a js 00007F59E0FE79C6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 46638D second address: 466391 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 467DBE second address: 467DC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 467DC3 second address: 467DC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 467DC9 second address: 467DCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 467DCD second address: 467DFD instructions: 0x00000000 rdtsc 0x00000002 jno 00007F59E0FDFAB6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f je 00007F59E0FDFAB6h 0x00000015 push edx 0x00000016 pop edx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jl 00007F59E0FDFABAh 0x00000022 push ebx 0x00000023 pop ebx 0x00000024 pushad 0x00000025 popad 0x00000026 push edx 0x00000027 jnc 00007F59E0FDFAB6h 0x0000002d push ecx 0x0000002e pop ecx 0x0000002f pop edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 467DFD second address: 467E05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 467E05 second address: 467E09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 467E09 second address: 467E1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F59E0FE79C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F59E0FE79C6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 46A4A7 second address: 46A4AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 46A4AB second address: 46A4B1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 46A4B1 second address: 46A51D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FDFABEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 2A941C6Eh 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007F59E0FDFAB8h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 0000001Dh 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a movzx edi, ax 0x0000002d jmp 00007F59E0FDFABFh 0x00000032 jmp 00007F59E0FDFAC1h 0x00000037 push 53997933h 0x0000003c push eax 0x0000003d push edx 0x0000003e push ecx 0x0000003f pushad 0x00000040 popad 0x00000041 pop ecx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 46A51D second address: 46A522 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 46A5C6 second address: 46A5CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 46A5CB second address: 46A5D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 46B1DE second address: 46B1E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 46BC38 second address: 46BC4B instructions: 0x00000000 rdtsc 0x00000002 jg 00007F59E0FE79C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push edi 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 46BC4B second address: 46BC50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 46BC50 second address: 46BC56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 46BC56 second address: 46BC5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 46C3F3 second address: 46C3F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 46F5F2 second address: 46F602 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F59E0FDFABBh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 470A9E second address: 470AA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 46FE35 second address: 46FE39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 470844 second address: 470857 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edi 0x00000008 push eax 0x00000009 push esi 0x0000000a pushad 0x0000000b jg 00007F59E0FE79C6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 471384 second address: 471395 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F59E0FDFABDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 472A6B second address: 472A6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4760E7 second address: 47611F instructions: 0x00000000 rdtsc 0x00000002 js 00007F59E0FDFAB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F59E0FDFAC9h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F59E0FDFAC0h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4776E9 second address: 4776F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F59E0FE79C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4776F4 second address: 47775A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push edi 0x00000009 jmp 00007F59E0FDFAC9h 0x0000000e pop edi 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007F59E0FDFAB8h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 0000001Ah 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d or ebx, dword ptr [ebp+122D3039h] 0x00000033 xor di, 6636h 0x00000038 push eax 0x00000039 pushad 0x0000003a jng 00007F59E0FDFAB8h 0x00000040 push edx 0x00000041 pop edx 0x00000042 jng 00007F59E0FDFABCh 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 478962 second address: 478968 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 479911 second address: 479930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F59E0FDFAC8h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 479930 second address: 47994C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b jmp 00007F59E0FE79D0h 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 47A95F second address: 47A964 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 47B729 second address: 47B73C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F59E0FE79CEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 47A964 second address: 47A97E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F59E0FDFAC6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 47C64D second address: 47C658 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edi 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 47C6E8 second address: 47C6EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 47C6EC second address: 47C6F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 47C6F0 second address: 47C711 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F59E0FDFAC9h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 47D5E0 second address: 47D5E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 47C8DB second address: 47C8F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FDFAC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 47D5E4 second address: 47D606 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FE79CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F59E0FE79D0h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 47C8F8 second address: 47C902 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F59E0FDFAB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 47E587 second address: 47E597 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F59E0FE79CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 47D7AA second address: 47D7AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 47D7AE second address: 47D7B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 47D7B4 second address: 47D7B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 480620 second address: 480626 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 480626 second address: 48062A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4815E4 second address: 4815F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FE79CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4815F5 second address: 48165D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FDFABAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jne 00007F59E0FDFAB7h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007F59E0FDFAB8h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push edx 0x00000031 call 00007F59E0FDFAB8h 0x00000036 pop edx 0x00000037 mov dword ptr [esp+04h], edx 0x0000003b add dword ptr [esp+04h], 00000019h 0x00000043 inc edx 0x00000044 push edx 0x00000045 ret 0x00000046 pop edx 0x00000047 ret 0x00000048 stc 0x00000049 or bl, FFFFFF91h 0x0000004c xchg eax, esi 0x0000004d push eax 0x0000004e push edx 0x0000004f pushad 0x00000050 pushad 0x00000051 popad 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 48165D second address: 481662 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 481662 second address: 481695 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FDFAC6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F59E0FDFABFh 0x00000010 jp 00007F59E0FDFABCh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 47F5CD second address: 47F5E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F59E0FE79D5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 47F5E6 second address: 47F5EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 48337F second address: 483384 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 480776 second address: 48077B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 483384 second address: 4833CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+12461E2Dh], ecx 0x00000010 push 00000000h 0x00000012 mov edi, dword ptr [ebp+122D3912h] 0x00000018 push 00000000h 0x0000001a mov dword ptr [ebp+122D30DBh], edx 0x00000020 xchg eax, esi 0x00000021 pushad 0x00000022 pushad 0x00000023 pushad 0x00000024 popad 0x00000025 jns 00007F59E0FE79C6h 0x0000002b popad 0x0000002c push ecx 0x0000002d push edi 0x0000002e pop edi 0x0000002f pop ecx 0x00000030 popad 0x00000031 push eax 0x00000032 pushad 0x00000033 pushad 0x00000034 push eax 0x00000035 pop eax 0x00000036 ja 00007F59E0FE79C6h 0x0000003c popad 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F59E0FE79CAh 0x00000044 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4817DC second address: 481812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 jmp 00007F59E0FDFAC8h 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 jmp 00007F59E0FDFAC1h 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 48077B second address: 480834 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnc 00007F59E0FE79C6h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jc 00007F59E0FE79C8h 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007F59E0FE79D7h 0x0000001b popad 0x0000001c nop 0x0000001d push 00000000h 0x0000001f push eax 0x00000020 call 00007F59E0FE79C8h 0x00000025 pop eax 0x00000026 mov dword ptr [esp+04h], eax 0x0000002a add dword ptr [esp+04h], 0000001Dh 0x00000032 inc eax 0x00000033 push eax 0x00000034 ret 0x00000035 pop eax 0x00000036 ret 0x00000037 jmp 00007F59E0FE79D8h 0x0000003c push dword ptr fs:[00000000h] 0x00000043 mov di, 014Dh 0x00000047 mov dword ptr fs:[00000000h], esp 0x0000004e mov edi, dword ptr [ebp+122D2FDDh] 0x00000054 mov eax, dword ptr [ebp+122D06ADh] 0x0000005a push ecx 0x0000005b or ebx, dword ptr [ebp+122D3B9Ah] 0x00000061 pop ebx 0x00000062 push FFFFFFFFh 0x00000064 mov bh, EEh 0x00000066 adc ebx, 37F7968Ah 0x0000006c nop 0x0000006d push ebx 0x0000006e jmp 00007F59E0FE79CFh 0x00000073 pop ebx 0x00000074 push eax 0x00000075 jnp 00007F59E0FE79E0h 0x0000007b push eax 0x0000007c push edx 0x0000007d push eax 0x0000007e push edx 0x0000007f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 480834 second address: 480838 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 482692 second address: 482696 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 482696 second address: 4826FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 jmp 00007F59E0FDFAC1h 0x0000000d push dword ptr fs:[00000000h] 0x00000014 add dword ptr [ebp+122D1AD7h], ecx 0x0000001a mov edi, dword ptr [ebp+122D39BAh] 0x00000020 mov dword ptr fs:[00000000h], esp 0x00000027 push 00000000h 0x00000029 push ebp 0x0000002a call 00007F59E0FDFAB8h 0x0000002f pop ebp 0x00000030 mov dword ptr [esp+04h], ebp 0x00000034 add dword ptr [esp+04h], 00000015h 0x0000003c inc ebp 0x0000003d push ebp 0x0000003e ret 0x0000003f pop ebp 0x00000040 ret 0x00000041 mov eax, dword ptr [ebp+122D0F71h] 0x00000047 cmc 0x00000048 push FFFFFFFFh 0x0000004a movzx edi, di 0x0000004d nop 0x0000004e pushad 0x0000004f pushad 0x00000050 pushad 0x00000051 popad 0x00000052 pushad 0x00000053 popad 0x00000054 popad 0x00000055 push eax 0x00000056 push edx 0x00000057 push edi 0x00000058 pop edi 0x00000059 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4855AA second address: 4855B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 484541 second address: 48454A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 484635 second address: 484639 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 48572E second address: 4857E9 instructions: 0x00000000 rdtsc 0x00000002 js 00007F59E0FDFABCh 0x00000008 jbe 00007F59E0FDFAB6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jmp 00007F59E0FDFAC1h 0x00000016 nop 0x00000017 push 00000000h 0x00000019 push ecx 0x0000001a call 00007F59E0FDFAB8h 0x0000001f pop ecx 0x00000020 mov dword ptr [esp+04h], ecx 0x00000024 add dword ptr [esp+04h], 0000001Bh 0x0000002c inc ecx 0x0000002d push ecx 0x0000002e ret 0x0000002f pop ecx 0x00000030 ret 0x00000031 push dword ptr fs:[00000000h] 0x00000038 push 00000000h 0x0000003a push ebx 0x0000003b call 00007F59E0FDFAB8h 0x00000040 pop ebx 0x00000041 mov dword ptr [esp+04h], ebx 0x00000045 add dword ptr [esp+04h], 00000016h 0x0000004d inc ebx 0x0000004e push ebx 0x0000004f ret 0x00000050 pop ebx 0x00000051 ret 0x00000052 mov dword ptr [ebp+12461E2Dh], ecx 0x00000058 mov dword ptr fs:[00000000h], esp 0x0000005f mov ebx, edi 0x00000061 mov eax, dword ptr [ebp+122D06CDh] 0x00000067 jmp 00007F59E0FDFAC3h 0x0000006c push FFFFFFFFh 0x0000006e or dword ptr [ebp+122D2AE5h], edx 0x00000074 mov ebx, dword ptr [ebp+122D186Dh] 0x0000007a nop 0x0000007b push eax 0x0000007c push edx 0x0000007d pushad 0x0000007e jmp 00007F59E0FDFAC3h 0x00000083 push esi 0x00000084 pop esi 0x00000085 popad 0x00000086 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4857E9 second address: 4857F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F59E0FE79C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 48CCB3 second address: 48CCBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 48CCBB second address: 48CCBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 491DE3 second address: 491DE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 491DE7 second address: 491DF6 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F59E0FE79C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 491E9D second address: 491EA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 491EA1 second address: 491EA7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 491EA7 second address: 491EB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F59E0FDFABCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 41E132 second address: 41E148 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F59E0FE79D0h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 41E148 second address: 41E153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 41E153 second address: 41E16E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FE79D7h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 497A8B second address: 497A91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 497A91 second address: 497AA2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F59E0FE79CBh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 497AA2 second address: 497AA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 497AA7 second address: 497AAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 497AAF second address: 497ACA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F59E0FDFAC2h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4982A7 second address: 4982AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 49859A second address: 4985A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F59E0FDFAB6h 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4985A7 second address: 4985AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 498705 second address: 498709 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 49884D second address: 498858 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F59E0FE79C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 498AB8 second address: 498AD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F59E0FDFABEh 0x0000000b popad 0x0000000c pushad 0x0000000d ja 00007F59E0FDFAB6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 498AD6 second address: 498AF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F59E0FE79C6h 0x0000000a popad 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007F59E0FE79CEh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 498AF2 second address: 498AF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 498C4F second address: 498C5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 jp 00007F59E0FE79C6h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 498C5E second address: 498C75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F59E0FDFAC3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 49EF5B second address: 49EF61 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 49DCF1 second address: 49DCF6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 49DCF6 second address: 49DCFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 49DCFC second address: 49DD12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F59E0FDFABDh 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 468CEF second address: 468CF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 468CF3 second address: 468CF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4691ED second address: 4691F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 469425 second address: 46942E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 46942E second address: 469432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4695FE second address: 469645 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F59E0FDFAB8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e ja 00007F59E0FDFAC5h 0x00000014 mov eax, dword ptr [eax] 0x00000016 pushad 0x00000017 jbe 00007F59E0FDFAB8h 0x0000001d push ecx 0x0000001e pop ecx 0x0000001f jo 00007F59E0FDFAB8h 0x00000025 push eax 0x00000026 pop eax 0x00000027 popad 0x00000028 mov dword ptr [esp+04h], eax 0x0000002c push eax 0x0000002d push edx 0x0000002e jg 00007F59E0FDFAB8h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 469645 second address: 46964F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F59E0FE79C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 46970D second address: 469711 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4697E8 second address: 46983C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ecx 0x0000000a call 00007F59E0FE79C8h 0x0000000f pop ecx 0x00000010 mov dword ptr [esp+04h], ecx 0x00000014 add dword ptr [esp+04h], 0000001Ch 0x0000001c inc ecx 0x0000001d push ecx 0x0000001e ret 0x0000001f pop ecx 0x00000020 ret 0x00000021 push edi 0x00000022 or dword ptr [ebp+122D1DE3h], edx 0x00000028 pop edx 0x00000029 mov ecx, dword ptr [ebp+122D3A8Eh] 0x0000002f push 00000004h 0x00000031 nop 0x00000032 push ebx 0x00000033 jnc 00007F59E0FE79CCh 0x00000039 pop ebx 0x0000003a push eax 0x0000003b pushad 0x0000003c push eax 0x0000003d push edx 0x0000003e ja 00007F59E0FE79C6h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 49E00F second address: 49E016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 49E30A second address: 49E310 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 49E768 second address: 49E775 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007F59E0FDFAB8h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 49E775 second address: 49E77F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F59E0FE79C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 49E77F second address: 49E783 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 49E783 second address: 49E78D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 49E78D second address: 49E793 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 49EA6D second address: 49EA98 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F59E0FE79E3h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 49EA98 second address: 49EA9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 49EA9C second address: 49EAC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d jp 00007F59E0FE79C6h 0x00000013 pop esi 0x00000014 pushad 0x00000015 jng 00007F59E0FE79C6h 0x0000001b push esi 0x0000001c pop esi 0x0000001d jg 00007F59E0FE79C6h 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 49EAC0 second address: 49EAE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F59E0FDFABAh 0x00000008 jmp 00007F59E0FDFAC2h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 49EAE1 second address: 49EAE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4A3664 second address: 4A368F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jns 00007F59E0FDFAB6h 0x0000000d pushad 0x0000000e popad 0x0000000f push edx 0x00000010 pop edx 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F59E0FDFAC7h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4A310B second address: 4A311A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4A311A second address: 4A311E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4A311E second address: 4A312E instructions: 0x00000000 rdtsc 0x00000002 jo 00007F59E0FE79C6h 0x00000008 jns 00007F59E0FE79C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4A4158 second address: 4A4164 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4A4454 second address: 4A4466 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jne 00007F59E0FE79C6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 41FB6A second address: 41FB6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 41FB6E second address: 41FB76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4AD26B second address: 4AD298 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jns 00007F59E0FDFAB6h 0x0000000c jmp 00007F59E0FDFAC2h 0x00000011 popad 0x00000012 push edi 0x00000013 pushad 0x00000014 popad 0x00000015 pop edi 0x00000016 js 00007F59E0FDFABEh 0x0000001c push eax 0x0000001d pop eax 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4ADAB1 second address: 4ADAF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F59E0FE79D0h 0x0000000b pushad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F59E0FE79CDh 0x00000014 jg 00007F59E0FE79C6h 0x0000001a popad 0x0000001b jg 00007F59E0FE79D2h 0x00000021 push edx 0x00000022 push ecx 0x00000023 pop ecx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4ADD8E second address: 4ADD9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F59E0FDFABAh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4ADD9F second address: 4ADDA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4ADDA3 second address: 4ADDA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4ADDA9 second address: 4ADDEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007F59E0FE79D0h 0x0000000a jno 00007F59E0FE79C6h 0x00000010 popad 0x00000011 jl 00007F59E0FE79C8h 0x00000017 pushad 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b pushad 0x0000001c jmp 00007F59E0FE79D6h 0x00000021 push eax 0x00000022 push edx 0x00000023 push ebx 0x00000024 pop ebx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4AE21D second address: 4AE223 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4AE223 second address: 4AE22E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4AE22E second address: 4AE234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4B1C1B second address: 4B1C5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FE79D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F59E0FE79D7h 0x0000000f jmp 00007F59E0FE79CCh 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4B1C5D second address: 4B1C63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4B1C63 second address: 4B1C69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4B1C69 second address: 4B1C6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4B1C6D second address: 4B1C96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F59E0FE79C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F59E0FE79D2h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 push esi 0x00000015 pushad 0x00000016 popad 0x00000017 pop esi 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4B4894 second address: 4B48B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FDFABAh 0x00000007 je 00007F59E0FDFAB6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007F59E0FDFAB6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4B48B0 second address: 4B48D7 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F59E0FE79C6h 0x00000008 jmp 00007F59E0FE79D9h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4B48D7 second address: 4B48DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4B4A24 second address: 4B4A3C instructions: 0x00000000 rdtsc 0x00000002 js 00007F59E0FE79DAh 0x00000008 jmp 00007F59E0FE79CEh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4B4A3C second address: 4B4A6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F59E0FDFABBh 0x0000000a jmp 00007F59E0FDFABCh 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 jo 00007F59E0FDFACCh 0x00000018 push esi 0x00000019 push edx 0x0000001a pop edx 0x0000001b pop esi 0x0000001c js 00007F59E0FDFAC2h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4B4A6D second address: 4B4A73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4B6C48 second address: 4B6C4E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4B6C4E second address: 4B6C53 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4BC985 second address: 4BC996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jnl 00007F59E0FDFAB6h 0x0000000c popad 0x0000000d push edi 0x0000000e push edx 0x0000000f pop edx 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 430765 second address: 430797 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a ja 00007F59E0FE79CCh 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F59E0FE79D8h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4BBC4E second address: 4BBC54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4BBC54 second address: 4BBC58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4BBC58 second address: 4BBC5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4BBC5C second address: 4BBC62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4BBC62 second address: 4BBC95 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FDFAC2h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jl 00007F59E0FDFAB6h 0x00000010 jmp 00007F59E0FDFAC4h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4BC1F6 second address: 4BC205 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 js 00007F59E0FE79C6h 0x0000000c push eax 0x0000000d pop eax 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4BE052 second address: 4BE058 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4BE058 second address: 4BE064 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C38B8 second address: 4C38BE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C3D5E second address: 4C3D63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C3D63 second address: 4C3D69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C3EF2 second address: 4C3EF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C3EF6 second address: 4C3F00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C3F00 second address: 4C3F04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C3F04 second address: 4C3F18 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FDFAC0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C4084 second address: 4C40A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FE79D8h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C40A2 second address: 4C40A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C422E second address: 4C4232 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C4232 second address: 4C4238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C75BB second address: 4C75BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C75BF second address: 4C75CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C7705 second address: 4C773F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FE79D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jp 00007F59E0FE79D2h 0x00000011 jg 00007F59E0FE79C6h 0x00000017 ja 00007F59E0FE79C6h 0x0000001d jmp 00007F59E0FE79D2h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C773F second address: 4C7745 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C7745 second address: 4C774B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CD2D6 second address: 4CD2E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 jnc 00007F59E0FDFAB6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CD44D second address: 4CD462 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F59E0FE79CFh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CD58D second address: 4CD591 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CD591 second address: 4CD5A1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CD5A1 second address: 4CD5BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FDFAC5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CD5BD second address: 4CD5C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CD5C2 second address: 4CD5C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CD8A5 second address: 4CD8BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F59E0FE79CCh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CD8BD second address: 4CD8CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FDFABDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CD8CE second address: 4CD8D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CDBA9 second address: 4CDBC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FDFAC5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CDBC2 second address: 4CDBD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F59E0FE79CCh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CDBD4 second address: 4CDBDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CDBDA second address: 4CDBEA instructions: 0x00000000 rdtsc 0x00000002 jo 00007F59E0FE79C6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CDBEA second address: 4CDBEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CE212 second address: 4CE216 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CE216 second address: 4CE21C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CE21C second address: 4CE226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CE226 second address: 4CE22A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CE22A second address: 4CE22E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CE22E second address: 4CE237 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CE237 second address: 4CE23F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CE4CA second address: 4CE4E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F59E0FDFAC9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CE4E7 second address: 4CE4FE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F59E0FE79CEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CE4FE second address: 4CE504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CED0B second address: 4CED34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F59E0FE79C6h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jc 00007F59E0FE79C6h 0x00000015 jmp 00007F59E0FE79D4h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CED34 second address: 4CED38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CED38 second address: 4CED42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CED42 second address: 4CED46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CED46 second address: 4CED4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CED4C second address: 4CED52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CED52 second address: 4CED58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CED58 second address: 4CED5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CED5C second address: 4CED60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CED60 second address: 4CED66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4D2A41 second address: 4D2A4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4D2A4B second address: 4D2A5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F59E0FDFABFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4D2A5E second address: 4D2A64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4D2A64 second address: 4D2A6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4D2DB2 second address: 4D2DBE instructions: 0x00000000 rdtsc 0x00000002 jne 00007F59E0FE79CEh 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4D2DBE second address: 4D2DD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F59E0FDFABEh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4D306D second address: 4D307F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007F59E0FE79C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4D64A8 second address: 4D64B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jc 00007F59E0FDFAB6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4D65F5 second address: 4D662D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FE79D8h 0x00000007 je 00007F59E0FE79C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f ja 00007F59E0FE79C8h 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 pushad 0x00000018 push edx 0x00000019 jo 00007F59E0FE79C6h 0x0000001f pushad 0x00000020 popad 0x00000021 pop edx 0x00000022 push edi 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4D662D second address: 4D6666 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F59E0FDFAB6h 0x0000000a pop edi 0x0000000b jmp 00007F59E0FDFAC7h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F59E0FDFAC3h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4D6666 second address: 4D666A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4D6AA4 second address: 4D6AA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4D6E05 second address: 4D6E1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jne 00007F59E0FE79C6h 0x0000000c popad 0x0000000d push edi 0x0000000e js 00007F59E0FE79C6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4D6E1B second address: 4D6E2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007F59E0FDFAB6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4D6E2A second address: 4D6E2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4E3602 second address: 4E3606 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4E3606 second address: 4E3634 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F59E0FE79D2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push edi 0x00000011 pop edi 0x00000012 jmp 00007F59E0FE79CEh 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4E3634 second address: 4E3639 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4E3E57 second address: 4E3E94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F59E0FE79C6h 0x0000000a pop ecx 0x0000000b jmp 00007F59E0FE79D7h 0x00000010 jns 00007F59E0FE79D5h 0x00000016 push eax 0x00000017 push edx 0x00000018 push edx 0x00000019 pop edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4E3E94 second address: 4E3E98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4E4C3E second address: 4E4C4D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4EA8BC second address: 4EA8C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F59E0FDFAB6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4EA2D2 second address: 4EA2D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4ECBBD second address: 4ECBCB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FDFABAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4ECBCB second address: 4ECBD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4ECBD1 second address: 4ECBD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 423232 second address: 423253 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FE79D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a pushad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 423253 second address: 423278 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jmp 00007F59E0FDFAC4h 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d popad 0x0000000e push ebx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4ECA1F second address: 4ECA2E instructions: 0x00000000 rdtsc 0x00000002 jno 00007F59E0FE79CAh 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4ECA2E second address: 4ECA36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4F7A83 second address: 4F7AB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F59E0FE79D9h 0x00000009 jmp 00007F59E0FE79D8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4F7727 second address: 4F7738 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push edx 0x00000006 pop edx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ebx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4F7738 second address: 4F7740 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4FC721 second address: 4FC725 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4FC725 second address: 4FC72B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4FC72B second address: 4FC762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jmp 00007F59E0FDFAC2h 0x0000000c pop esi 0x0000000d popad 0x0000000e pushad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 push edx 0x00000017 pop edx 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F59E0FDFABFh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 50D53D second address: 50D541 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 50D541 second address: 50D55D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F59E0FDFAC2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 50D55D second address: 50D561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 5179FE second address: 517A08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F59E0FDFAB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 517A08 second address: 517A1A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F59E0FE79C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 517A1A second address: 517A20 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 517A20 second address: 517A33 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F59E0FE79CEh 0x00000008 pushad 0x00000009 popad 0x0000000a jne 00007F59E0FE79C6h 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 51635C second address: 516361 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 516361 second address: 51637E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F59E0FE79D7h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 51637E second address: 516386 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 516663 second address: 516681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push esi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pop esi 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007F59E0FE79C8h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 jp 00007F59E0FE79C6h 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 516681 second address: 516685 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 516685 second address: 51668D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 516912 second address: 516918 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 516BF0 second address: 516BF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 516BF6 second address: 516C0B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F59E0FDFABCh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 516C0B second address: 516C13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 52E85A second address: 52E867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 52E867 second address: 52E86B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 52E70B second address: 52E727 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FDFAC4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 52E727 second address: 52E72B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 52E72B second address: 52E733 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 53B042 second address: 53B047 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 53B047 second address: 53B04D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 53B04D second address: 53B071 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F59E0FE79D9h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 53AECD second address: 53AED1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 53DCC5 second address: 53DCEA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FE79D6h 0x00000007 jo 00007F59E0FE79C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 53DCEA second address: 53DCF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 53DCF0 second address: 53DD01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F59E0FE79C6h 0x0000000a jc 00007F59E0FE79C6h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 53D8C2 second address: 53D8CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 53D8CC second address: 53D8E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 push eax 0x00000009 pushad 0x0000000a jc 00007F59E0FE79C6h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 560B28 second address: 560B46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F59E0FDFAC3h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 560B46 second address: 560B4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 55F9E3 second address: 55F9F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F59E0FDFABBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 55F9F2 second address: 55FA18 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 ja 00007F59E0FE79C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F59E0FE79D7h 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 55FB49 second address: 55FB4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 55FB4F second address: 55FB53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 55FCB2 second address: 55FCBC instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F59E0FDFAB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 55FF93 second address: 55FF9D instructions: 0x00000000 rdtsc 0x00000002 jp 00007F59E0FE79E0h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 56050B second address: 560511 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 560511 second address: 560530 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F59E0FE79CCh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007F59E0FE79C6h 0x00000012 jg 00007F59E0FE79C6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 560692 second address: 56069C instructions: 0x00000000 rdtsc 0x00000002 je 00007F59E0FDFAB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 56069C second address: 5606A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 5606A7 second address: 5606C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F59E0FDFABDh 0x00000009 popad 0x0000000a ja 00007F59E0FDFAC2h 0x00000010 jns 00007F59E0FDFAB6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 56083B second address: 560842 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 56370F second address: 563713 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 563A4D second address: 563A5D instructions: 0x00000000 rdtsc 0x00000002 js 00007F59E0FE79C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 563A5D second address: 563A61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 563A61 second address: 563A85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F59E0FE79D0h 0x0000000b popad 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 pushad 0x00000011 jbe 00007F59E0FE79CCh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 566681 second address: 56669D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F59E0FDFAC7h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 56669D second address: 5666A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 5666A2 second address: 5666A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 5666A8 second address: 5666AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C80605 second address: 4C8063A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F59E0FDFAC0h 0x00000010 xchg eax, ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F59E0FDFAC7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C8063A second address: 4C8063F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C8063F second address: 4C80669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dx, 6E68h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007F59E0FDFAC7h 0x00000012 pop ebp 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 mov bh, cl 0x00000018 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C00D27 second address: 4C00D2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C00D2D second address: 4C00D85 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FDFABBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d call 00007F59E0FDFAC4h 0x00000012 call 00007F59E0FDFAC2h 0x00000017 pop eax 0x00000018 pop edi 0x00000019 mov ah, E2h 0x0000001b popad 0x0000001c mov ebp, esp 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F59E0FDFAC6h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C00D85 second address: 4C00DD0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, bx 0x00000006 pushfd 0x00000007 jmp 00007F59E0FE79CDh 0x0000000c or cl, FFFFFFD6h 0x0000000f jmp 00007F59E0FE79D1h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push dword ptr [ebp+04h] 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F59E0FE79D8h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C00DD0 second address: 4C00DD6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C00DD6 second address: 4C00DDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C00DDC second address: 4C00DE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C00DE0 second address: 4C00DE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C50B1E second address: 4C50BC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FDFABBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F59E0FDFAC4h 0x00000011 adc esi, 13183808h 0x00000017 jmp 00007F59E0FDFABBh 0x0000001c popfd 0x0000001d mov cx, BE7Fh 0x00000021 popad 0x00000022 push eax 0x00000023 jmp 00007F59E0FDFAC5h 0x00000028 xchg eax, ebp 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007F59E0FDFABCh 0x00000030 sbb ah, FFFFFF98h 0x00000033 jmp 00007F59E0FDFABBh 0x00000038 popfd 0x00000039 pushfd 0x0000003a jmp 00007F59E0FDFAC8h 0x0000003f xor cx, 57F8h 0x00000044 jmp 00007F59E0FDFABBh 0x00000049 popfd 0x0000004a popad 0x0000004b mov ebp, esp 0x0000004d pushad 0x0000004e push eax 0x0000004f push edx 0x00000050 mov edx, eax 0x00000052 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C80D4E second address: 4C80D84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F59E0FE79D4h 0x0000000a xor ax, 3E08h 0x0000000f jmp 00007F59E0FE79CBh 0x00000014 popfd 0x00000015 popad 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b movsx edi, si 0x0000001e push ecx 0x0000001f pop edi 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C80D84 second address: 4C80D9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F59E0FDFAC4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C80D9C second address: 4C80E05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov cl, 2Ch 0x0000000c pushfd 0x0000000d jmp 00007F59E0FE79D9h 0x00000012 sub eax, 3F6D5136h 0x00000018 jmp 00007F59E0FE79D1h 0x0000001d popfd 0x0000001e popad 0x0000001f xchg eax, ebp 0x00000020 jmp 00007F59E0FE79CEh 0x00000025 mov ebp, esp 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F59E0FE79D7h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C80E05 second address: 4C80E1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F59E0FDFAC4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C80E1D second address: 4C80E35 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FE79CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C80E35 second address: 4C80E50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FDFAC7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C80E50 second address: 4C80E56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C80E56 second address: 4C80E5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C10539 second address: 4C1053F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C1053F second address: 4C10543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C10543 second address: 4C10547 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C10547 second address: 4C10553 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C10553 second address: 4C105A7 instructions: 0x00000000 rdtsc 0x00000002 movsx edi, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 pop ebx 0x0000000a mov di, ax 0x0000000d popad 0x0000000e popad 0x0000000f mov dword ptr [esp], ebp 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F59E0FE79CAh 0x00000019 and cl, 00000018h 0x0000001c jmp 00007F59E0FE79CBh 0x00000021 popfd 0x00000022 movzx ecx, di 0x00000025 popad 0x00000026 mov ebp, esp 0x00000028 pushad 0x00000029 jmp 00007F59E0FE79D1h 0x0000002e mov si, C8B7h 0x00000032 popad 0x00000033 pop ebp 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 mov dl, 6Ah 0x00000039 movzx esi, bx 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C80486 second address: 4C804D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F59E0FDFAC5h 0x0000000b sbb ax, 7D56h 0x00000010 jmp 00007F59E0FDFAC1h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F59E0FDFAC8h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C804D8 second address: 4C804DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C804DE second address: 4C804E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C80B26 second address: 4C80B3A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FE79D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C80B3A second address: 4C80B72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F59E0FDFAC1h 0x00000008 call 00007F59E0FDFAC0h 0x0000000d pop ecx 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F59E0FDFABCh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C80B72 second address: 4C80BB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FE79CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F59E0FE79CBh 0x00000015 xor cx, 791Eh 0x0000001a jmp 00007F59E0FE79D9h 0x0000001f popfd 0x00000020 movzx eax, di 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C80BB6 second address: 4C80BEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F59E0FDFAC8h 0x00000009 jmp 00007F59E0FDFAC5h 0x0000000e popfd 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C80BEA second address: 4C80C07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 and dword ptr [eax], 00000000h 0x0000000a pushad 0x0000000b movzx esi, bx 0x0000000e mov esi, edi 0x00000010 popad 0x00000011 and dword ptr [eax+04h], 00000000h 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 mov edi, 2FB134C0h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C50A79 second address: 4C50ABA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FDFAC3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F59E0FDFAC9h 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F59E0FDFABDh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C50ABA second address: 4C50AE5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FE79D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F59E0FE79CEh 0x00000010 pop ebp 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 mov cl, CBh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C9001B second address: 4C9008F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FDFAC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov ebx, eax 0x0000000d mov ax, EDAFh 0x00000011 popad 0x00000012 push eax 0x00000013 jmp 00007F59E0FDFAC5h 0x00000018 xchg eax, ebp 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F59E0FDFAC8h 0x00000020 or ax, 5F38h 0x00000025 jmp 00007F59E0FDFABBh 0x0000002a popfd 0x0000002b popad 0x0000002c mov ebp, esp 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 mov ecx, ebx 0x00000033 mov cx, di 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C3076F second address: 4C30775 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C30775 second address: 4C30779 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C30779 second address: 4C307DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FE79CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F59E0FE79D6h 0x00000011 push eax 0x00000012 pushad 0x00000013 mov ch, dh 0x00000015 pushfd 0x00000016 jmp 00007F59E0FE79CAh 0x0000001b xor ch, 00000068h 0x0000001e jmp 00007F59E0FE79CBh 0x00000023 popfd 0x00000024 popad 0x00000025 xchg eax, ebp 0x00000026 jmp 00007F59E0FE79D6h 0x0000002b mov ebp, esp 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C307DF second address: 4C307E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C307E3 second address: 4C307E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C307E7 second address: 4C307ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C307ED second address: 4C307FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F59E0FE79CBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C90AAE second address: 4C90AB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C90AB4 second address: 4C90AB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C90AB8 second address: 4C90ABC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C90ABC second address: 4C90AF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 pushad 0x0000000a mov esi, 298B96DBh 0x0000000f mov di, si 0x00000012 popad 0x00000013 mov dword ptr [esp], ebp 0x00000016 pushad 0x00000017 pushad 0x00000018 jmp 00007F59E0FE79D6h 0x0000001d mov ecx, 389CAF31h 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C90AF4 second address: 4C90B05 instructions: 0x00000000 rdtsc 0x00000002 mov si, 1369h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C90B05 second address: 4C90B16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FE79CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C90B16 second address: 4C90B9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 pushfd 0x00000006 jmp 00007F59E0FDFAC3h 0x0000000b jmp 00007F59E0FDFAC3h 0x00000010 popfd 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 xchg eax, ecx 0x00000015 pushad 0x00000016 mov ecx, 7B7F7C6Bh 0x0000001b pushad 0x0000001c jmp 00007F59E0FDFABEh 0x00000021 pushfd 0x00000022 jmp 00007F59E0FDFAC2h 0x00000027 sub ah, 00000028h 0x0000002a jmp 00007F59E0FDFABBh 0x0000002f popfd 0x00000030 popad 0x00000031 popad 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 jmp 00007F59E0FDFAC2h 0x0000003b mov bx, cx 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C90B9A second address: 4C90BD4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F59E0FE79CDh 0x00000008 pushfd 0x00000009 jmp 00007F59E0FE79D0h 0x0000000e and al, FFFFFFE8h 0x00000011 jmp 00007F59E0FE79CBh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C90BD4 second address: 4C90BD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C90BD8 second address: 4C90BDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C90BDE second address: 4C90C4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F59E0FDFAC8h 0x00000009 sbb esi, 7B083878h 0x0000000f jmp 00007F59E0FDFABBh 0x00000014 popfd 0x00000015 jmp 00007F59E0FDFAC8h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov eax, dword ptr [76FB65FCh] 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 pushfd 0x00000026 jmp 00007F59E0FDFABCh 0x0000002b sub ax, 2208h 0x00000030 jmp 00007F59E0FDFABBh 0x00000035 popfd 0x00000036 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C90C4D second address: 4C90CBD instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F59E0FE79D8h 0x00000008 sub eax, 64784468h 0x0000000e jmp 00007F59E0FE79CBh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushfd 0x00000017 jmp 00007F59E0FE79D8h 0x0000001c jmp 00007F59E0FE79D5h 0x00000021 popfd 0x00000022 popad 0x00000023 test eax, eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F59E0FE79CDh 0x0000002c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C90CBD second address: 4C90CC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C90CC2 second address: 4C90CDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bx, 6540h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F5A5328A65Fh 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push ecx 0x00000015 pop edi 0x00000016 mov bx, ax 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C90CDC second address: 4C90CF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F59E0FDFAC4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C90CF4 second address: 4C90CF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C9019B second address: 4C901A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C901A1 second address: 4C901B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, ax 0x00000006 mov ecx, 1055B06Fh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C901B6 second address: 4C901BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C901BA second address: 4C901BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C901BE second address: 4C901C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C901C4 second address: 4C901CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C901CA second address: 4C901CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C901CE second address: 4C901EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FE79D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C901EA second address: 4C901F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F59E0FDFABAh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C901F9 second address: 4C901FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C901FF second address: 4C90203 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C90203 second address: 4C9023F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FE79CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F59E0FE79CEh 0x00000011 mov ebp, esp 0x00000013 jmp 00007F59E0FE79D0h 0x00000018 mov eax, dword ptr [ebp+08h] 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C9023F second address: 4C90243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C90243 second address: 4C9024E instructions: 0x00000000 rdtsc 0x00000002 mov ebx, ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 mov dx, si 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C9024E second address: 4C90270 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 and dword ptr [eax], 00000000h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F59E0FDFAC4h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C90270 second address: 4C9027F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FE79CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C9027F second address: 4C90285 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C90285 second address: 4C90289 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C90289 second address: 4C902CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FDFABBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F59E0FDFABBh 0x00000015 sub cx, 678Eh 0x0000001a jmp 00007F59E0FDFAC9h 0x0000001f popfd 0x00000020 mov dx, cx 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C902CD second address: 4C902D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C902D3 second address: 4C902D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C50016 second address: 4C5002E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F59E0FE79D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C5002E second address: 4C50032 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C50032 second address: 4C50083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F59E0FE79D8h 0x00000012 add eax, 2212BDD8h 0x00000018 jmp 00007F59E0FE79CBh 0x0000001d popfd 0x0000001e popad 0x0000001f mov ebp, esp 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F59E0FE79D5h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C50083 second address: 4C50093 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F59E0FDFABCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C50093 second address: 4C5013C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and esp, FFFFFFF8h 0x0000000b pushad 0x0000000c mov ebx, 16534380h 0x00000011 mov ecx, ebx 0x00000013 popad 0x00000014 push esi 0x00000015 jmp 00007F59E0FE79D0h 0x0000001a mov dword ptr [esp], ecx 0x0000001d pushad 0x0000001e mov ecx, 0601839Dh 0x00000023 pushfd 0x00000024 jmp 00007F59E0FE79CAh 0x00000029 add si, ACF8h 0x0000002e jmp 00007F59E0FE79CBh 0x00000033 popfd 0x00000034 popad 0x00000035 xchg eax, ebx 0x00000036 jmp 00007F59E0FE79D6h 0x0000003b push eax 0x0000003c pushad 0x0000003d push edx 0x0000003e push esi 0x0000003f pop ebx 0x00000040 pop eax 0x00000041 pushad 0x00000042 push ebx 0x00000043 pop eax 0x00000044 pushfd 0x00000045 jmp 00007F59E0FE79CBh 0x0000004a adc eax, 4E37561Eh 0x00000050 jmp 00007F59E0FE79D9h 0x00000055 popfd 0x00000056 popad 0x00000057 popad 0x00000058 xchg eax, ebx 0x00000059 push eax 0x0000005a push edx 0x0000005b jmp 00007F59E0FE79CDh 0x00000060 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C5013C second address: 4C50145 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, C7E2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C50145 second address: 4C50164 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebx, dword ptr [ebp+10h] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F59E0FE79D1h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C50164 second address: 4C50168 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C50168 second address: 4C5016E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C5016E second address: 4C501AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F59E0FDFABAh 0x00000008 pop esi 0x00000009 mov ax, bx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ecx 0x00000010 pushad 0x00000011 mov ax, 0C9Fh 0x00000015 jmp 00007F59E0FDFAC4h 0x0000001a popad 0x0000001b mov dword ptr [esp], esi 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F59E0FDFABAh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C501AE second address: 4C501B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C501B4 second address: 4C501BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C501BA second address: 4C501BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C501BE second address: 4C501F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FDFAC8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, dword ptr [ebp+08h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F59E0FDFAC7h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C501F8 second address: 4C50283 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FE79D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F59E0FE79CCh 0x00000011 xor esi, 537F9A58h 0x00000017 jmp 00007F59E0FE79CBh 0x0000001c popfd 0x0000001d push esi 0x0000001e mov bx, 157Ah 0x00000022 pop edx 0x00000023 popad 0x00000024 push eax 0x00000025 pushad 0x00000026 jmp 00007F59E0FE79D7h 0x0000002b mov ax, F4EFh 0x0000002f popad 0x00000030 xchg eax, edi 0x00000031 pushad 0x00000032 pushfd 0x00000033 jmp 00007F59E0FE79D0h 0x00000038 or si, 5F18h 0x0000003d jmp 00007F59E0FE79CBh 0x00000042 popfd 0x00000043 push eax 0x00000044 push edx 0x00000045 mov ebx, ecx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C50283 second address: 4C502DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FDFAC2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a test esi, esi 0x0000000c pushad 0x0000000d jmp 00007F59E0FDFABEh 0x00000012 pushfd 0x00000013 jmp 00007F59E0FDFAC2h 0x00000018 adc cl, FFFFFFD8h 0x0000001b jmp 00007F59E0FDFABBh 0x00000020 popfd 0x00000021 popad 0x00000022 je 00007F5A532BDDFDh 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C502DA second address: 4C502E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C502E0 second address: 4C502FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F59E0FDFAC9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C502FD second address: 4C50375 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FE79D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b cmp dword ptr [esi+08h], DDEEDDEEh 0x00000012 jmp 00007F59E0FE79CEh 0x00000017 je 00007F5A532C5CC8h 0x0000001d pushad 0x0000001e push esi 0x0000001f pushfd 0x00000020 jmp 00007F59E0FE79CDh 0x00000025 adc ah, 00000036h 0x00000028 jmp 00007F59E0FE79D1h 0x0000002d popfd 0x0000002e pop ecx 0x0000002f push edx 0x00000030 jmp 00007F59E0FE79CCh 0x00000035 pop esi 0x00000036 popad 0x00000037 mov edx, dword ptr [esi+44h] 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F59E0FE79CCh 0x00000041 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C60056 second address: 4C6005C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C6005C second address: 4C60092 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a call 00007F59E0FE79D0h 0x0000000f mov bh, cl 0x00000011 pop edx 0x00000012 mov dl, ch 0x00000014 popad 0x00000015 xchg eax, ebp 0x00000016 jmp 00007F59E0FE79CFh 0x0000001b mov ebp, esp 0x0000001d pushad 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C60092 second address: 4C600D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F59E0FDFAC0h 0x0000000a and al, 00000018h 0x0000000d jmp 00007F59E0FDFABBh 0x00000012 popfd 0x00000013 popad 0x00000014 pushad 0x00000015 mov ax, 9665h 0x00000019 movzx eax, bx 0x0000001c popad 0x0000001d popad 0x0000001e and esp, FFFFFFF8h 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F59E0FDFABFh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C600D7 second address: 4C600DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C600DD second address: 4C6010F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FDFAC4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F59E0FDFAC7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C6010F second address: 4C60195 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FE79D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F59E0FE79D1h 0x0000000f xchg eax, ebx 0x00000010 pushad 0x00000011 jmp 00007F59E0FE79CCh 0x00000016 jmp 00007F59E0FE79D2h 0x0000001b popad 0x0000001c xchg eax, esi 0x0000001d jmp 00007F59E0FE79D0h 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007F59E0FE79CCh 0x0000002c sbb si, 5858h 0x00000031 jmp 00007F59E0FE79CBh 0x00000036 popfd 0x00000037 push esi 0x00000038 pop ebx 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C60195 second address: 4C601D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 pushfd 0x00000007 jmp 00007F59E0FDFABCh 0x0000000c sbb eax, 1145E2B8h 0x00000012 jmp 00007F59E0FDFABBh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, esi 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F59E0FDFAC5h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C601D5 second address: 4C601E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F59E0FE79CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C601E5 second address: 4C601E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C601E9 second address: 4C60240 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+08h] 0x0000000b jmp 00007F59E0FE79D7h 0x00000010 sub ebx, ebx 0x00000012 jmp 00007F59E0FE79CFh 0x00000017 test esi, esi 0x00000019 pushad 0x0000001a mov edx, ecx 0x0000001c mov ax, 3597h 0x00000020 popad 0x00000021 je 00007F5A532ADB2Eh 0x00000027 pushad 0x00000028 mov bh, ah 0x0000002a mov cx, dx 0x0000002d popad 0x0000002e cmp dword ptr [esi+08h], DDEEDDEEh 0x00000035 pushad 0x00000036 push eax 0x00000037 push edx 0x00000038 mov ax, bx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C60240 second address: 4C60274 instructions: 0x00000000 rdtsc 0x00000002 movsx edi, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 call 00007F59E0FDFAC0h 0x0000000c call 00007F59E0FDFAC2h 0x00000011 pop eax 0x00000012 pop edx 0x00000013 popad 0x00000014 mov ecx, esi 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C60274 second address: 4C60278 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C60278 second address: 4C6027C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C6027C second address: 4C60282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C60282 second address: 4C602E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F59E0FDFAC0h 0x00000009 adc ax, 90F8h 0x0000000e jmp 00007F59E0FDFABBh 0x00000013 popfd 0x00000014 jmp 00007F59E0FDFAC8h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c je 00007F5A532A5B97h 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F59E0FDFAC7h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C602E1 second address: 4C60304 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, bx 0x00000006 mov dh, 8Eh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test byte ptr [76FB6968h], 00000002h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov ecx, edi 0x00000017 jmp 00007F59E0FE79CBh 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C60304 second address: 4C6030A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C6030A second address: 4C6030E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C6030E second address: 4C6034A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F5A532A5B56h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov bx, cx 0x00000014 pushfd 0x00000015 jmp 00007F59E0FDFAC4h 0x0000001a adc eax, 5D811A78h 0x00000020 jmp 00007F59E0FDFABBh 0x00000025 popfd 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C6034A second address: 4C60350 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C60350 second address: 4C60354 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C60354 second address: 4C60365 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [ebp+0Ch] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C60365 second address: 4C60369 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C60369 second address: 4C6036F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C6036F second address: 4C60381 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F59E0FDFABEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C60381 second address: 4C603C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F59E0FE79CCh 0x0000000e mov dword ptr [esp], ebx 0x00000011 jmp 00007F59E0FE79D0h 0x00000016 xchg eax, ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F59E0FE79D7h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C603C3 second address: 4C6042B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, di 0x00000006 mov edi, 7BC3F086h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 mov edx, ecx 0x00000015 popad 0x00000016 call 00007F59E0FDFAC2h 0x0000001b pushfd 0x0000001c jmp 00007F59E0FDFAC2h 0x00000021 add ecx, 73D27E58h 0x00000027 jmp 00007F59E0FDFABBh 0x0000002c popfd 0x0000002d pop ecx 0x0000002e popad 0x0000002f xchg eax, ebx 0x00000030 jmp 00007F59E0FDFABFh 0x00000035 push dword ptr [ebp+14h] 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C6042B second address: 4C6042F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C6042F second address: 4C60435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C60435 second address: 4C6043B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C6043B second address: 4C6043F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C60488 second address: 4C6048E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C6048E second address: 4C604B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F59E0FDFABBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F59E0FDFAC0h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C604B4 second address: 4C604B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C604B8 second address: 4C604BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C604BE second address: 4C604CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F59E0FE79CDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C604CF second address: 4C604D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4C604D3 second address: 4C6050A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 pushad 0x0000000a mov dx, C74Eh 0x0000000e mov ebx, 4A430A5Ah 0x00000013 popad 0x00000014 mov esp, ebp 0x00000016 jmp 00007F59E0FE79D1h 0x0000001b pop ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F59E0FE79CDh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CC1967 second address: 4CC196D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CC196D second address: 4CC1971 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CC1971 second address: 4CC1975 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CC1975 second address: 4CC1A29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F59E0FE79CEh 0x0000000e push eax 0x0000000f jmp 00007F59E0FE79CBh 0x00000014 xchg eax, ebp 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007F59E0FE79D4h 0x0000001c sub cl, FFFFFFD8h 0x0000001f jmp 00007F59E0FE79CBh 0x00000024 popfd 0x00000025 call 00007F59E0FE79D8h 0x0000002a call 00007F59E0FE79D2h 0x0000002f pop eax 0x00000030 pop edi 0x00000031 popad 0x00000032 mov ebp, esp 0x00000034 pushad 0x00000035 jmp 00007F59E0FE79D8h 0x0000003a popad 0x0000003b push 0000007Fh 0x0000003d jmp 00007F59E0FE79D0h 0x00000042 push 00000001h 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F59E0FE79CAh 0x0000004d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CC1A29 second address: 4CC1A2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CC1A2F second address: 4CC1A42 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov ebx, esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push dword ptr [ebp+08h] 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CC1A42 second address: 4CC1A46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CC1A46 second address: 4CC1A4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CC1A4A second address: 4CC1A50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 4CC1A50 second address: 4CC1A56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	RDTSC instruction interceptor: First address: 46E69B second address: 46E69F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Special instruction interceptor: First address: 2AFD01 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Special instruction interceptor: First address: 2AFD9E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Special instruction interceptor: First address: 460FEF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Special instruction interceptor: First address: 2AD6B6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Special instruction interceptor: First address: 4885D7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Special instruction interceptor: First address: 468EFF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Special instruction interceptor: First address: 4ED528 instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: BAFD01 instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: BAFD9E instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: D60FEF instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: BAD6B6 instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: D885D7 instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: D68EFF instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: DED528 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: 35FD01 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: 35FD9E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: 510FEF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: 35D6B6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: 5385D7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: 518EFF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: 59D528 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe

Code function: 0_2_04CD0906 rdtsc

0_2_04CD0906

Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Window / User API: threadDelayed 1077	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Window / User API: threadDelayed 1145	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Window / User API: threadDelayed 1040	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 1107	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 1124	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 738	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 1199	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 1145	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 712	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1358	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1386	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1171	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1156	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1148	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe TID: 6508	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe TID: 6404	Thread sleep count: 1077 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe TID: 6404	Thread sleep time: -2155077s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe TID: 4248	Thread sleep count: 243 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe TID: 7176	Thread sleep count: 231 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe TID: 6500	Thread sleep count: 1145 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe TID: 6500	Thread sleep time: -2291145s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe TID: 3060	Thread sleep count: 1040 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe TID: 3060	Thread sleep time: -2081040s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7248	Thread sleep count: 115 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7248	Thread sleep time: -230115s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7244	Thread sleep count: 145 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7244	Thread sleep time: -290145s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7440	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7192	Thread sleep count: 123 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7232	Thread sleep count: 75 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7232	Thread sleep time: -150075s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7192	Thread sleep count: 1107 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7192	Thread sleep time: -111807s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7484	Thread sleep count: 1124 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7484	Thread sleep count: 738 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7484	Thread sleep time: -73800s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7252	Thread sleep count: 119 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7252	Thread sleep time: -238119s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7240	Thread sleep count: 130 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7240	Thread sleep time: -260130s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7228	Thread sleep count: 118 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7228	Thread sleep time: -236118s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7340	Thread sleep count: 126 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7340	Thread sleep time: -252126s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7344	Thread sleep count: 99 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7344	Thread sleep time: -198099s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7200	Thread sleep count: 120 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7328	Thread sleep count: 107 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7328	Thread sleep time: -214107s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7336	Thread sleep count: 116 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7336	Thread sleep time: -232116s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7200	Thread sleep count: 1199 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7200	Thread sleep time: -121099s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7488	Thread sleep count: 1145 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7488	Thread sleep count: 712 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7488	Thread sleep time: -71200s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7324	Thread sleep count: 108 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7324	Thread sleep time: -216108s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7556	Thread sleep count: 50 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7556	Thread sleep time: -100050s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7560	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7516	Thread sleep count: 59 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7516	Thread sleep count: 265 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7708	Thread sleep count: 260 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7548	Thread sleep count: 1358 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7548	Thread sleep time: -2717358s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7536	Thread sleep count: 1386 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7536	Thread sleep time: -2773386s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7868	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7868	Thread sleep time: -66033s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7840	Thread sleep count: 1171 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7840	Thread sleep time: -2343171s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7824	Thread sleep count: 271 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 8016	Thread sleep count: 252 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7860	Thread sleep count: 1156 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7860	Thread sleep time: -2313156s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7852	Thread sleep count: 1148 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7852	Thread sleep time: -2297148s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed

Source: RageMP131.exe, RageMP131.exe, 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: MPGPH131.exe, 00000006.00000002.4115189261.000000000168D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: MPGPH131.exe, 00000005.00000002.4115259179.000000000148D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}q4
Source: RageMP131.exe, 00000007.00000002.4115609037.0000000000DC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000g
Source: RageMP131.exe, 00000009.00000002.4112061259.00000000001AD000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}H
Source: LisectAVT_2403002A_224.exe, 00000000.00000002.4115340739.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 00000006.00000002.4115021267.00000000011AD000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}f
Source: RageMP131.exe, 00000007.00000002.4115609037.0000000000E02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000nes\AppData\Local\Temp\heidiq
Source: RageMP131.exe, 00000009.00000003.1920445343.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}B
Source: RageMP131.exe, 00000009.00000002.4115337931.0000000000CBB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 00000006.00000002.4115189261.000000000168D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}a
Source: MPGPH131.exe, 00000006.00000003.1767661926.00000000016A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}$
Source: MPGPH131.exe, 00000005.00000002.4115259179.00000000014D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_4114B19C
Source: MPGPH131.exe, 00000006.00000002.4115189261.000000000166A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}@
Source: RageMP131.exe, 00000009.00000002.4115337931.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 3c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_4114B19C
Source: RageMP131.exe, 00000007.00000003.1849767285.0000000000E14000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: RageMP131.exe, 00000009.00000002.4115337931.0000000000CBB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&a
Source: LisectAVT_2403002A_224.exe, 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.4113971389.0000000000D42000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000006.00000002.4113956720.0000000000D42000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: LisectAVT_2403002A_224.exe, 00000000.00000002.4115340739.0000000000E94000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.4115259179.00000000014C2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.4115189261.000000000168D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.4115609037.0000000000E02000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000002.4115337931.0000000000CBB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Thread information set: HideFromDebugger	Jump to behavior

Potentially malicious time measurement code found

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_055D018A Start: 055D018F End: 055D0199		5_2_055D018A
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_055D0DA1 Start: 055D0DB0 End: 055D0DB6		6_2_055D0DA1

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe

Code function: 0_2_04CD0906 rdtsc

0_2_04CD0906

Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_001D3A40 mov eax, dword ptr fs:[00000030h]	0_2_001D3A40
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_001D3A40 mov eax, dword ptr fs:[00000030h]	0_2_001D3A40
Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Code function: 0_2_00184100 mov eax, dword ptr fs:[00000030h]	0_2_00184100
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00AD3A40 mov eax, dword ptr fs:[00000030h]	5_2_00AD3A40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00AD3A40 mov eax, dword ptr fs:[00000030h]	5_2_00AD3A40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00A84100 mov eax, dword ptr fs:[00000030h]	5_2_00A84100
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00AD3A40 mov eax, dword ptr fs:[00000030h]	6_2_00AD3A40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00AD3A40 mov eax, dword ptr fs:[00000030h]	6_2_00AD3A40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00A84100 mov eax, dword ptr fs:[00000030h]	6_2_00A84100
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00283A40 mov eax, dword ptr fs:[00000030h]	7_2_00283A40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00283A40 mov eax, dword ptr fs:[00000030h]	7_2_00283A40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00234100 mov eax, dword ptr fs:[00000030h]	7_2_00234100
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 9_2_00283A40 mov eax, dword ptr fs:[00000030h]	9_2_00283A40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 9_2_00283A40 mov eax, dword ptr fs:[00000030h]	9_2_00283A40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 9_2_00234100 mov eax, dword ptr fs:[00000030h]	9_2_00234100

Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.4113956720.0000000000D42000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, RageMP131.exe, 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmp

Binary or memory string: 'TProgram Manager

Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe

Code function: 0_2_0024F26A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_0024F26A

Source: C:\Users\user\Desktop\LisectAVT_2403002A_224.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected RisePro Stealer

Source: Yara match	File source: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1904982936.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1673549400.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.1734673045.0000000005330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1822511495.0000000004960000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1735290637.0000000005330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_224.exe PID: 6816, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7188, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7196, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7820, type: MEMORYSTR

Remote Access Functionality

Yara detected RisePro Stealer

Source: Yara match	File source: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1904982936.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1673549400.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.1734673045.0000000005330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1822511495.0000000004960000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1735290637.0000000005330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_224.exe PID: 6816, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7188, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7196, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7820, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Command and Scripting Interpreter	1 Scheduled Task/Job	2 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	24 Virtualization/Sandbox Evasion	LSASS Memory	741 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	2 Process Injection	Security Account Manager	24 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	214 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
LisectAVT_2403002A_224.exe	67%	ReversingLabs	Win32.Trojan.RisePro
LisectAVT_2403002A_224.exe	64%	Virustotal		Browse
LisectAVT_2403002A_224.exe	100%	Avira	TR/Scar.vkkgx
LisectAVT_2403002A_224.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	100%	Avira	TR/Scar.vkkgx
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Avira	TR/Scar.vkkgx
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	67%	ReversingLabs	Win32.Trojan.RisePro
C:\ProgramData\MPGPH131\MPGPH131.exe	64%	Virustotal		Browse
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	67%	ReversingLabs	Win32.Trojan.RisePro
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	64%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://www.winimage.com/zLibDll	0%	URL Reputation	safe
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORTbYE	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORTX	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORTX	1%	Virustotal		Browse
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	0%	Virustotal		Browse
https://t.me/RiseProSUPPORT	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	LisectAVT_2403002A_224.exe, 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, LisectAVT_2403002A_224.exe, 00000000.00000003.1673549400.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000005.00000003.1734673045.0000000005330000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000006.00000003.1735290637.0000000005330000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000007.00000003.1822511495.0000000004960000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000003.1904982936.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORTX	LisectAVT_2403002A_224.exe, 00000000.00000002.4115340739.0000000000E5E000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORTbYE	RageMP131.exe, 00000009.00000002.4115337931.0000000000CBB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDll	LisectAVT_2403002A_224.exe, 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, LisectAVT_2403002A_224.exe, 00000000.00000003.1673549400.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000005.00000003.1734673045.0000000005330000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000006.00000003.1735290637.0000000005330000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000007.00000003.1822511495.0000000004960000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000003.1904982936.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp	false	URL Reputation: safe	unknown
https://t.me/RiseProSUPPORT	LisectAVT_2403002A_224.exe, 00000000.00000002.4115340739.0000000000E5E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.4115259179.000000000148D000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.4115189261.000000000166A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.4115609037.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000002.4115337931.0000000000CBB000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.233.132.74	unknown	Russian Federation		2895	FREE-NET-ASFREEnetEU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1481004
Start date and time:	2024-07-25 02:45:45 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LisectAVT_2403002A_224.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@11/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.

Simulations

Behavior and APIs

Time	Type	Description
01:46:41	Task Scheduler	Run new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
01:46:41	Task Scheduler	Run new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
01:46:41	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
01:46:50	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
20:47:06	API Interceptor	3125258x Sleep call for process: LisectAVT_2403002A_224.exe modified
20:47:11	API Interceptor	5502x Sleep call for process: MPGPH131.exe modified
20:47:21	API Interceptor	4362026x Sleep call for process: RageMP131.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
193.233.132.74	80OrFCsz0u.exe	Get hash	malicious	GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse
	SecuriteInfo.com.Win64.Evo-gen.28136.30716.exe	Get hash	malicious	GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse
	file.exe	Get hash	malicious	RisePro Stealer	Browse
	vGDqFBB1Jz.exe	Get hash	malicious	RisePro Stealer	Browse
	iKV7MCWDJF.exe	Get hash	malicious	RisePro Stealer	Browse
	8TFD6H44Pz.exe	Get hash	malicious	RisePro Stealer	Browse
	uRLTbkeYF7.exe	Get hash	malicious	RisePro Stealer	Browse
	7mIgg1hm7Q.exe	Get hash	malicious	RisePro Stealer	Browse
	mZHCe1PQGn.exe	Get hash	malicious	RisePro Stealer	Browse
	1hYctqPwrw.exe	Get hash	malicious	RisePro Stealer	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FREE-NET-ASFREEnetEU	hunta[1].exe	Get hash	malicious	Bdaejec, RisePro Stealer	Browse	193.233.132.62
	External Own 4.20.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse	147.45.47.64
	Aquantia_Setup 2.11.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse	147.45.47.64
	AdobeUpdaterV131.exe	Get hash	malicious	Bdaejec, RisePro Stealer	Browse	193.233.132.62
	installer.exe	Get hash	malicious	LummaC, PureLog Stealer, Xmrig, zgRAT	Browse	147.45.47.81
	92.249.48.47-skid.arm7-2024-07-20T09_04_19.elf	Get hash	malicious	Mirai, Moobot	Browse	147.45.93.156
	conhost.exe	Get hash	malicious	Xmrig	Browse	147.45.47.81
	http://premium.davidabostic.com	Get hash	malicious	Unknown	Browse	147.45.78.74
	Software1.30.1.exe	Get hash	malicious	RedLine, Xmrig	Browse	147.45.47.81
	arm7.elf	Get hash	malicious	Mirai	Browse	147.45.45.222

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_224.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2340360
Entropy (8bit):	7.970077794206971
Encrypted:	false
SSDEEP:	49152:AB0vmtT5qmRdVuL9rNM9xz4mA6JMk1Y0/GiII:A2WYmRdVuLRNIfMk14I
MD5:	CC4A3A36D266E313523FEB9146C56DF6
SHA1:	094EF8DE8465D13EA82A0F9DAF13474F4F11BC17
SHA-256:	721A20928239475312D70EE30D402768348D81E72F67363A92E34ED087A545E7
SHA-512:	32C83BA930B1D6B3D88F4306F28ACF0303694D6F995574D5B7201855FB3F5E275C3CD47408959AB2C70259FE4595F2AC2774FCC95F311DFBC30D64A872A968BD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 67% Antivirus: Virustotal, Detection: 64%, Browse
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$......."...f.{Tf.{Tf.{T-.xUk.{T-.~U..{T-.\|Ug.{T)..Tb.{T)..Ut.{T).xUq.{T).~U3.{T-..U..{T-.}Ug.{T-.zU}.{Tf.zT@.{T..rUz.{T..{Ug.{T...Tg.{Tf..Tg.{T..yUg.{TRichf.{T................PE..L.....e...............".....0........Z...........@...........................Z......$...@.........................d.Z.L...U...i.......X+.......................................................................................................... . .p..........................@....rsrc...X+..........................@....idata ............."..............@... .`,..........$..............@...eyjsffgc..... @......&..............@...qbcnvswu......Z.......#.............@...........................................................................................................................................................................................................................

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_224.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_224.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2340360
Entropy (8bit):	7.970077794206971
Encrypted:	false
SSDEEP:	49152:AB0vmtT5qmRdVuL9rNM9xz4mA6JMk1Y0/GiII:A2WYmRdVuLRNIfMk14I
MD5:	CC4A3A36D266E313523FEB9146C56DF6
SHA1:	094EF8DE8465D13EA82A0F9DAF13474F4F11BC17
SHA-256:	721A20928239475312D70EE30D402768348D81E72F67363A92E34ED087A545E7
SHA-512:	32C83BA930B1D6B3D88F4306F28ACF0303694D6F995574D5B7201855FB3F5E275C3CD47408959AB2C70259FE4595F2AC2774FCC95F311DFBC30D64A872A968BD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 67% Antivirus: Virustotal, Detection: 64%, Browse
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$......."...f.{Tf.{Tf.{T-.xUk.{T-.~U..{T-.\|Ug.{T)..Tb.{T)..Ut.{T).xUq.{T).~U3.{T-..U..{T-.}Ug.{T-.zU}.{Tf.zT@.{T..rUz.{T..{Ug.{T...Tg.{Tf..Tg.{T..yUg.{TRichf.{T................PE..L.....e...............".....0........Z...........@...........................Z......$...@.........................d.Z.L...U...i.......X+.......................................................................................................... . .p..........................@....rsrc...X+..........................@....idata ............."..............@... .`,..........$..............@...eyjsffgc..... @......&..............@...qbcnvswu......Z.......#.............@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_224.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_224.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	13
Entropy (8bit):	2.8150724101159437
Encrypted:	false
SSDEEP:	3:LEQH7P:rP
MD5:	23B46E29AB05130754E2202717CB7A4A
SHA1:	9040273811B82BEE20B102785D9C59001083A884
SHA-256:	C0E625B2FC0F9C87BAAB7ED38FB5CEB2A44A8571CCD4D965B17589B7D9542D28
SHA-512:	EFA5D2552F4AB487E5FB7DB4714419F78F91BA308B563D117BD363F167F2FFBA7E349C749DE9773AE949EC83F48CBF38E55AB643CAE3355D590A085174ECB4C7
Malicious:	false
Reputation:	low
Preview:	1721872249513

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.970077794206971
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	LisectAVT_2403002A_224.exe
File size:	2'340'360 bytes
MD5:	cc4a3a36d266e313523feb9146c56df6
SHA1:	094ef8de8465d13ea82a0f9daf13474f4f11bc17
SHA256:	721a20928239475312d70ee30d402768348d81e72f67363a92e34ed087a545e7
SHA512:	32c83ba930b1d6b3d88f4306f28acf0303694d6f995574d5b7201855fb3f5e275c3cd47408959ab2c70259fe4595f2ac2774fcc95f311dfbc30d64a872a968bd
SSDEEP:	49152:AB0vmtT5qmRdVuL9rNM9xz4mA6JMk1Y0/GiII:A2WYmRdVuLRNIfMk14I
TLSH:	5CB5330D5D48F730DD702F723ECA824B2E9C7A5956F4189E84DEBF2B720E25A431A5B4
File Content Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$......."...f.{Tf.{Tf.{T-.xUk.{T-.~U..{T-.\|Ug.{T)..Tb.{T)..Ut.{T).xUq.{T).~U3.{T-..U..{T-.}Ug.{T-.zU}.{Tf.zT@.{T..rUz.{T..{Ug.{T...Tg.{

File Icon


Icon Hash:	c769eccc64f6e2bb

Static PE Info

General

Entrypoint:	0x9ab000
Entrypoint Section:	qbcnvswu
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x65FE94C6 [Sat Mar 23 08:37:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
push esi
mov esi, esp
add esi, 00000004h
sub esi, 04h
push esi
push dword ptr [esp+04h]
pop esi
pop dword ptr [esp]
pop esp
mov dword ptr [esp], esi
push ecx
mov dword ptr [esp], 0A515175h
mov dword ptr [esp], ecx
mov dword ptr [esp], eax
sub esp, 00000004h
mov dword ptr [esp], edi
mov dword ptr [esp], edx
mov dword ptr [esp], ebx
call 00007F59E1453176h
int3
push dword ptr [esp]
mov eax, dword ptr [esp]
add esp, 04h
add esp, 04h
push eax
push dword ptr [esp]
pop ebx
add esp, 00000004h
push 3651A27Bh
mov dword ptr [esp], esi
mov esi, FFFFFFFFh
sub eax, esi
pop esi
push edi
push ebx
mov ebx, 7FDE0622h
neg ebx
or ebx, 798B12DAh
xor ebx, 7D4D9C37h
dec ebx
add ebx, 79FE9FDBh
xor ebx, FEFF97C3h
mov edi, ebx
pop ebx
sub eax, edi
mov edi, dword ptr [esp]
add esp, 04h
sub eax, 0DBC003Ch
add eax, 0DBC0000h
cmp byte ptr [ebx], FFFFFFCCh
jne 00007F59E145321Ch
push eax
mov ah, 00h
mov byte ptr [ebx], ah
push dword ptr [esp]
pop eax
add esp, 00000004h
push ebp
mov dword ptr [esp], edx
mov edx, 1E1FCE60h
and edx, 7EFBDAAEh
add edx, 3BDF2EE1h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x5a8164	0x4c	eyjsffgc
IMAGE_DIRECTORY_ENTRY_IMPORT	0x13b055	0x69	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x138000	0x2b58	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x13b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x137000	0x90600	e4e8fb48afd6339971ccb7f0ed7c224d	False	0.9991950757575757	data	7.988529889235953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x138000	0x2b58	0xc00	0dbc2e0ce54dde3b48359016fe487dbf	False	0.8388671875	data	7.028331503308207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x13b000	0x1000	0x200	745dea56938759dccaf9e183aa01b020	False	0.146484375	data	0.998472215956371	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x13c000	0x2c6000	0x200	f499450209318211941570717674635e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
eyjsffgc	0x402000	0x1a9000	0x1a8c00	743ce54a4e665c4336381ba8d8da7323	False	0.9903292147954679	data	7.951534972159276	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qbcnvswu	0x5ab000	0x1000	0x400	df3793edc675569036291f9ef32eb10e	False	0.8330078125	data	6.394279404898658	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x5a81b0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Russian	Russia	0.1892116182572614
RT_GROUP_ICON	0x5aa758	0x14	data	Russian	Russia	1.15
RT_VERSION	0x5aa76c	0x2e4	data	Russian	Russia	0.4689189189189189
RT_MANIFEST	0x5aaa50	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Exports

Name	Ordinal	Address
Start	1	0x466e80

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-25T02:46:49.373342+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49731	58709	192.168.2.4	193.233.132.74
2024-07-25T02:46:46.402445+0200	TCP	2049060	ET MALWARE RisePro TCP Heartbeat Packet	49731	58709	192.168.2.4	193.233.132.74
2024-07-25T02:46:49.373471+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49732	58709	192.168.2.4	193.233.132.74
2024-07-25T02:46:39.895152+0200	TCP	2049060	ET MALWARE RisePro TCP Heartbeat Packet	49730	58709	192.168.2.4	193.233.132.74
2024-07-25T02:47:04.634108+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49740	58709	192.168.2.4	193.233.132.74
2024-07-25T02:46:57.571611+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49734	58709	192.168.2.4	193.233.132.74
2024-07-25T02:46:56.137355+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49733	20.114.59.183	192.168.2.4
2024-07-25T02:47:34.333582+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49741	20.114.59.183	192.168.2.4
2024-07-25T02:46:42.884945+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49730	58709	192.168.2.4	193.233.132.74

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 02:46:39.871575117 CEST	49730	58709	192.168.2.4	193.233.132.74
Jul 25, 2024 02:46:39.877028942 CEST	58709	49730	193.233.132.74	192.168.2.4
Jul 25, 2024 02:46:39.877276897 CEST	49730	58709	192.168.2.4	193.233.132.74
Jul 25, 2024 02:46:39.895152092 CEST	49730	58709	192.168.2.4	193.233.132.74
Jul 25, 2024 02:46:39.900207996 CEST	58709	49730	193.233.132.74	192.168.2.4
Jul 25, 2024 02:46:42.884944916 CEST	49730	58709	192.168.2.4	193.233.132.74
Jul 25, 2024 02:46:42.889842033 CEST	58709	49730	193.233.132.74	192.168.2.4
Jul 25, 2024 02:46:46.374893904 CEST	49731	58709	192.168.2.4	193.233.132.74
Jul 25, 2024 02:46:46.376255989 CEST	49732	58709	192.168.2.4	193.233.132.74
Jul 25, 2024 02:46:46.380253077 CEST	58709	49731	193.233.132.74	192.168.2.4
Jul 25, 2024 02:46:46.380354881 CEST	49731	58709	192.168.2.4	193.233.132.74
Jul 25, 2024 02:46:46.381270885 CEST	58709	49732	193.233.132.74	192.168.2.4
Jul 25, 2024 02:46:46.381337881 CEST	49732	58709	192.168.2.4	193.233.132.74
Jul 25, 2024 02:46:46.402445078 CEST	49731	58709	192.168.2.4	193.233.132.74
Jul 25, 2024 02:46:46.403275967 CEST	49732	58709	192.168.2.4	193.233.132.74
Jul 25, 2024 02:46:46.407592058 CEST	58709	49731	193.233.132.74	192.168.2.4
Jul 25, 2024 02:46:46.408183098 CEST	58709	49732	193.233.132.74	192.168.2.4
Jul 25, 2024 02:46:49.373342037 CEST	49731	58709	192.168.2.4	193.233.132.74
Jul 25, 2024 02:46:49.373471022 CEST	49732	58709	192.168.2.4	193.233.132.74
Jul 25, 2024 02:46:49.378490925 CEST	58709	49731	193.233.132.74	192.168.2.4
Jul 25, 2024 02:46:49.378561020 CEST	58709	49732	193.233.132.74	192.168.2.4
Jul 25, 2024 02:46:54.580554962 CEST	49734	58709	192.168.2.4	193.233.132.74
Jul 25, 2024 02:46:54.585618973 CEST	58709	49734	193.233.132.74	192.168.2.4
Jul 25, 2024 02:46:54.587141037 CEST	49734	58709	192.168.2.4	193.233.132.74
Jul 25, 2024 02:46:54.620657921 CEST	49734	58709	192.168.2.4	193.233.132.74
Jul 25, 2024 02:46:54.625835896 CEST	58709	49734	193.233.132.74	192.168.2.4
Jul 25, 2024 02:46:57.571610928 CEST	49734	58709	192.168.2.4	193.233.132.74
Jul 25, 2024 02:46:57.576564074 CEST	58709	49734	193.233.132.74	192.168.2.4
Jul 25, 2024 02:47:01.256742954 CEST	58709	49730	193.233.132.74	192.168.2.4
Jul 25, 2024 02:47:01.258691072 CEST	49730	58709	192.168.2.4	193.233.132.74
Jul 25, 2024 02:47:01.634232998 CEST	49740	58709	192.168.2.4	193.233.132.74
Jul 25, 2024 02:47:01.639583111 CEST	58709	49740	193.233.132.74	192.168.2.4
Jul 25, 2024 02:47:01.642580986 CEST	49740	58709	192.168.2.4	193.233.132.74
Jul 25, 2024 02:47:01.691051960 CEST	49740	58709	192.168.2.4	193.233.132.74
Jul 25, 2024 02:47:01.696101904 CEST	58709	49740	193.233.132.74	192.168.2.4
Jul 25, 2024 02:47:04.634108067 CEST	49740	58709	192.168.2.4	193.233.132.74
Jul 25, 2024 02:47:04.639174938 CEST	58709	49740	193.233.132.74	192.168.2.4
Jul 25, 2024 02:47:07.740628958 CEST	58709	49731	193.233.132.74	192.168.2.4
Jul 25, 2024 02:47:07.740923882 CEST	49731	58709	192.168.2.4	193.233.132.74
Jul 25, 2024 02:47:07.777354002 CEST	58709	49732	193.233.132.74	192.168.2.4
Jul 25, 2024 02:47:07.777483940 CEST	49732	58709	192.168.2.4	193.233.132.74
Jul 25, 2024 02:47:15.980272055 CEST	58709	49734	193.233.132.74	192.168.2.4
Jul 25, 2024 02:47:15.980384111 CEST	49734	58709	192.168.2.4	193.233.132.74
Jul 25, 2024 02:47:23.049293995 CEST	58709	49740	193.233.132.74	192.168.2.4
Jul 25, 2024 02:47:23.049433947 CEST	49740	58709	192.168.2.4	193.233.132.74

Target ID:	0
Start time:	20:46:35
Start date:	24/07/2024
Path:	C:\Users\user\Desktop\LisectAVT_2403002A_224.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LisectAVT_2403002A_224.exe"
Imagebase:	0x170000
File size:	2'340'360 bytes
MD5 hash:	CC4A3A36D266E313523FEB9146C56DF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000003.1673549400.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	20:46:39
Start date:	24/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0xf40000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:46:39
Start date:	24/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:46:39
Start date:	24/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0xf40000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:46:39
Start date:	24/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:46:41
Start date:	24/07/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0xa70000
File size:	2'340'360 bytes
MD5 hash:	CC4A3A36D266E313523FEB9146C56DF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000005.00000003.1734673045.0000000005330000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 67%, ReversingLabs Detection: 64%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	20:46:41
Start date:	24/07/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0xa70000
File size:	2'340'360 bytes
MD5 hash:	CC4A3A36D266E313523FEB9146C56DF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000006.00000003.1735290637.0000000005330000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	20:46:50
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x220000
File size:	2'340'360 bytes
MD5 hash:	CC4A3A36D266E313523FEB9146C56DF6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000003.1822511495.0000000004960000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 67%, ReversingLabs Detection: 64%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:46:58
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x220000
File size:	2'340'360 bytes
MD5 hash:	CC4A3A36D266E313523FEB9146C56DF6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000009.00000003.1904982936.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	1.2%
Signature Coverage:	4.3%
Total number of Nodes:	346
Total number of Limit Nodes:	55

Executed Functions

Function 0018E0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 0018E0CB
socket.WS2_32(?,?,?), ref: 0018E17E
connect.WS2_32(00000000,?,?), ref: 0018E193
closesocket.WS2_32(00000000), ref: 0018E19E

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: 657fcc9e98be9b49f5c66028d3d63b9d9e5b4ea06c4cfb8fe6e2be3874e40468
Instruction ID: 5df7e433156236e2eb21428d8c6452dce4226bfae1e57274167c736eeaa6d5cf
Opcode Fuzzy Hash: 657fcc9e98be9b49f5c66028d3d63b9d9e5b4ea06c4cfb8fe6e2be3874e40468
Instruction Fuzzy Hash: D531C4716053106BE7209F25CC48B2BB7E4EBC5734F104F1DF9A8A32D0D3359A048BA2

Function 001D3A40 Relevance: 2.7, APIs: 2, Instructions: 157
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E9,?,00000001,00000000,?,?,?,?,?,?,?,?,001D3DB6), ref: 001D3B08
Sleep.KERNELBASE(00000001,?,00000001,00000000,?,?,?,?,?,?,?,?,001D3DB6), ref: 001D3BBA

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 8519f31472b6e77d94ceb112f4794907bf09318eb7480644ecf1fa16e423593a
Instruction ID: af0e0cf718e63c7d9cd167aa42a64d54f53ee4b87ac57f817939a01d8fcb7224
Opcode Fuzzy Hash: 8519f31472b6e77d94ceb112f4794907bf09318eb7480644ecf1fa16e423593a
Instruction Fuzzy Hash: 8351C935B042198FCB28CF58C8D0EAAB3B1FF45704B29859AD465AF352D731EE45CB91

Function 04CD0906 Relevance: 1.7, APIs: 1, Instructions: 217COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04CD0911

Memory Dump Source

Source File: 00000000.00000002.4119394949.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cd0000_LisectAVT_2403002A_224.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: ac682e00ef806454b976c4e852014cde66bbbff9e530be5a630597deeeb6c9d9
Instruction ID: b578e010e373df1b13ff8f91ec75718d69614ddf982ced4268fadb99b85f8cbd
Opcode Fuzzy Hash: ac682e00ef806454b976c4e852014cde66bbbff9e530be5a630597deeeb6c9d9
Instruction Fuzzy Hash: D241D3EB70D122BD7152D14B2B51AFB666FE6D6338B388437F60BC6106F2946A497031

Function 04CD078E Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 305
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

aa, xrefs: 04CD079D

Memory Dump Source

Source File: 00000000.00000002.4119394949.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cd0000_LisectAVT_2403002A_224.jbxd

Similarity

API ID: CurrentProfile
String ID: aa
API String ID: 2104809126-2759896527
Opcode ID: a61336ee737fbfcd5099e2459e149da119202ebbb8570e7db62eb9bad04104ad
Instruction ID: 12ddd4f9305c91d0fe81a572dfd9a2a709fec7f3047ecdd71140e249558acc6b
Opcode Fuzzy Hash: a61336ee737fbfcd5099e2459e149da119202ebbb8570e7db62eb9bad04104ad
Instruction Fuzzy Hash: A551E5EB70C211BDB202814B1B51AF7666FF7D6738F388436B60BD7202F2946A897131

Function 00254942 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

O%, xrefs: 00254A93, 00254A61, 00254AAB, 00254AC7

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID:
String ID: O%
API String ID: 0-3459504969
Opcode ID: eac49679473a12323e4e6accac1d17bc4948db6711504755ae559044b4c65548
Instruction ID: 95f303a785629387816874eed0340393e2134e6845bceb232729c80f4cf7bd96
Opcode Fuzzy Hash: eac49679473a12323e4e6accac1d17bc4948db6711504755ae559044b4c65548
Instruction Fuzzy Hash: 94511830A10108AFCF14EF58CC55AAAFBB1EF45328F248158FC495B252D3719EA5CB98

Function 00264623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffff077c7b799185c501543a818426cd8feab98400f9bdb319c562f3d65f712c
Instruction ID: 07dc3c6a69dfe1b4342b78b6f75162e3ecaab808c4b3cbb93d035db5584a9608
Opcode Fuzzy Hash: ffff077c7b799185c501543a818426cd8feab98400f9bdb319c562f3d65f712c
Instruction Fuzzy Hash: CFB14870E24246AFDB11FFA8D840BAEBBB2AF46314F144159E894A7382C7709DA1CF50

Function 04CD06F3 Relevance: 1.9, APIs: 1, Instructions: 354
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4119394949.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cd0000_LisectAVT_2403002A_224.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 2f5b861f69fce8852913fd3b40c49510517c076939c96955d439af99c683e57b
Instruction ID: 259f31485ea1e6ac2ef6270c052a76b43740becd9ecc4b89ea4d66a25a008ab3
Opcode Fuzzy Hash: 2f5b861f69fce8852913fd3b40c49510517c076939c96955d439af99c683e57b
Instruction Fuzzy Hash: 687106EB74C211BDB202814B1B94AF66A6FF6D7738F388436F607D6102F2846E897171

Function 04CD06E6 Relevance: 1.8, APIs: 1, Instructions: 344
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4119394949.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cd0000_LisectAVT_2403002A_224.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 31da4399d6259fc1af9f5a56f034bb2c36caa353d4c0f01cdb2cdf66453ba122
Instruction ID: 634ba24735ecb87c74e3eac34ee38f1fc27da3086fb38e209643194d78d1af4c
Opcode Fuzzy Hash: 31da4399d6259fc1af9f5a56f034bb2c36caa353d4c0f01cdb2cdf66453ba122
Instruction Fuzzy Hash: 9A61E4EB74C211BDB242814F1B94AF7666FF6D7738F388436B607D6206F2946A897031

Function 04CD0738 Relevance: 1.8, APIs: 1, Instructions: 339
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4119394949.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cd0000_LisectAVT_2403002A_224.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5247cc31b65fc26430b189b48fa16ae7eb8164673ed7ab6eb31d5eecb74b078e
Instruction ID: cce67d5ae5849c832dca4a4356a8ef4ca24ea6435f668f3fd9f97b5a8d618787
Opcode Fuzzy Hash: 5247cc31b65fc26430b189b48fa16ae7eb8164673ed7ab6eb31d5eecb74b078e
Instruction Fuzzy Hash: 546103EB74C211BDB252818F1B94AF6666FF6D7338F388436F607D6206F2946A497031

Function 04CD071E Relevance: 1.8, APIs: 1, Instructions: 335
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4119394949.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cd0000_LisectAVT_2403002A_224.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 0063380f97e4762c1d40cd3e292497ec93eeebf35c077e12b04e73ab6bccb046
Instruction ID: e535f171099180854ccf256b0c6d7973494848ab64234a62c29403658f0e9e2a
Opcode Fuzzy Hash: 0063380f97e4762c1d40cd3e292497ec93eeebf35c077e12b04e73ab6bccb046
Instruction Fuzzy Hash: C461F5EB74C211BDB242814F1B94AF6666FF6D7738F388436B607D6106F2C46A497131

Function 04CD075B Relevance: 1.8, APIs: 1, Instructions: 315
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4119394949.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cd0000_LisectAVT_2403002A_224.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: f5824348039bc199e79af5d00dde8bc797c8a965294096dd5ca73241834c28c1
Instruction ID: 32b37448f1bad78862666de6c9cbeb98a185a2e386685e7129694bc20b22bd53
Opcode Fuzzy Hash: f5824348039bc199e79af5d00dde8bc797c8a965294096dd5ca73241834c28c1
Instruction Fuzzy Hash: 4A51F7EB70C211BDB202914F1B94AF7666FF6D7738F388436B607D6206F2946A497131

Function 04CD076E Relevance: 1.8, APIs: 1, Instructions: 311
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4119394949.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cd0000_LisectAVT_2403002A_224.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: e38c685b54df00549ace43185ea3a05e28c4da0e34b93fbf99b7ccf884116fec
Instruction ID: ddd0451dbefddb1f06a86eafa0b84d59e2114222552ba22979188ad0d9e21088
Opcode Fuzzy Hash: e38c685b54df00549ace43185ea3a05e28c4da0e34b93fbf99b7ccf884116fec
Instruction Fuzzy Hash: FD5106EB74C211BDB202814F1B54AF7666FF6D7738F388436B60BD6206F2946A897131

Function 04CD0804 Relevance: 1.8, APIs: 1, Instructions: 304
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04CD0911

Memory Dump Source

Source File: 00000000.00000002.4119394949.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cd0000_LisectAVT_2403002A_224.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: f2746491717cb9135ae0c305327e0e3d728240d2ef755e713076c022cfe84f7a
Instruction ID: a35ea6594c13efcae6452b092ec3c9fc51a993c9360207ce3da095c902dd6404
Opcode Fuzzy Hash: f2746491717cb9135ae0c305327e0e3d728240d2ef755e713076c022cfe84f7a
Instruction Fuzzy Hash: 295127EB70D211BDB202804F1B90AF6676FE6D6738F388037B707C6202F2946A897171

Function 04CD07BB Relevance: 1.8, APIs: 1, Instructions: 302
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04CD0911

Memory Dump Source

Source File: 00000000.00000002.4119394949.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cd0000_LisectAVT_2403002A_224.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: daa4e1f2b39fe127431982be38dc42adaaa999bc14f382ab2f1cfe62a3f26485
Instruction ID: c4ec28e0e4c883f6c9e97ed6b4235aecdadd3ee8d6d8ab6a746cc4abfa91f087
Opcode Fuzzy Hash: daa4e1f2b39fe127431982be38dc42adaaa999bc14f382ab2f1cfe62a3f26485
Instruction Fuzzy Hash: 1051F7EB70D111BDB242814B1B90AF6676FE6D6738F388476B607C6206F2946A497131

Function 04CD082D Relevance: 1.8, APIs: 1, Instructions: 300
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04CD0911

Memory Dump Source

Source File: 00000000.00000002.4119394949.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cd0000_LisectAVT_2403002A_224.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 6907d4c84a6f612ffe3d188c63bd2c6050954ebf9f611c91931ff3ac90772444
Instruction ID: ad4f373e6c3521eb40561ed2d215368270eaca6fdb5361359b02bc7e1efd9dec
Opcode Fuzzy Hash: 6907d4c84a6f612ffe3d188c63bd2c6050954ebf9f611c91931ff3ac90772444
Instruction Fuzzy Hash: 8351F6EB70C111BDB642814F5B90AF6676FE7D6338F388476B607C6206F2946A8A7131

Function 04CD07D3 Relevance: 1.8, APIs: 1, Instructions: 297
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04CD0911

Memory Dump Source

Source File: 00000000.00000002.4119394949.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cd0000_LisectAVT_2403002A_224.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: ba2756729f5f08736e9a4fe9c1cdd8925f57ab40d755ab32474bf16c9dfecb56
Instruction ID: 0212acb21016c5bd86bdbb654f1fc0ca45599af4c2cebdb2e64188676ba0d4bd
Opcode Fuzzy Hash: ba2756729f5f08736e9a4fe9c1cdd8925f57ab40d755ab32474bf16c9dfecb56
Instruction Fuzzy Hash: 4451F7EB70C211BDB242814F1B51AF6676FE7D6738F388076B607C7202F2946A4A7171

Function 04CD07AB Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4119394949.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cd0000_LisectAVT_2403002A_224.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: d25dccae9393793cf193bf937396a3a864177ee970e97f9c5c08ed9b822cf94c
Instruction ID: a60e626440bd1b095f8a7a8fb998bd3e47c448a450be527895d9dc6a4d6f7a11
Opcode Fuzzy Hash: d25dccae9393793cf193bf937396a3a864177ee970e97f9c5c08ed9b822cf94c
Instruction Fuzzy Hash: 7251F6EB70C211BDB242804F1B90AF6666FE6D6738F388436B707D6206F2946A897131

Function 04CD0854 Relevance: 1.8, APIs: 1, Instructions: 287COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04CD0911

Memory Dump Source

Source File: 00000000.00000002.4119394949.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cd0000_LisectAVT_2403002A_224.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: a20083381074a932e2bf9aa9980583afa1645b04557ddce9f75e8838467f0412
Instruction ID: 4b62e4d0ede624742ee9b0a0ba39cb8bd9ad2dc4f983a598c7133d4a9ee3d240
Opcode Fuzzy Hash: a20083381074a932e2bf9aa9980583afa1645b04557ddce9f75e8838467f0412
Instruction Fuzzy Hash: 2C5136EB70D221BDB202815B1B51AFA676FEAD7338F388476F607C7506F2846A497131

Function 04CD081B Relevance: 1.8, APIs: 1, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4119394949.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cd0000_LisectAVT_2403002A_224.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 9a751d2099c2f037a9b35232da6c28a0ebd5eef500e9dcd164eed9da549f6ccc
Instruction ID: 306abdff13aed3d1c0134c3e11c016053acb5380a0b3efb407d00abbce76edb2
Opcode Fuzzy Hash: 9a751d2099c2f037a9b35232da6c28a0ebd5eef500e9dcd164eed9da549f6ccc
Instruction Fuzzy Hash: FE51E5EB70C211BDB102904B1B50AFB666FE6D6738F388436B60BD7206F2946E497131

Function 04CD08A4 Relevance: 1.8, APIs: 1, Instructions: 263COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04CD0911

Memory Dump Source

Source File: 00000000.00000002.4119394949.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cd0000_LisectAVT_2403002A_224.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 04d8dbb062490617da6ed968c9e6ab8e432b1a1979d162f37aad96b8b18b9976
Instruction ID: c712668c9a7f194e622f7d0f332a53302a7ab762c49750df4279769b86e9ae2d
Opcode Fuzzy Hash: 04d8dbb062490617da6ed968c9e6ab8e432b1a1979d162f37aad96b8b18b9976
Instruction Fuzzy Hash: 415105EB70D121BDB112914F2B50AFB666FE6D6338B388437B64BC6106F2846A497131

Function 04CD08DA Relevance: 1.7, APIs: 1, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4119394949.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cd0000_LisectAVT_2403002A_224.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: c569d8b77b3652d7d58122a816af3cb34bbac22fe89e057dc3ae6ab0f8f4d9e9
Instruction ID: 94751a602ecb8dc61e3eb30b6d916b2187ba1265057e1eb7f79498d967b5a077
Opcode Fuzzy Hash: c569d8b77b3652d7d58122a816af3cb34bbac22fe89e057dc3ae6ab0f8f4d9e9
Instruction Fuzzy Hash: 1F41F2EB70D121BD7112D14B2B51AFB666FE6D6338B38843BF60BC6106F2946E497031

Function 0017A210 Relevance: 1.7, APIs: 1, Instructions: 231COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 0017A343

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: d32ab36099e89df1452dc2434c7164bed3cd1e10676749dd735e4d4da1560085
Instruction ID: 877f361a1d1d695c51aa29542b1116064417f97d63cf45d21bdde2282e8272ba
Opcode Fuzzy Hash: d32ab36099e89df1452dc2434c7164bed3cd1e10676749dd735e4d4da1560085
Instruction Fuzzy Hash: 6D715971910204AFDB18DF68CC46BAEBBF8EF81704F50C56DF8099B282D7B59945CB92

Function 04CD08EA Relevance: 1.7, APIs: 1, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4119394949.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cd0000_LisectAVT_2403002A_224.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: e7595d1abaeca384df3b6da25715057467d2588c45ec2b5df9e875857cbeddc0
Instruction ID: 386d8b1d29819b060cb02189f6366cc8cc53b9dede4d5d6996602be71ada6ba8
Opcode Fuzzy Hash: e7595d1abaeca384df3b6da25715057467d2588c45ec2b5df9e875857cbeddc0
Instruction Fuzzy Hash: 8541F3EB70D121BD7112D14B2B519FB676FE6D6738B38843BF60BC6106F2946A496031

Function 0026549C Relevance: 1.7, APIs: 1, Instructions: 198fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000000,00259087,?,00000000,00000000,00000000,?,00000000,?,0017A3EB,00259087,00000000,0017A3EB,?,?), ref: 00265621

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: cde942d1942a3cc5e770d261b3c4909ce9310cd24ab3c2f96916a5f3540057cd
Instruction ID: 7980bd705e5a196cd841fdc971b404e0548be06cb1e50ac24b8a4ed1ade2ce98
Opcode Fuzzy Hash: cde942d1942a3cc5e770d261b3c4909ce9310cd24ab3c2f96916a5f3540057cd
Instruction Fuzzy Hash: E761D871D2052AAFDF11DFA8C848EEEBFBAEF09304F540185E805A7255D771D9A1CBA0

Function 001E0560 Relevance: 1.6, APIs: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 001E06AE

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction ID: 8f7ae79ddb7cf7c899d83e8a560e5750676ac085d935f767886fc3978d3bffa4
Opcode Fuzzy Hash: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction Fuzzy Hash: 4041F672A005549BCB16EF69DD8066EBBA5EF8C310F150169FC05DB302D770DDA18BE1

Function 00264B12 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,002649F9,00000000,CF830579,002A1140,0000000C,00264AB5,00258BBD,?), ref: 00264B68

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: eb81faaa81da7a148cfe68ba981c35b219a9c86e4e1fd78eb622bef0051987ae
Instruction ID: 86dda41ff3ce2b70175b00972d18c13fcd6d6803c2b2e5864adefa5aaceb8a0d
Opcode Fuzzy Hash: eb81faaa81da7a148cfe68ba981c35b219a9c86e4e1fd78eb622bef0051987ae
Instruction Fuzzy Hash: 22116B33E7111416DB243A75E845B7EA74ECB8377CF390249F8589B0C2EE60DCE14995

Function 0025E05C Relevance: 1.6, APIs: 1, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,002A0DF8,0017A3EB,00000002,0017A3EB,00000000,?,?,?,0025E166,00000000,?,0017A3EB,00000002,002A0DF8), ref: 0025E098

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 0650b28ace0548cbe31d09ca7afb639b3c66932401f26e1972d49ca66016b422
Instruction ID: a2dd52c867fbfb92236b7846b4a47394218bed3c968642c4bfde9abe50059c0b
Opcode Fuzzy Hash: 0650b28ace0548cbe31d09ca7afb639b3c66932401f26e1972d49ca66016b422
Instruction Fuzzy Hash: D4012B32624115AFCF199F55CC05C9E3B2ADB81334F250148FC50A71D1E6B1EE558BD0

Function 0024F290 Relevance: 1.6, APIs: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0017220E

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 57e3a21e3014e9654acea49b4cfd9e7732b387955d27f9aaf0b917f7d714f14a
Instruction ID: f6faad1ab675c48772a9b69d62313343db23d54598796ae5dae912bc9dfde539
Opcode Fuzzy Hash: 57e3a21e3014e9654acea49b4cfd9e7732b387955d27f9aaf0b917f7d714f14a
Instruction Fuzzy Hash: 7F01DB7551430DABCB18EFA8EC0295977ACDA00320B54843AFE1DDB591EB70E9748B95

Function 002663F3 Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,002591F7,00000000,?,00265D79,00000001,00000364,00000000,00000006,000000FF,?,00000000,0025D244,002589C3,002591F7,00000000), ref: 00266434

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0a3b53a882c9a553f91e6e25f5391ab29d332217c7a4042bfb04a8103cd3a151
Instruction ID: 2db50934df840829e1b9254ec917dfd8bdf762897247fda9480253db12fba835
Opcode Fuzzy Hash: 0a3b53a882c9a553f91e6e25f5391ab29d332217c7a4042bfb04a8103cd3a151
Instruction Fuzzy Hash: BCF0E23253512566DB31AF62DC0AB5B7B8CEF81B60F298021AC08A64C0CF30ECB14AF1

Function 00266E2D Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0026D635,4D88C033,?,0026D635,00000220,?,002657EF,4D88C033), ref: 00266E5F

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7cec77ec7f2f0bf63b20622b0e2d38d46dd03cd27e39ef082f8bef5bc8c8a4b8
Instruction ID: 6af6fd3868922b8aab586b8a73feeaac3309e58f12eaf8cee80f3271aac77415
Opcode Fuzzy Hash: 7cec77ec7f2f0bf63b20622b0e2d38d46dd03cd27e39ef082f8bef5bc8c8a4b8
Instruction Fuzzy Hash: 3FE02B3957551266DB313E66DC09F5B764C8F417B0F250120FC04D24D1CF63CCB085A8

Function 04CE0000 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4119442932.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_LisectAVT_2403002A_224.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 606357a0ce67b1f2469b3bd31c086e45bf1aa721fa92c4d911dc5e3ada75285f
Instruction ID: 58252b52efa71627cd16d6672c82c4e3336b298fa6ea19391303b0b9ea0e74dd
Opcode Fuzzy Hash: 606357a0ce67b1f2469b3bd31c086e45bf1aa721fa92c4d911dc5e3ada75285f
Instruction Fuzzy Hash: 64215EEF24C230BD604294576B15AF76B6FE2D77303388526F847D9542E3DA1A8A31B2

Function 04CE0019 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4119442932.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_LisectAVT_2403002A_224.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f613d3330bd93d491170a4c7649585c78a04996ab8b68de19679625243054b
Instruction ID: f6ce8e683689f0066975ec7804351cc04b1ee7b4d2d8abb26143eaa2e1b9878c
Opcode Fuzzy Hash: e1f613d3330bd93d491170a4c7649585c78a04996ab8b68de19679625243054b
Instruction Fuzzy Hash: E12193EF24C230BD604254576B15AF66B6FE2D77303348526F447D5942E3DA1A8E31B2

Function 04CE0091 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4119442932.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_LisectAVT_2403002A_224.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e5590e438e29c271e39f51c15f30f325ad80123df753824ea8425961530e33d
Instruction ID: a21ad29e5f1e2c09a6545bb56c0c40938f8140e9ef0decfeca962ba6dae52809
Opcode Fuzzy Hash: 6e5590e438e29c271e39f51c15f30f325ad80123df753824ea8425961530e33d
Instruction Fuzzy Hash: B011E1EF20C230BD604258576B15AF66B6FE2D77303388516F407C9A41F3EA1B8A31B1

Function 04CE0043 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4119442932.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_LisectAVT_2403002A_224.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2b3cbbbeee1fdea5ed64717d311bf3374da752c18daa86b6f323146cd79762e
Instruction ID: 0d2c81b9dbe069e869b3acea1a7edf0eb5845753ead14360e757909817470605
Opcode Fuzzy Hash: a2b3cbbbeee1fdea5ed64717d311bf3374da752c18daa86b6f323146cd79762e
Instruction Fuzzy Hash: 45115CEB20C270BEA14245575B15AF67B7FE6D33303388156F443C9541E3DA1A4D72B2

Function 04CE006A Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4119442932.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_LisectAVT_2403002A_224.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74dce76d552d4ea6d6bf5e955f3022f1048db1e92a135d8aa344c44a69f90b93
Instruction ID: fb6c47b2e0b80a3cbdbe20eb9b73719fd3627b3262a93433b614095e6ded25d4
Opcode Fuzzy Hash: 74dce76d552d4ea6d6bf5e955f3022f1048db1e92a135d8aa344c44a69f90b93
Instruction Fuzzy Hash: 0611A5EF20C230BD654245576B15AF76B7FE2D63303358226F453D8682E3DA1B8A71B1

Function 04CE00BC Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4119442932.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_LisectAVT_2403002A_224.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dd53a2ee16d28117ebd288356cf8aa87bb04124e2298e8990e5578c6079ae94
Instruction ID: 75c76f55c74bf5e2276e6ac612b48388333bccdd98ad44c58ca491d7c99de24d
Opcode Fuzzy Hash: 0dd53a2ee16d28117ebd288356cf8aa87bb04124e2298e8990e5578c6079ae94
Instruction Fuzzy Hash: 360144AB20C230AD654258639B195F66B2BF3933303388216F443D8981E7DA678A72B1

Function 04CE0137 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4119442932.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_LisectAVT_2403002A_224.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eb08ff77d654e37d42066f0daa31ab31dec23f3a7f4cf10ac2d559f4b3206e0
Instruction ID: a378933ba738812508a3ea01adec3761e7994a99e38197e90d1c1f6b4fe30709
Opcode Fuzzy Hash: 2eb08ff77d654e37d42066f0daa31ab31dec23f3a7f4cf10ac2d559f4b3206e0
Instruction Fuzzy Hash: 9901479F20C270BEA14259635B195B76B7BA6D73303388626F043D8942F7CA274932B2

Function 04CE00AC Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4119442932.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_LisectAVT_2403002A_224.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee6fdbc06f5095cb3db599fb6b8312ca09d98b87c3af89efd1d645af66b5fbf0
Instruction ID: 257eac3e486ec61edf762afa15193442484ea7fbd94782e0b7c8f1c304708cd0
Opcode Fuzzy Hash: ee6fdbc06f5095cb3db599fb6b8312ca09d98b87c3af89efd1d645af66b5fbf0
Instruction Fuzzy Hash: C401F2AF20C230BD604258535B159B76B6BA2D6330338C126F40798541E3DA564932A1

Function 04CE00DD Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4119442932.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_LisectAVT_2403002A_224.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a136111b0d9fe8e8703a6a2c2a753c81c14d8a4f9a5957466848a4a06db376e
Instruction ID: c621579d8bf22cc0d9e552d9a3255673030e11f70af11c90e583ef6c5449f521
Opcode Fuzzy Hash: 0a136111b0d9fe8e8703a6a2c2a753c81c14d8a4f9a5957466848a4a06db376e
Instruction Fuzzy Hash: BE012BBF20C170AE920249535B196F67B3BE6D7330339417AF443CA906E3CA565962B1

Function 04CE0106 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4119442932.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_LisectAVT_2403002A_224.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a5708b82801d35715d4bf4abdc123f67d9d9207760f568bc1d9d1fc6bb91aa5
Instruction ID: 12241703b9636b2ae2cd425a404f677f76fa939739f54614cd8f762ad2daa37d
Opcode Fuzzy Hash: 1a5708b82801d35715d4bf4abdc123f67d9d9207760f568bc1d9d1fc6bb91aa5
Instruction Fuzzy Hash: E4F0B4BF14C221AEA14195936B195B677BBF2D6330775843AF403C9105E3CB2A4A76B1

Function 04CE012A Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4119442932.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_LisectAVT_2403002A_224.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d205beaa656397e3103be5b0b7a73d2f3bb49e97436ef049ba4e402e18683082
Instruction ID: 7a4cf95b10492b9fe3a8a88cc373c0c0419ba3aa226a9bcaabe9e66c890fc4f5
Opcode Fuzzy Hash: d205beaa656397e3103be5b0b7a73d2f3bb49e97436ef049ba4e402e18683082
Instruction Fuzzy Hash: 9DE0E5EF14C131ADA00154936B296F7677BE2D63307B58427F407C9502E3CA168D76B1

Function 04CE015C Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4119442932.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_LisectAVT_2403002A_224.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d5a5095c22c4a4843687220f2f991d96f24299b140201505ca6b2a3b8e6c7fc
Instruction ID: d43c24211dfaa2488696f159673b6ef860dfc5035893da43a1654b72b5f3861d
Opcode Fuzzy Hash: 9d5a5095c22c4a4843687220f2f991d96f24299b140201505ca6b2a3b8e6c7fc
Instruction Fuzzy Hash: D3E026EF04C120AF600190836A289FBA77EE1D6330375C037F083D9106E7CA054E76B0

Non-executed Functions

Function 00189F50 Relevance: 16.1, Strings: 11, Instructions: 2331COMMON

Download Yara Rule

Strings

%s|%s, xrefs: 0018A198
,, xrefs: 0018A6AF
$, xrefs: 0018BD6D
,, xrefs: 0018A5D2
|N*, xrefs: 0018A321
:, xrefs: 0018A097
type must be boolean, but is , xrefs: 0018BF3C, 0018BF6D, 0018C02B
., xrefs: 0018B0E2
., xrefs: 0018AB30
131, xrefs: 0018A178, 0018A17F, 0018A190
|N*, xrefs: 0018A2D3

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID:
String ID: $$%s|%s$,$,$.$.$131$:$type must be boolean, but is $|N*$|N*
API String ID: 0-748053694
Opcode ID: ee4726273ec254a006d56c1cea5e0bbccf850d1b9ab845f289abf311056e3f5d
Instruction ID: a42831404a23340f1f4b14787787c3966dc0b55a7463410410fff5d8c776c657
Opcode Fuzzy Hash: ee4726273ec254a006d56c1cea5e0bbccf850d1b9ab845f289abf311056e3f5d
Instruction Fuzzy Hash: FB23D170D042588FDB29EF68C998BEDBBB4EF05304F148199E449AB392D7319B84CF91

Function 001E73F0 Relevance: 7.9, APIs: 3, Strings: 1, Instructions: 897COMMON

Download Yara Rule

Strings

unordered_map/set too long, xrefs: 001E78C7

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID:
String ID: unordered_map/set too long
API String ID: 0-306623848
Opcode ID: d9ef4b6e485e49e21f8fe024edca36a61f807b92553724ab65da63e25decc71f
Instruction ID: 81120c9ef6a7899a2030ded3e2b3fb7ea14f3b2829c9ad94ca53a62308bda3cc
Opcode Fuzzy Hash: d9ef4b6e485e49e21f8fe024edca36a61f807b92553724ab65da63e25decc71f
Instruction Fuzzy Hash: 9F629171E006499FDB14DFA9C880AADFBF5FF48314F248269E819AB395D730AD51CB80

Function 002584A0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction ID: 7ff3fead07b693b6cce34ec92bf466dcaeede13452b32dd38f86c7a1ea44a446
Opcode Fuzzy Hash: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction Fuzzy Hash: 9B026B71E1121A9BDF14CFA8C8806AEFBF5FF48315F248269D919F7380DB71A9158B84

Function 001E50B0 Relevance: 5.3, Strings: 4, Instructions: 268COMMON

Download Yara Rule

Strings

type must be string, but is , xrefs: 001E5114
/Kim, xrefs: 001E52A9
/Kim, xrefs: 001E52C2
type must be number, but is , xrefs: 001E5241

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID:
String ID: /Kim$/Kim$type must be number, but is $type must be string, but is
API String ID: 0-1144537432
Opcode ID: 3ae7a040992e97fb32d01a497415f5e1eda6708974f67eaab75c285eb619cec3
Instruction ID: 003b070cd5fb1d2cdc3942df13600e81aad4b4fb50ce63f26f120b74c5c96f58
Opcode Fuzzy Hash: 3ae7a040992e97fb32d01a497415f5e1eda6708974f67eaab75c285eb619cec3
Instruction Fuzzy Hash: 32914676E00A099FCB08CF6CD8517DDB7AAEB88314F14826EE919D7391EB759D05CB80

Function 001791A0 Relevance: 4.9, Strings: 3, Instructions: 1146COMMON

Download Yara Rule

Strings

/, xrefs: 001794E2
\, xrefs: 00179528
/\/, xrefs: 0017956A, 0017959C

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID:
String ID: /$/\/$\
API String ID: 0-1523196992
Opcode ID: b98181a38291335a2143f1c50d0d2bc5b6f5ea2e45eee463004d8d15bc6829f9
Instruction ID: 026b85fcf0bc5bd665de28ca1ce4d634fe052ea25e7ed0996f9aea30f572a71c
Opcode Fuzzy Hash: b98181a38291335a2143f1c50d0d2bc5b6f5ea2e45eee463004d8d15bc6829f9
Instruction Fuzzy Hash: B692D671D002588FDF19CFA8C894BEEBBB5FF45314F14826DD449AB282E7315A4ACB91

Function 001724F0 Relevance: 2.7, Strings: 2, Instructions: 221COMMON

Download Yara Rule

Strings

L*, xrefs: 001726B7
L*, xrefs: 001725C7

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID:
String ID: L*$L*
API String ID: 0-893013501
Opcode ID: e424eeacf5d95ce9cac88c7c331a9b67a58546d5aa2059e03271f8f5b5a5cefc
Instruction ID: 9dd70ee2d94a05ce9d4994ec3eac762c8f86ac140a668f3e6b07436f63cacd90
Opcode Fuzzy Hash: e424eeacf5d95ce9cac88c7c331a9b67a58546d5aa2059e03271f8f5b5a5cefc
Instruction Fuzzy Hash: F27115B4E002568FDB14DF68D8D17FEBBB5EB1A310F14826AD85897342C734990BCBA0

Function 00178D70 Relevance: 1.6, Strings: 1, Instructions: 327COMMON

Download Yara Rule

Strings

File, xrefs: 00178F73

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID:
String ID: File
API String ID: 0-749574446
Opcode ID: 7fca3744ca74ab57476613ea6be418318d1e58f5d3ffaaf98df8194134a4552b
Instruction ID: ed0524005b8621d37e52d9efec1bf6909744ee911808626e2483068d0ce3f6e4
Opcode Fuzzy Hash: 7fca3744ca74ab57476613ea6be418318d1e58f5d3ffaaf98df8194134a4552b
Instruction Fuzzy Hash: 32C1B170D102599BEF24DFA4CC85BEEBBB9FF05304F104069E908BB281DB719959CB65

Function 0025BEAF Relevance: 1.5, Strings: 1, Instructions: 293COMMON

Download Yara Rule

Strings

0, xrefs: 0025C01F

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 145e7dad2a8722deca9f99e917323cda82dd81c584b6f3c5f657d09bf677b3f7
Instruction ID: 6dd34e51bb79aeb33f655f887c0e38b7c49c14926d13a6c0c6be122e15e76b37
Opcode Fuzzy Hash: 145e7dad2a8722deca9f99e917323cda82dd81c584b6f3c5f657d09bf677b3f7
Instruction Fuzzy Hash: AAB1D234520B07CFCB25CF68C880A7AB7B1AF05312F244619EC5A97692E731AD6DCF58

Function 0024F26A Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,?,0024EC78,?,?,?,?,001840EB,?,001D3C2E), ref: 0024F283

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: cb29443ac1fbc515cd7c4485468daf3ef1e139263c6966713e82693f2c9e5d68
Instruction ID: 0ab29b55818d36aef78290586b3587134daa059712283b6b1a9923fc520ff110
Opcode Fuzzy Hash: cb29443ac1fbc515cd7c4485468daf3ef1e139263c6966713e82693f2c9e5d68
Instruction Fuzzy Hash: DCD02232A52038978AD93FC1BD088ACBB1C9B8AB503040236EE09631148B916C105BD4

Function 001F9880 Relevance: .7, Instructions: 748COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24bb6029f677f1da32f9d96d4c1866d89451971e321bb15b1834e2c9d6dd1b85
Instruction ID: 9dd6dbd29c95e019b9c851cbfdf66c4db61433d4029bfe13c04b737512cac775
Opcode Fuzzy Hash: 24bb6029f677f1da32f9d96d4c1866d89451971e321bb15b1834e2c9d6dd1b85
Instruction Fuzzy Hash: 206260B0E002099BDB18DF59C5847BDBBF1AF84308F2881ADDA08AB356D735D946CF91

Function 0026F771 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23e19819f1d422d564742bd8597df51f57b8e1aeabff205f884225a356cafa5b
Instruction ID: c07ad4c175613734a86997f216a6657ff821a81f3a45653f87091f927b96cabe
Opcode Fuzzy Hash: 23e19819f1d422d564742bd8597df51f57b8e1aeabff205f884225a356cafa5b
Instruction Fuzzy Hash: 2BB123315207069BDF289F28DD82BBBB3A9EF44308F14457DE987C6680EB75A9D5CB10

Function 00269824 Relevance: .3, Instructions: 270COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 920210460b7f6a2068692c5b301465b8b78ec645a9c57e533a68f770885a9839
Instruction ID: a652a1d824ec685055eb045f6f67b05c0e2d85cb36ba4914cdee7914575989b5
Opcode Fuzzy Hash: 920210460b7f6a2068692c5b301465b8b78ec645a9c57e533a68f770885a9839
Instruction Fuzzy Hash: B6B139316206099FDB15CF28C48AB657BE4FF45364F29865CE899CF2A1CB35E9E1CB40

Function 001F6550 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1f27913ce12cd3992e43b0cd1b35270bb02ae416dbc9cca5a9e784c2a4e906b
Instruction ID: ea053442302a76afa22d25530330eadfe5137120a97b327a279092595176d035
Opcode Fuzzy Hash: d1f27913ce12cd3992e43b0cd1b35270bb02ae416dbc9cca5a9e784c2a4e906b
Instruction Fuzzy Hash: 406130396111644FD719CF6EFCC44363361A78A301387821AEAC1DB2A7D739E926DBA0

Function 001F55B0 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 673d5ff3bb7b0ad53b3e0db9c713919e7ec6c8bbcf1723622c98b7316c990154
Instruction ID: 4aaccf1ec8178444878f54736baa1d4cc5f3190bbd0b2f9dff82b4bc834a16b4
Opcode Fuzzy Hash: 673d5ff3bb7b0ad53b3e0db9c713919e7ec6c8bbcf1723622c98b7316c990154
Instruction Fuzzy Hash: 1D8192B081429C9EDF08CF94D855AFEBFB9EF06304F5080AED851AB651D778530ACB66

Function 00184100 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a84eaef98b6de883feb85383a91bc74a417ce6e1c92125db405d5dcd364aa77
Instruction ID: 49d5d753ed7c525b49b94b7b1ebd268af87e37cde83ca1f3d2691afdb0582a3b
Opcode Fuzzy Hash: 2a84eaef98b6de883feb85383a91bc74a417ce6e1c92125db405d5dcd364aa77
Instruction Fuzzy Hash: DA51AD71E0021A9FCB18EF98D985AEEBBB5FB58310F14456DE815A7341DB30AA44CFA0

Function 0025646A Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 920c44e739ca4d08db5b5969fbc7a5a158caad0a814d8dad7807257cb044add9
Instruction ID: 4b87a8b043cded7aa03e5c1862dc417463e853a197dabcc9ad321c9744c83183
Opcode Fuzzy Hash: 920c44e739ca4d08db5b5969fbc7a5a158caad0a814d8dad7807257cb044add9
Instruction Fuzzy Hash: CD51A172D1011AEFDF14CF98C841AEEBBB2FF88300F898498E815AB201D7349E54DB94

Function 00252CE0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 65f4687cff6ccb89b618acdeed19e302ae6a318481098ba7d1dd3dfead2ba5c3
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 111138B7222083C3D6048E2DC8B46B6A3B5EADB32372C436AC8414B6D8D232D86D9508

Function 001DF810 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 001DF833
std::_Lockit::_Lockit.LIBCPMT ref: 001DF855
std::_Lockit::~_Lockit.LIBCPMT ref: 001DF875
std::_Lockit::~_Lockit.LIBCPMT ref: 001DF89F
std::_Lockit::_Lockit.LIBCPMT ref: 001DF90D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 001DF959
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 001DF973
std::_Lockit::~_Lockit.LIBCPMT ref: 001DFA08
std::_Facet_Register.LIBCPMT ref: 001DFA15

Strings

bad locale name, xrefs: 001DFA2F
"), xrefs: 001DF96B, 001DF972

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$")
API String ID: 3375549084-2947786438
Opcode ID: 4f8d4fdf74b17caefd334e4a17116fa05e97cf7b2bcfb0f599afda7d4bea07ee
Instruction ID: cefe170c61816a2e9ff6c7fc1106fe82092a1eb08032da184cea65d93206a65b
Opcode Fuzzy Hash: 4f8d4fdf74b17caefd334e4a17116fa05e97cf7b2bcfb0f599afda7d4bea07ee
Instruction Fuzzy Hash: EB61A071E10248DFEF24DFA4D845B9EBBB4AF15310F144069E809A7381DB74EA06CB96

Function 00252E10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00252E47
___except_validate_context_record.LIBVCRUNTIME ref: 00252E4F
_ValidateLocalCookies.LIBCMT ref: 00252ED8
__IsNonwritableInCurrentImage.LIBCMT ref: 00252F03
_ValidateLocalCookies.LIBCMT ref: 00252F58

Strings

csm, xrefs: 00252EED
i*, xrefs: 00252F78

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: i*$csm
API String ID: 1170836740-2185108902
Opcode ID: c3ac234793f5d801df8c18f5a10b1a393ba701a84a4f23fddb2aec95687c87cc
Instruction ID: 6394e0621bd7c10b00838264fd011c377e2fec889b7508c718b85410bf4f8f73
Opcode Fuzzy Hash: c3ac234793f5d801df8c18f5a10b1a393ba701a84a4f23fddb2aec95687c87cc
Instruction Fuzzy Hash: 9D41B434A20209DBCF10DF68D885A9EBBB5AF46325F148055EC149B3D2D731EE6DCB94

Function 001DDE70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 001DDE93
std::_Lockit::_Lockit.LIBCPMT ref: 001DDEB6
std::_Lockit::~_Lockit.LIBCPMT ref: 001DDED6
std::_Facet_Register.LIBCPMT ref: 001DDF4B
std::_Lockit::~_Lockit.LIBCPMT ref: 001DDF63
Concurrency::cancel_current_task.LIBCPMT ref: 001DDF7B

Strings

m, xrefs: 001DDEA5, 001DDF5A

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID: m
API String ID: 2081738530-3130793244
Opcode ID: 8edd0447dcd6a03eb36d687726c5b829ade408ec12d31a6a1c0dd77fb15dbaba
Instruction ID: de40bbf53a632084693d5300b3d42d6d3752b5f4da93f42b992fb46b2806f07c
Opcode Fuzzy Hash: 8edd0447dcd6a03eb36d687726c5b829ade408ec12d31a6a1c0dd77fb15dbaba
Instruction Fuzzy Hash: A841F571900215DFCF14DF54E889AAEBBB4FB15710F14426AE815AB392DB30AD12CFD1

Function 001739F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00173A58
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00173AA4
__Getctype.LIBCPMT ref: 00173ABA
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00173AE6
std::_Lockit::~_Lockit.LIBCPMT ref: 00173B7B

Strings

bad locale name, xrefs: 00173B96

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: 43ac77810a00b67d271668b7932f83a298c057d085d4d5146ee34c860a99b265
Instruction ID: d8ae6a6ddf84e605f349839ce6c353a63df9ce8e8062e57e2fb9413cc97c0500
Opcode Fuzzy Hash: 43ac77810a00b67d271668b7932f83a298c057d085d4d5146ee34c860a99b265
Instruction Fuzzy Hash: 415152B1D002089FEF14DFA4D945B8EBBB8BF14310F148069EC09AB381E775DA18CB95

Function 00174C50 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 442COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00174F72
___std_exception_destroy.LIBVCRUNTIME ref: 00174FFF
___std_exception_copy.LIBVCRUNTIME ref: 001750C8

Strings

recursive_directory_iterator::operator++, xrefs: 0017504C

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$___std_exception_copy
String ID: recursive_directory_iterator::operator++
API String ID: 1206660477-953255998
Opcode ID: 4b6f4b2ade5226a2a0990014c078d49e204b6573392429528e390fceb988d98b
Instruction ID: 60240741352f0ce512a85b87fbc119c40de12390e74eb6d692ec1b99eb9a569b
Opcode Fuzzy Hash: 4b6f4b2ade5226a2a0990014c078d49e204b6573392429528e390fceb988d98b
Instruction Fuzzy Hash: 60E104719002049FCB28DF68D845BAEF7F9FF48310F148A2DE45A97781EB74A954CBA1

Function 00177820 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0017799A
___std_exception_copy.LIBVCRUNTIME ref: 00177B75

Strings

out_of_range, xrefs: 00177A27
type_error, xrefs: 0017784A

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: out_of_range$type_error
API String ID: 2659868963-3702451861
Opcode ID: f72ead6823922020a35b493eeb1eecffc1e379d936e321b0f49e9e872227685b
Instruction ID: a1657cb37dd4540864982d9b565fe488a9ef008c0add958e6d60a6513131df9e
Opcode Fuzzy Hash: f72ead6823922020a35b493eeb1eecffc1e379d936e321b0f49e9e872227685b
Instruction Fuzzy Hash: 86C166B19002089FDB08DFA8D984B9DFBF5FF48310F14866AE419EB782E7749984CB54

Function 00172270 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 218COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00172275

Part of subcall function 0024D6E9: std::invalid_argument::invalid_argument.LIBCONCRT ref: 0024D6F5

Strings

string too long, xrefs: 00172270
L*, xrefs: 00172427
L*, xrefs: 00172347

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: string too long$L*$L*
API String ID: 1997705970-1600591071
Opcode ID: 044d154c3975ca12bcf6db3a8b90b0d49139b94d77f3dce100c172641f4d507f
Instruction ID: 8027d6bd2599dda7bb5df45d8ce8314f33f4a5f2c5f80af919a907f5a91551e9
Opcode Fuzzy Hash: 044d154c3975ca12bcf6db3a8b90b0d49139b94d77f3dce100c172641f4d507f
Instruction Fuzzy Hash: 03810275A042859FDB05CF68C451BEEBFB2FF6A300F18816EC899A7742C3758546CBA1

Function 001773B0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 001775BE
___std_exception_destroy.LIBVCRUNTIME ref: 001775CD

Strings

, column , xrefs: 00177434, 0017744A
at line , xrefs: 001773F7

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column
API String ID: 4194217158-191570568
Opcode ID: 5af4e192679f5b69e0180d84fb06a56951ae7a6526ade286d4fc7b5a64c1d455
Instruction ID: 80e0d5312b39dd09d363233e393c8d022a51be3563f95ab464a561da578edf6e
Opcode Fuzzy Hash: 5af4e192679f5b69e0180d84fb06a56951ae7a6526ade286d4fc7b5a64c1d455
Instruction Fuzzy Hash: FC61E571A042049FDB0CDF68DD94BADBBB6FF44300F24862CE419A7781D774AA54CB91

Function 00173D10 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00173E7F

Strings

ios_base::eofbit set, xrefs: 00173E41, 00173E63
ios_base::badbit set, xrefs: 00173E17
ios_base::failbit set, xrefs: 00173D32

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: 47fb75a86988378fbcd1ae9dc43a4e24eacda00fd214b114ac93341656d3b59a
Instruction ID: c73ed3d0360c2db568538fc1cceff76daee930932c19ee41197ad33e42239faf
Opcode Fuzzy Hash: 47fb75a86988378fbcd1ae9dc43a4e24eacda00fd214b114ac93341656d3b59a
Instruction Fuzzy Hash: 3141B6B2910204AFCB14DF58C845B9EF7F8EF49310F54C52AF929D7641E770AA158BA4

Function 00173DE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00173E7F

Strings

ios_base::eofbit set, xrefs: 00173E28, 00173E41, 00173E63
ios_base::badbit set, xrefs: 00173E17
ios_base::failbit set, xrefs: 00173D32, 00173E1E

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: c8164ce186b55d8bb777c5f09351068b5a34757576eade310b2bfd7c99b18697
Instruction ID: e53a0d18a29fe5f7d66c01b5c13f5126080620614952d6e18406e8fd60b13a21
Opcode Fuzzy Hash: c8164ce186b55d8bb777c5f09351068b5a34757576eade310b2bfd7c99b18697
Instruction Fuzzy Hash: F421D8B2514704AFC714DF58D806B96B7ECAB04310F18C82AFA7C87641EB70EA249B95

Function 00176F40 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 349COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00177340

Strings

parse_error, xrefs: 00176F8B
parse error, xrefs: 00176FFF, 00177018

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: parse error$parse_error
API String ID: 2659868963-1820534363
Opcode ID: 2522329efa14742b0e2b438a1b22a304e9cd451d3ba8d046bd9d66998af4d62c
Instruction ID: 5e098f7b82e5742b3798e4d4c29edd8e0f30836c3d801c3d0d0771584d313497
Opcode Fuzzy Hash: 2522329efa14742b0e2b438a1b22a304e9cd451d3ba8d046bd9d66998af4d62c
Instruction Fuzzy Hash: BAE17070D042089FDB18CF68C994BADBBB1FF49300F248269E418EB792D7749A85CF91

Function 00176C60 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00176F11
___std_exception_destroy.LIBVCRUNTIME ref: 00176F20

Strings

[json.exception., xrefs: 00176CB8

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.
API String ID: 4194217158-791563284
Opcode ID: 80f3fa840c98554b9c683e27ca68a1da6bb01c774cd8bc0aacdf34aa28d903f9
Instruction ID: ec7b877b6a26f3b3354f00308e5157a6d699bd7aed8b54c97495716b51c56925
Opcode Fuzzy Hash: 80f3fa840c98554b9c683e27ca68a1da6bb01c774cd8bc0aacdf34aa28d903f9
Instruction Fuzzy Hash: 0A91E770A006049FDB18CF68C994B9EFBF5FF49300F20852CE459AB792D771AA45CB51

Function 001EE440 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 001EE491

Strings

type must be string, but is , xrefs: 001EE4F8
type must be boolean, but is , xrefs: 001EE582

Memory Dump Source

Source File: 00000000.00000002.4112057176.0000000000171000.00000040.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.4112021575.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4112057176.00000000002A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113832752.00000000002A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.00000000002AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000442000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113869557.0000000000572000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114489300.0000000000573000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4114849502.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_LisectAVT_2403002A_224.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: type must be boolean, but is $type must be string, but is
API String ID: 118556049-436076039
Opcode ID: 74bab5e242b393286a8708924ac9cef106f52d6b139dc9b022230accbba75b01
Instruction ID: e92507dc7e9dba42c4bd5d64570b724334aec81bba68c05beed8e79d01e86109
Opcode Fuzzy Hash: 74bab5e242b393286a8708924ac9cef106f52d6b139dc9b022230accbba75b01
Instruction Fuzzy Hash: 63419CB5904688AFCB04EBA4D802B9EB7F8EB10310F148679F819D77C1EB35E950C796

Analysis Process: MPGPH131.exePID: 7188, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	3.2%
Dynamic/Decrypted Code Coverage:	1.4%
Signature Coverage:	0%
Total number of Nodes:	627
Total number of Limit Nodes:	64

Executed Functions

Function 00AD3A40 Relevance: 2.7, APIs: 2, Instructions: 157
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E9,?,00000001,00000000,?,?,?,?,?,?,?,?,00AD3DB6), ref: 00AD3B08
Sleep.KERNELBASE(00000001,?,00000001,00000000,?,?,?,?,?,?,?,?,00AD3DB6), ref: 00AD3BBA

Memory Dump Source

Source File: 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000005.00000002.4111979088.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4112092223.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113927951.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114617141.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114946317.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 308e4c270ce0ebc796642c2fa52edb8a53941bbe3885bceaaa12496f9994ca6a
Instruction ID: 5ce03385b1765083d13302fa9f07434aece1d9ed770d0e6f8825bf48e66a55a9
Opcode Fuzzy Hash: 308e4c270ce0ebc796642c2fa52edb8a53941bbe3885bceaaa12496f9994ca6a
Instruction Fuzzy Hash: BC51A936A042198FCF24CF58C8D0EAAB7B1FF85744B29859AD446AF351D732EE05CB91

Function 00A8E0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00A8E0CB
socket.WS2_32(?,?,?), ref: 00A8E17F
connect.WS2_32(00000000,?,?), ref: 00A8E193
closesocket.WS2_32(00000000), ref: 00A8E19E

Memory Dump Source

Source File: 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000005.00000002.4111979088.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4112092223.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113927951.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114617141.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114946317.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: 48d76b699c48df94181b49e273319c1fd96134d5eff7ffb074cd4627a5f61a68
Instruction ID: b6c14a8b1613e580b387bcad2642619ba5ac2e455c63ca5decf59b98d8b3f416
Opcode Fuzzy Hash: 48d76b699c48df94181b49e273319c1fd96134d5eff7ffb074cd4627a5f61a68
Instruction Fuzzy Hash: F931B071605300ABE720EF25CC8872BB7E4EBD6724F004F1DF9A8A62D0D33599048BA2

Function 055D0255 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 212
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(055D0244), ref: 055D02C3

Strings

PPR, xrefs: 055D03F3
`, xrefs: 055D0412

Memory Dump Source

Source File: 00000005.00000002.4119264163.00000000055D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_55d0000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: PPR$`
API String ID: 2104809126-4190364777
Opcode ID: dcf0765fa1c26bbf121e09c7d239b6f888dd2dc0c70a87b3f6ad967d129ec187
Instruction ID: e393145b787960ed3f9e07d5b0be6e0c57a0d3be2a395993d8ad1fe5c8b64954
Opcode Fuzzy Hash: dcf0765fa1c26bbf121e09c7d239b6f888dd2dc0c70a87b3f6ad967d129ec187
Instruction Fuzzy Hash: 8C41C3EB24C111BDB521D1996B2CEFB976EF1D6730B308827F807C55A2F6848A4E11B1

Function 055D027A Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(055D0244), ref: 055D02C3

Strings

PPR, xrefs: 055D03F3
`, xrefs: 055D0412

Memory Dump Source

Source File: 00000005.00000002.4119264163.00000000055D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_55d0000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: PPR$`
API String ID: 2104809126-4190364777
Opcode ID: b2f080bfcf41fac40be69e26eab557cb299ebaa108068cf3844865a541fafe4b
Instruction ID: 528e8bd2ad47e96ad6540bcb389b7dc53d75e1e521e4f3410c12f145c5984771
Opcode Fuzzy Hash: b2f080bfcf41fac40be69e26eab557cb299ebaa108068cf3844865a541fafe4b
Instruction Fuzzy Hash: 6B410BE724C1017DF121D1986A2CEFBE76EF6D6730B308837F802C61A2F6848A4E01B1

Function 055D02F0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(055D0244), ref: 055D02C3

Strings

PPR, xrefs: 055D03F3
`, xrefs: 055D0412

Memory Dump Source

Source File: 00000005.00000002.4119264163.00000000055D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_55d0000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: PPR$`
API String ID: 2104809126-4190364777
Opcode ID: ba1eb97a5e990067ea66cb3edcdfabbdc51c3565bb0fa94dc15f2109c4640257
Instruction ID: 2d57bbc71b59ba444dc923e6135ddfb7aa54c39a57ab5e4d4283630e90c911d8
Opcode Fuzzy Hash: ba1eb97a5e990067ea66cb3edcdfabbdc51c3565bb0fa94dc15f2109c4640257
Instruction Fuzzy Hash: 6F4109E724C1117DB522D1996B6CEFBDB6EF6D2630B308837F803C51A2F6848A4E01B1

Function 055D026F Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(055D0244), ref: 055D02C3

Strings

PPR, xrefs: 055D03F3
`, xrefs: 055D0412

Memory Dump Source

Source File: 00000005.00000002.4119264163.00000000055D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_55d0000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: PPR$`
API String ID: 2104809126-4190364777
Opcode ID: 2d4b03b400196e564c23b033f18c5ee98b3996b3c2e011c48ad081ad33abda08
Instruction ID: 6426fca8d5fc9a8879b0909168ea5160970c3dbd62b0bf239ec725374dfed302
Opcode Fuzzy Hash: 2d4b03b400196e564c23b033f18c5ee98b3996b3c2e011c48ad081ad33abda08
Instruction Fuzzy Hash: D041C3EB24C111BDB521D1996B2CEFB976EF5D6730B308827F807C51A2F6848A4E11B1

Function 00B64623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000005.00000002.4111979088.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4112092223.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113927951.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114617141.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114946317.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f7f71f464384f24c5030f6217e82a0f8357eafe8e6bde4945417a098ce52dd4
Instruction ID: 36463d5ab51578eb9c7ea7a973444042557872fac45826076e8852d6cded2d0b
Opcode Fuzzy Hash: 1f7f71f464384f24c5030f6217e82a0f8357eafe8e6bde4945417a098ce52dd4
Instruction Fuzzy Hash: C3B11670A04649AFDB11DFA8D881BBEBBF1EF46310F1442D8E854A7292CB799D45CB60

Function 00A7A210 Relevance: 1.7, APIs: 1, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 00A7A343

Memory Dump Source

Source File: 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000005.00000002.4111979088.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4112092223.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113927951.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114617141.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114946317.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: bff99f61635dc78b269abd781d54db10353a0467e758f88c0b24ffd633a07cae
Instruction ID: 11787d8074ff9e7235ba42425957bff18b03b7026022f0a7eb9678f31a34255c
Opcode Fuzzy Hash: bff99f61635dc78b269abd781d54db10353a0467e758f88c0b24ffd633a07cae
Instruction Fuzzy Hash: 62714B71900204BFDB14DF68CC49BAEBBE8EF81700F10C5ADF8099B682D7B59A45C792

Function 00B6549C Relevance: 1.7, APIs: 1, Instructions: 198
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000000,00B59087,?,00000000,00000000,00000000,?,00000000,?,00A7A3EB,00B59087,00000000,00A7A3EB,?,?), ref: 00B65621

Memory Dump Source

Source File: 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000005.00000002.4111979088.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4112092223.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113927951.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114617141.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114946317.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: c68603f16a9f3c651b8d2ac84aa65c3c98db9f9ebbd5cd0b82fa147421179748
Instruction ID: 5b247d6b4af18c93e82631a1bdfbc856055a215319db3605eeac5980fa0575bf
Opcode Fuzzy Hash: c68603f16a9f3c651b8d2ac84aa65c3c98db9f9ebbd5cd0b82fa147421179748
Instruction Fuzzy Hash: 4561A1B2900519AFDF21DFA8C884EEEBBFAEF19304F1401C5E805A7215D779D961CBA0

Function 00B54942 Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000005.00000002.4111979088.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4112092223.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113927951.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114617141.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114946317.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 873bb3c47b15d373126beefc2e09f71cf402ef20fe3bcf237f6867130a39263a
Instruction ID: 6fc1532634142dbf2a5e6b08e91f4269efd13529698e007af4e0160a2605a84e
Opcode Fuzzy Hash: 873bb3c47b15d373126beefc2e09f71cf402ef20fe3bcf237f6867130a39263a
Instruction Fuzzy Hash: B451B370A00108AFDB54CF58C881BAEBBF1EF49369F2481D8FC599B252D3719E95CB90

Function 00AE0560 Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00AE06AE

Memory Dump Source

Source File: 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000005.00000002.4111979088.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4112092223.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113927951.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114617141.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114946317.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction ID: 629e8c71b86cef13bd0161e4997186ee116ec03c669648962dccb1b59c98d6d0
Opcode Fuzzy Hash: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction Fuzzy Hash: 5B41E572A001549BCB15EF69DD80AAE7BE5EF88310F1441A9FC05DB302D7B0DEA09BE1

Function 00B64B12 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,00B649F9,00000000,CF830579,00BA1140,0000000C,00B64AB5,00B58BBD,?), ref: 00B64B68

Memory Dump Source

Source File: 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000005.00000002.4111979088.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4112092223.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113927951.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114617141.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114946317.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: b5509422815d2f7e7047400b12ea34974cf3ea9363c7b46f8470dffe2c21aa1f
Instruction ID: 577cad133243b59295a64456a560aa9bc6265fa443683f94d0f80e75178b51f1
Opcode Fuzzy Hash: b5509422815d2f7e7047400b12ea34974cf3ea9363c7b46f8470dffe2c21aa1f
Instruction Fuzzy Hash: C911483364151816CB253674D846B7EB7C9CB83770F2D02DDF8189B0C2EF69D8825555

Function 00B5E05C Relevance: 1.6, APIs: 1, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00BA0DF8,00A7A3EB,00000002,00A7A3EB,00000000,?,?,?,00B5E166,00000000,?,00A7A3EB,00000002,00BA0DF8), ref: 00B5E098

Memory Dump Source

Source File: 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000005.00000002.4111979088.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4112092223.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113927951.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114617141.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114946317.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 6641a99bfad2f2ae292e906e2fb13521750cd8b05c47a8eff085f07e3a8dcc1b
Instruction ID: 13582bae817d2770e9d44237b60d26fb586cc951f5e16f6c1514b8260f440697
Opcode Fuzzy Hash: 6641a99bfad2f2ae292e906e2fb13521750cd8b05c47a8eff085f07e3a8dcc1b
Instruction Fuzzy Hash: D7010832614119ABCF199F55CC0699E3B9ADB81331B280288EC60971D0E6B1EE41CBD0

Function 00B4F290 Relevance: 1.6, APIs: 1, Instructions: 51
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00A7220E

Memory Dump Source

Source File: 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000005.00000002.4111979088.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4112092223.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113927951.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114617141.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114946317.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 25e7954cbe89233ca00581d69169b55b070b8f2e6094e1840ebd59dd632e47d6
Instruction ID: 73c230ea496404db19ae85c01a08eaa18707b4370f9878e3341fd3e0e378dcf0
Opcode Fuzzy Hash: 25e7954cbe89233ca00581d69169b55b070b8f2e6094e1840ebd59dd632e47d6
Instruction Fuzzy Hash: B4012B7650430EABCB14AFA8DC0296977ECDA00310B54C5B9FE1DDB551EB70E9548794

Function 00B663F3 Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,00B591F7,00000000,?,00B65D79,00000001,00000364,00000000,00000006,000000FF,?,00000000,00B5D244,00B589C3,00B591F7,00000000), ref: 00B66434

Memory Dump Source

Source File: 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000005.00000002.4111979088.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4112092223.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113927951.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114617141.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114946317.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 98907af624a6ce96451d3f5501384db4459a53024993449d7f3783684673f71a
Instruction ID: b4c15e1ceed0f2c7728773a8fe143150d690f24d48f41c8ecdfbea86f6be490d
Opcode Fuzzy Hash: 98907af624a6ce96451d3f5501384db4459a53024993449d7f3783684673f71a
Instruction Fuzzy Hash: BEF0893254512466DB216B66DC17B5B7BCDEF51B64F2581E1EC04A7290CE38EC1146F1

Function 00B66E2D Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00B6D635,4D88C033,?,00B6D635,00000220,?,00B657EF,4D88C033), ref: 00B66E60

Memory Dump Source

Source File: 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000005.00000002.4111979088.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4112092223.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113927951.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114617141.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114946317.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d30aa0ef34bcd88e01c765665eedda19780e37c5924531ec492157e6ae4e46e2
Instruction ID: f682c6a2a6edde1077892c69fdf5e9be412b2dc8e13d5ef253aadf0c76efe720
Opcode Fuzzy Hash: d30aa0ef34bcd88e01c765665eedda19780e37c5924531ec492157e6ae4e46e2
Instruction Fuzzy Hash: 67E0ED3A94562166DA302266CC01B6B7BC8CBA27A1F0505E1FC04D20D0CF2ACC0081A4

Non-executed Functions

Function 00B584A0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000005.00000002.4111979088.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4112092223.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113927951.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114617141.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114946317.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction ID: 9ce32bd519990f92cdfb160b500c19bf8f6db6426940903da7a90d62eb7b9c32
Opcode Fuzzy Hash: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction Fuzzy Hash: 4D022D71E012199BDF14CFA9D8807AEBBF1FF48315F2482A9D919F7380DB31A9458B90

Function 055D018A Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4119264163.00000000055D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_55d0000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b19f2d368e9658a8b9fca4a24bc68deb535cdac7f428862cea0b64a5810f253b
Instruction ID: b1e7bb5d844ecb331c2b667bc1128daf28053b2eb17d7e7472954bdd16828d3d
Opcode Fuzzy Hash: b19f2d368e9658a8b9fca4a24bc68deb535cdac7f428862cea0b64a5810f253b
Instruction Fuzzy Hash: DF01897750C2989ED313C6E82A9C3E8BF36BB93230F3845BFD04286592E7940A4E4231

Function 00ADF810 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00ADF833
std::_Lockit::_Lockit.LIBCPMT ref: 00ADF855
std::_Lockit::~_Lockit.LIBCPMT ref: 00ADF875
std::_Lockit::~_Lockit.LIBCPMT ref: 00ADF89F
std::_Lockit::_Lockit.LIBCPMT ref: 00ADF90D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00ADF959
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00ADF973
std::_Lockit::~_Lockit.LIBCPMT ref: 00ADFA08
std::_Facet_Register.LIBCPMT ref: 00ADFA15

Strings

bad locale name, xrefs: 00ADFA2F
Ps, xrefs: 00ADF96B, 00ADF972

Memory Dump Source

Source File: 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000005.00000002.4111979088.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4112092223.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113927951.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114617141.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114946317.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$Ps
API String ID: 3375549084-1174896957
Opcode ID: e3d010db819d2ba949adbb9fd107647a8fe8e225c4fc84076c3ef0f27ac75fcf
Instruction ID: 38df27924287b8bdba71f8167509716181c8f6f3eff58b70e4349ee376f56cf7
Opcode Fuzzy Hash: e3d010db819d2ba949adbb9fd107647a8fe8e225c4fc84076c3ef0f27ac75fcf
Instruction Fuzzy Hash: DF616EB1D002489FEF20DFA4D845B9EBBF4AF15710F1841A9E816A7341EB74EA05CB92

Function 00A739F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00A73A58
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00A73AA4
__Getctype.LIBCPMT ref: 00A73ABA
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00A73AE6
std::_Lockit::~_Lockit.LIBCPMT ref: 00A73B7B

Strings

bad locale name, xrefs: 00A73B96

Memory Dump Source

Source File: 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000005.00000002.4111979088.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4112092223.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113927951.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114617141.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114946317.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: 7bb4de58a8d44943d33fb7d3e9407b12fee82f9a60f96baebc80b0d1b4934a9a
Instruction ID: 13f73beedc94de9d46bc43e4edce78056c9d25f3c738ebc1e0991ef726e0262d
Opcode Fuzzy Hash: 7bb4de58a8d44943d33fb7d3e9407b12fee82f9a60f96baebc80b0d1b4934a9a
Instruction Fuzzy Hash: 3D5130B2D012489BEF10DFA4DC45B9EBBF8AF54310F1481A9E809AB341E775DA08DB91

Function 00B52E10 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00B52E47
___except_validate_context_record.LIBVCRUNTIME ref: 00B52E4F
_ValidateLocalCookies.LIBCMT ref: 00B52ED8
__IsNonwritableInCurrentImage.LIBCMT ref: 00B52F03
_ValidateLocalCookies.LIBCMT ref: 00B52F58

Strings

csm, xrefs: 00B52EED

Memory Dump Source

Source File: 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000005.00000002.4111979088.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4112092223.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113927951.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114617141.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114946317.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: e98551110e5a50f17180e0d3840e447a36147e15659089685c48d3cd1e519ec2
Instruction ID: bf72ab0f317d4a9128e7928f2bb9fafa319f065582c9d0588044997eb2c39fc9
Opcode Fuzzy Hash: e98551110e5a50f17180e0d3840e447a36147e15659089685c48d3cd1e519ec2
Instruction Fuzzy Hash: 29419130A012099BCF10DF68D885B9EBBF5EF46315F1480D5ED189B392D731DA49CB90

Function 00ADDE70 Relevance: 9.1, APIs: 6, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00ADDE93
std::_Lockit::_Lockit.LIBCPMT ref: 00ADDEB6
std::_Lockit::~_Lockit.LIBCPMT ref: 00ADDED6
std::_Facet_Register.LIBCPMT ref: 00ADDF4B
std::_Lockit::~_Lockit.LIBCPMT ref: 00ADDF63
Concurrency::cancel_current_task.LIBCPMT ref: 00ADDF7B

Memory Dump Source

Source File: 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000005.00000002.4111979088.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4112092223.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113927951.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114617141.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114946317.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: c03016c01924e7dd2e343f5316efa6c5528a095dcd9aa44fc0f0f2ae2c1e6e16
Instruction ID: 0fe2e2e8b9442f6f31ac3a41cd8a7d107d977768cc5ff9ec9ebf5790aac0b60a
Opcode Fuzzy Hash: c03016c01924e7dd2e343f5316efa6c5528a095dcd9aa44fc0f0f2ae2c1e6e16
Instruction Fuzzy Hash: 7C41B2B1900215DFCF14DF58D845AAEBBF4FB05710F14466AE8169B392DB31AE05CBD1

Function 00A74C50 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 442COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00A74F72
___std_exception_destroy.LIBVCRUNTIME ref: 00A74FFF
___std_exception_copy.LIBVCRUNTIME ref: 00A750C8

Strings

recursive_directory_iterator::operator++, xrefs: 00A7504C

Memory Dump Source

Source File: 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000005.00000002.4111979088.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4112092223.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113927951.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114617141.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114946317.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$___std_exception_copy
String ID: recursive_directory_iterator::operator++
API String ID: 1206660477-953255998
Opcode ID: f61041b02dcce777b7efb80a637ca91e61f23187c2b3a857c138110da9025674
Instruction ID: 1d223d151804ccf9954e84bfec9eb3b6e269fdb1fcddcbae671971f847aa0def
Opcode Fuzzy Hash: f61041b02dcce777b7efb80a637ca91e61f23187c2b3a857c138110da9025674
Instruction Fuzzy Hash: 82E1E0719002059FCB28DF68CD45BAEB7F9FF48710F108A6DE45A97781E774AA04CBA1

Function 00A77820 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00A7799A
___std_exception_copy.LIBVCRUNTIME ref: 00A77B75

Strings

type_error, xrefs: 00A7784A
out_of_range, xrefs: 00A77A27

Memory Dump Source

Source File: 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000005.00000002.4111979088.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4112092223.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113927951.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114617141.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114946317.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: out_of_range$type_error
API String ID: 2659868963-3702451861
Opcode ID: 6bfa4a5049e065fe6ed3a58a1bfd0124992e5d7005f5817957fd539e0a02f634
Instruction ID: da9c46fa6771d612c9573084d4125abb46b7b1384140ed26eb9031cbb5b46f7e
Opcode Fuzzy Hash: 6bfa4a5049e065fe6ed3a58a1bfd0124992e5d7005f5817957fd539e0a02f634
Instruction Fuzzy Hash: 5FC157B1D002089FDB18DFA8D984B9DBBF5FF48300F14866AE419EB791E7749980CB54

Function 00A773B0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00A775BE
___std_exception_destroy.LIBVCRUNTIME ref: 00A775CD

Strings

at line , xrefs: 00A773F7
, column , xrefs: 00A77434, 00A7744A

Memory Dump Source

Source File: 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000005.00000002.4111979088.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4112092223.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113927951.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114617141.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114946317.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column
API String ID: 4194217158-191570568
Opcode ID: 9091a30999fdfebd5acf93302cc4f62311a63fcf42c23899d47e387fe6dc1cca
Instruction ID: 666b59668a73a8901c2a4ef0ca271b3ac13544a6a17c5819db1f196ace0c3bb4
Opcode Fuzzy Hash: 9091a30999fdfebd5acf93302cc4f62311a63fcf42c23899d47e387fe6dc1cca
Instruction Fuzzy Hash: 6961C171A042059FDB08DF68DD84BADBBF6FF44300F24C668E419A7782D774AA44CB91

Function 00A73D10 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00A73E7F

Strings

ios_base::badbit set, xrefs: 00A73E17
ios_base::failbit set, xrefs: 00A73D32
ios_base::eofbit set, xrefs: 00A73E41, 00A73E63

Memory Dump Source

Source File: 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000005.00000002.4111979088.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4112092223.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113927951.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114617141.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114946317.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: 28452488a43dcb035f3bf3b75a5b888a8a29e8abaa67a6f0c3779fcff7783aa4
Instruction ID: 059a8d05e346c8d8aa7e86a1f22bdcd0159f869fadf1bdf14e7aba4e97044fab
Opcode Fuzzy Hash: 28452488a43dcb035f3bf3b75a5b888a8a29e8abaa67a6f0c3779fcff7783aa4
Instruction Fuzzy Hash: 8641B4B3900209AFCB14DF68CC45BAEB7F8EF49310F14C56AF919D7641E770AA048BA4

Function 00A73DE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00A73E7F

Strings

ios_base::badbit set, xrefs: 00A73E17
ios_base::failbit set, xrefs: 00A73D32, 00A73E1E
ios_base::eofbit set, xrefs: 00A73E28, 00A73E41, 00A73E63

Memory Dump Source

Source File: 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000005.00000002.4111979088.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4112092223.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113927951.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114617141.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114946317.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: 424749cede513fc4d820d55567ff2eaf55e897bd98a72e7821cdb1c5453097bd
Instruction ID: 896b4465d931b0b46656993ec8364cea8a853c5827bd53b1dfbf60a5e67ae863
Opcode Fuzzy Hash: 424749cede513fc4d820d55567ff2eaf55e897bd98a72e7821cdb1c5453097bd
Instruction Fuzzy Hash: 5D2105B39047056FCB14DF58DC02B96B7E8AB04310F19C8BAFA6C8B641E770EA148B95

Function 00A76F40 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 349COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00A77340

Strings

parse error, xrefs: 00A76FFF, 00A77018
parse_error, xrefs: 00A76F8B

Memory Dump Source

Source File: 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000005.00000002.4111979088.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4112092223.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113927951.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114617141.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114946317.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: parse error$parse_error
API String ID: 2659868963-1820534363
Opcode ID: a36752a6cab398645f967befd0bb0e6696d44aa2d6791be29b7def99e181634e
Instruction ID: 4ab7e2da644a007e83129b465b72869f213f801c41b6c6fb47aea9b8ae204e06
Opcode Fuzzy Hash: a36752a6cab398645f967befd0bb0e6696d44aa2d6791be29b7def99e181634e
Instruction Fuzzy Hash: B7E14E719042449FDB18CF68CD84B9DBBF1BF49304F24C2A9E419AB792D7749A81CF91

Function 00A76C60 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00A76F11
___std_exception_destroy.LIBVCRUNTIME ref: 00A76F20

Strings

[json.exception., xrefs: 00A76CB8

Memory Dump Source

Source File: 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000005.00000002.4111979088.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4112092223.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113927951.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114617141.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114946317.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.
API String ID: 4194217158-791563284
Opcode ID: 8832be2fbdb71314eb89c9a2f451f452099b018f68f12edbacf093a47a539bae
Instruction ID: b1b1f4a20c4a095241b3334a6ac6a30061494df7035c7cad45ff5dcf89cd9f0d
Opcode Fuzzy Hash: 8832be2fbdb71314eb89c9a2f451f452099b018f68f12edbacf093a47a539bae
Instruction Fuzzy Hash: F591C370A006049FDB18CF68DD84BAEBBF5EF48300F20C56CE419AB792D771AA45CB91

Function 00AEE440 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00AEE491

Strings

type must be boolean, but is , xrefs: 00AEE582
type must be string, but is , xrefs: 00AEE4F8

Memory Dump Source

Source File: 00000005.00000002.4112092223.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000005.00000002.4111979088.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4112092223.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113927951.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4113971389.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114617141.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4114946317.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: type must be boolean, but is $type must be string, but is
API String ID: 118556049-436076039
Opcode ID: 916f9bc2e0b82d72467c8625bfd0a54e5b9316dac33056446fd169f5e19f6bc6
Instruction ID: 68a442044b90205a71fcba8720537a9ec575fad64cf3470a1dec716514d64847
Opcode Fuzzy Hash: 916f9bc2e0b82d72467c8625bfd0a54e5b9316dac33056446fd169f5e19f6bc6
Instruction Fuzzy Hash: 49417CB5904288AFCB14EBA4DD02B9EB7E8DB00310F1486B9F419D77D1EB36AD44C396

Analysis Process: MPGPH131.exePID: 7196, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	3.1%
Dynamic/Decrypted Code Coverage:	1.7%
Signature Coverage:	0%
Total number of Nodes:	661
Total number of Limit Nodes:	68

Executed Functions

Function 00AD3A40 Relevance: 2.7, APIs: 2, Instructions: 157
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E9,?,00000001,00000000,?,?,?,?,?,?,?,?,00AD3DB6), ref: 00AD3B08
Sleep.KERNELBASE(00000001,?,00000001,00000000,?,?,?,?,?,?,?,?,00AD3DB6), ref: 00AD3BBA

Memory Dump Source

Source File: 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000006.00000002.4111980092.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4112086502.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113915489.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114588753.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114920528.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 91568b4a504bffe5b6fdc4df9e7012cbfc543401a48ff9f3e657dcc2d4f9495c
Instruction ID: e23706940731cbf81a2ec8bd9f3f28546cb09a687f51ae1bc1ea789c49f39ac3
Opcode Fuzzy Hash: 91568b4a504bffe5b6fdc4df9e7012cbfc543401a48ff9f3e657dcc2d4f9495c
Instruction Fuzzy Hash: E851B936A042198FCF24CF58C8D0EAAB7B1FF45744B29859AD446AF352D732EE05CB91

Function 00A8E0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00A8E0CA
socket.WS2_32(?,?,?), ref: 00A8E17F
connect.WS2_32(00000000,?,?), ref: 00A8E193
closesocket.WS2_32(00000000), ref: 00A8E19E

Memory Dump Source

Source File: 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000006.00000002.4111980092.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4112086502.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113915489.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114588753.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114920528.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: 9cb1a79dac40c8c0370804db34e2bccc7a304f520968b10a493038a37a2615ac
Instruction ID: 821b6c66d26d3a8610d6925fc9e42edb9cbdf1a8fe02d888e7c51d2558d627b0
Opcode Fuzzy Hash: 9cb1a79dac40c8c0370804db34e2bccc7a304f520968b10a493038a37a2615ac
Instruction Fuzzy Hash: AA31B072605300ABE720EF258C4872BB7E4EBD6724F004F1DF9A8A62D0D33599048BA2

Function 055D064A Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 269
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 055D0702

Strings

k^[P, xrefs: 055D073C

Memory Dump Source

Source File: 00000006.00000002.4119414398.00000000055D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_55d0000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: k^[P
API String ID: 2104809126-2573564367
Opcode ID: 3489944f212bfc3cd61e472e8356420a94a88ab82866b526b89c107d3b55ca88
Instruction ID: dcd0158b48ee082afa4c2b73c5f5022ebca789ea5ba9d3af913b12b5b4c1b05d
Opcode Fuzzy Hash: 3489944f212bfc3cd61e472e8356420a94a88ab82866b526b89c107d3b55ca88
Instruction Fuzzy Hash: 6B5107EB54D111BCB172C1892B1CAFAE72FF6D6730B308C26F407DA6A1F2844A8941F1

Function 055D0640 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 055D0702

Strings

k^[P, xrefs: 055D073C

Memory Dump Source

Source File: 00000006.00000002.4119414398.00000000055D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_55d0000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: k^[P
API String ID: 2104809126-2573564367
Opcode ID: d5fe652bb89812e5160b66645c4eb8ae47d17176d52060ecdb5ba6d4ecc0f2bc
Instruction ID: e46cfe26da02f672fb2b79d292643f03c845e7af237cb4bb13fb06026d303325
Opcode Fuzzy Hash: d5fe652bb89812e5160b66645c4eb8ae47d17176d52060ecdb5ba6d4ecc0f2bc
Instruction Fuzzy Hash: 9B51C1EB54D111BCB171C18A2B1CAFAD72FF6D6730B308C26F407DA6A1F2844A8954F1

Function 055D0674 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 254
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 055D0702

Strings

k^[P, xrefs: 055D073C

Memory Dump Source

Source File: 00000006.00000002.4119414398.00000000055D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_55d0000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: k^[P
API String ID: 2104809126-2573564367
Opcode ID: 93685aaeb02ff8933b61abd0093dd3ea1315f9fa8ec310d2165d8709714f7bf5
Instruction ID: 85951f253e2250e581974c2fab1f0d73f6d65906185a9f2b1e907cb09affc9ea
Opcode Fuzzy Hash: 93685aaeb02ff8933b61abd0093dd3ea1315f9fa8ec310d2165d8709714f7bf5
Instruction Fuzzy Hash: DA51F3EB54D111ACB171D15A2B1CAFAE72FF2D6730B308C26F407DA6A1F2844A8954F1

Function 055D0685 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 248
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 055D0702

Strings

k^[P, xrefs: 055D073C

Memory Dump Source

Source File: 00000006.00000002.4119414398.00000000055D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_55d0000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: k^[P
API String ID: 2104809126-2573564367
Opcode ID: eefc1b25dc56a83a217207b281c6125666f0f038dec8cfd6fe209a7f9a5bc217
Instruction ID: 5fff87d127b276d087e1c30ad45bbac2ecea49a079bfca89b9bd77a919dacc1b
Opcode Fuzzy Hash: eefc1b25dc56a83a217207b281c6125666f0f038dec8cfd6fe209a7f9a5bc217
Instruction Fuzzy Hash: 1541C1EB54D111ACB171C15A2B1CAFADB2FF6D6730B308C26F407DA6A5F2844A8954F1

Function 055D0694 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 245
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 055D0702

Strings

k^[P, xrefs: 055D073C

Memory Dump Source

Source File: 00000006.00000002.4119414398.00000000055D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_55d0000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: k^[P
API String ID: 2104809126-2573564367
Opcode ID: c3874b166f398b03f86d05579e2d69b82d7e081dd26b22601825df6805dca525
Instruction ID: 3c35bdeff2d7c9981bff351fd22e911a696599d63c79ade86165a532a2695fa9
Opcode Fuzzy Hash: c3874b166f398b03f86d05579e2d69b82d7e081dd26b22601825df6805dca525
Instruction Fuzzy Hash: C841F2EB50D115BCB171C24A2B1CAFAD62FF6D6730B308C26F807DA6A1F2844A8950F1

Function 055D06A6 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 240
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 055D0702

Strings

k^[P, xrefs: 055D073C

Memory Dump Source

Source File: 00000006.00000002.4119414398.00000000055D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_55d0000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: k^[P
API String ID: 2104809126-2573564367
Opcode ID: 4b9aa86270f564a682eacbb92ef289f7f926ddd3b6f9d0a1703fd3912ea5946c
Instruction ID: f279393c95baf87770a8bdc6188c7ad1b119f8c6fc96d3081f100469125b77a3
Opcode Fuzzy Hash: 4b9aa86270f564a682eacbb92ef289f7f926ddd3b6f9d0a1703fd3912ea5946c
Instruction Fuzzy Hash: D341F4EB54D111BCB171C25E2B1CAFADA2FF2D6730B308C26F407DA6A1F2844A8954F1

Function 055D06AB Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 055D0702

Strings

k^[P, xrefs: 055D073C

Memory Dump Source

Source File: 00000006.00000002.4119414398.00000000055D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_55d0000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: k^[P
API String ID: 2104809126-2573564367
Opcode ID: d470c3602e9d9a441ab1906f1e055538094173a3696cb07f6f9c4ac90ba07ca5
Instruction ID: 82dcfe4c28486744022c9bcfc58dbbc0f06d177760e98d14eb7608fa84f49b88
Opcode Fuzzy Hash: d470c3602e9d9a441ab1906f1e055538094173a3696cb07f6f9c4ac90ba07ca5
Instruction Fuzzy Hash: 9541E2EB54D111BCB171C25A2B1CAFADA2FF2D6730B308C26F407DA6A1F2844A8954F1

Function 055D0708 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 233
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 055D0702

Strings

k^[P, xrefs: 055D073C

Memory Dump Source

Source File: 00000006.00000002.4119414398.00000000055D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_55d0000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: k^[P
API String ID: 2104809126-2573564367
Opcode ID: fdd43aa30f4488ad77a19eb38fd7a4a27a14d5d9689b15b9b53b95c5974ebe77
Instruction ID: 2438c203b7079c0e37caf038a43e85add1ed8b593fcba0ca0ad0af9e6a01a6dc
Opcode Fuzzy Hash: fdd43aa30f4488ad77a19eb38fd7a4a27a14d5d9689b15b9b53b95c5974ebe77
Instruction Fuzzy Hash: 2341F5EB50D115ACB172C2591B1CAF6EB2FF6D7730B308827F407DA6A2F2844A8955F1

Function 055D06BF Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 233
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 055D0702

Strings

k^[P, xrefs: 055D073C

Memory Dump Source

Source File: 00000006.00000002.4119414398.00000000055D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_55d0000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: k^[P
API String ID: 2104809126-2573564367
Opcode ID: 0ac5cb8080cfd2401d84d48da43739d8de7c0d51415c66eb3c65d02be24d131a
Instruction ID: 7a95966bd7f775274303ea4a99161be5536c94b5ba97a1c5c56d7a3614282938
Opcode Fuzzy Hash: 0ac5cb8080cfd2401d84d48da43739d8de7c0d51415c66eb3c65d02be24d131a
Instruction Fuzzy Hash: 5C4112EB50D111ACB171C2592B1CAFAEB2FF6D6730B308C27F407DA6A1F2944A8944F1

Function 055D06E5 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 055D0702

Strings

k^[P, xrefs: 055D073C

Memory Dump Source

Source File: 00000006.00000002.4119414398.00000000055D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_55d0000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: k^[P
API String ID: 2104809126-2573564367
Opcode ID: 65eed830c4b30e7db03d0284babf1f7f6370018bdb7b2ef01d7ebe426f85a97f
Instruction ID: 0fcd92acd15da03139613c17eeb9ef42c51a622814224af4600d9939497b1776
Opcode Fuzzy Hash: 65eed830c4b30e7db03d0284babf1f7f6370018bdb7b2ef01d7ebe426f85a97f
Instruction Fuzzy Hash: 864113EB50D115BCB171C29D1B1CAFADA2FF6D6730B308C26F407DA6A1F2844A8914F1

Function 00B64623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000006.00000002.4111980092.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4112086502.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113915489.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114588753.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114920528.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90e2f91753fdaf5cc3f256f372292ae7b3fa733a08ed6bd0eed60f59928d8b14
Instruction ID: df57141529db011eeb272ec8824b7412a14a62fbacf043a97e78fdfc506c265b
Opcode Fuzzy Hash: 90e2f91753fdaf5cc3f256f372292ae7b3fa733a08ed6bd0eed60f59928d8b14
Instruction Fuzzy Hash: B0B114B0E04645AFDB11DFA8D881BAEBBF1EF46314F1442D8E854A7382CB799D45CB60

Function 00A7A210 Relevance: 1.7, APIs: 1, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 00A7A343

Memory Dump Source

Source File: 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000006.00000002.4111980092.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4112086502.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113915489.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114588753.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114920528.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: da77661de617b226dddef21a0fe78c4bb16e92d24e271372ce46b838fadea3f9
Instruction ID: 6bd07c6d4404293b53f237bf1b55040bef0b3e2d0f01ae83a2b275ff12b824f5
Opcode Fuzzy Hash: da77661de617b226dddef21a0fe78c4bb16e92d24e271372ce46b838fadea3f9
Instruction Fuzzy Hash: 4B713A71900204BFDB14DF68CC49BAEBBE8EF81700F10C5ADF8099B682D7B59A45C792

Function 00B6549C Relevance: 1.7, APIs: 1, Instructions: 198
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000000,00B59087,?,00000000,00000000,00000000,?,00000000,?,00A7A3EB,00B59087,00000000,00A7A3EB,?,?), ref: 00B65621

Memory Dump Source

Source File: 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000006.00000002.4111980092.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4112086502.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113915489.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114588753.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114920528.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 324b8dbb2f1e50b3c9bbd8f9405b90681efa826abcf9a863f7a6ee11109b7753
Instruction ID: 5794ec207f20c80d4ac7d1ae923bc7fd30e86b432c2c1870688880926c0847a2
Opcode Fuzzy Hash: 324b8dbb2f1e50b3c9bbd8f9405b90681efa826abcf9a863f7a6ee11109b7753
Instruction Fuzzy Hash: 676191B2900519AFDF21DFA8C884AEEBBFAEF19304F5401C5E805A7215D779D961CBA0

Function 00B54942 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000006.00000002.4111980092.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4112086502.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113915489.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114588753.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114920528.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 873bb3c47b15d373126beefc2e09f71cf402ef20fe3bcf237f6867130a39263a
Instruction ID: 6fc1532634142dbf2a5e6b08e91f4269efd13529698e007af4e0160a2605a84e
Opcode Fuzzy Hash: 873bb3c47b15d373126beefc2e09f71cf402ef20fe3bcf237f6867130a39263a
Instruction Fuzzy Hash: B451B370A00108AFDB54CF58C881BAEBBF1EF49369F2481D8FC599B252D3719E95CB90

Function 00AE0560 Relevance: 1.6, APIs: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00AE06AE

Memory Dump Source

Source File: 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000006.00000002.4111980092.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4112086502.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113915489.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114588753.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114920528.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction ID: 629e8c71b86cef13bd0161e4997186ee116ec03c669648962dccb1b59c98d6d0
Opcode Fuzzy Hash: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction Fuzzy Hash: 5B41E572A001549BCB15EF69DD80AAE7BE5EF88310F1441A9FC05DB302D7B0DEA09BE1

Function 00B64B12 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,00B649F9,00000000,CF830579,00BA1140,0000000C,00B64AB5,00B58BBD,?), ref: 00B64B68

Memory Dump Source

Source File: 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000006.00000002.4111980092.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4112086502.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113915489.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114588753.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114920528.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 923347577642978887aa79934a52a28c3e897c23ba802a5bb2e36b8e966d09a9
Instruction ID: 5dea869dad8ffd22051dd8d1fb65e4363e593b16acd65a780e231d519d7dc862
Opcode Fuzzy Hash: 923347577642978887aa79934a52a28c3e897c23ba802a5bb2e36b8e966d09a9
Instruction Fuzzy Hash: 07114433A415241ACB253674E846B7EB7CACB83770F2D02D9F818AB1C2EF69DC825255

Function 00B5E05C Relevance: 1.6, APIs: 1, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00BA0DF8,00A7A3EB,00000002,00A7A3EB,00000000,?,?,?,00B5E166,00000000,?,00A7A3EB,00000002,00BA0DF8), ref: 00B5E098

Memory Dump Source

Source File: 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000006.00000002.4111980092.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4112086502.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113915489.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114588753.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114920528.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 202f7ccf3dce39b11e72c7dfe58976f217a3b6526a764fa8619d1507d080072e
Instruction ID: acdaeefbefb67a953b65b99f763f46be9e8d7d41ed66e84cb347e5d43bad5a9f
Opcode Fuzzy Hash: 202f7ccf3dce39b11e72c7dfe58976f217a3b6526a764fa8619d1507d080072e
Instruction Fuzzy Hash: D3012B32614115AFCF199F59CC06D9E3B5ADB81330B2802C8FC60972D1E6B1EE45CBD0

Function 00B4F290 Relevance: 1.6, APIs: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00A7220E

Memory Dump Source

Source File: 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000006.00000002.4111980092.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4112086502.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113915489.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114588753.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114920528.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 25e7954cbe89233ca00581d69169b55b070b8f2e6094e1840ebd59dd632e47d6
Instruction ID: 73c230ea496404db19ae85c01a08eaa18707b4370f9878e3341fd3e0e378dcf0
Opcode Fuzzy Hash: 25e7954cbe89233ca00581d69169b55b070b8f2e6094e1840ebd59dd632e47d6
Instruction Fuzzy Hash: B4012B7650430EABCB14AFA8DC0296977ECDA00310B54C5B9FE1DDB551EB70E9548794

Function 00B663F3 Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00B591F7,00000000,?,00B65D79,00000001,00000364,00000000,00000006,000000FF,?,00000000,00B5D244,00B589C3,00B591F7,00000000), ref: 00B66435

Memory Dump Source

Source File: 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000006.00000002.4111980092.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4112086502.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113915489.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114588753.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114920528.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 3d902fc4099ffd4f72bfb0d0542ca22001e8e34432318f478e69410e57793f1b
Instruction ID: 8b2dbbfdcec30f3d37f88cb9fd8ebbd939f702e83d853fa582264dfcf1bb4e8d
Opcode Fuzzy Hash: 3d902fc4099ffd4f72bfb0d0542ca22001e8e34432318f478e69410e57793f1b
Instruction Fuzzy Hash: BCF0E932505124669B216B62DC17B6B7BCCEF41760F1580D1EC0897280CF38EC0142F1

Function 00B66E2D Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00B6D635,4D88C033,?,00B6D635,00000220,?,00B657EF,4D88C033), ref: 00B66E60

Memory Dump Source

Source File: 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000006.00000002.4111980092.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4112086502.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113915489.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114588753.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114920528.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1fc5deaabc80795d153a4d706f26bf79d3513ab1a861800642317d1edb1bb1ef
Instruction ID: f682c6a2a6edde1077892c69fdf5e9be412b2dc8e13d5ef253aadf0c76efe720
Opcode Fuzzy Hash: 1fc5deaabc80795d153a4d706f26bf79d3513ab1a861800642317d1edb1bb1ef
Instruction Fuzzy Hash: 67E0ED3A94562166DA302266CC01B6B7BC8CBA27A1F0505E1FC04D20D0CF2ACC0081A4

Non-executed Functions

Function 00B584A0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000006.00000002.4111980092.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4112086502.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113915489.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114588753.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114920528.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction ID: 9ce32bd519990f92cdfb160b500c19bf8f6db6426940903da7a90d62eb7b9c32
Opcode Fuzzy Hash: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction Fuzzy Hash: 4D022D71E012199BDF14CFA9D8807AEBBF1FF48315F2482A9D919F7380DB31A9458B90

Function 00ADF810 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00ADF833
std::_Lockit::_Lockit.LIBCPMT ref: 00ADF855
std::_Lockit::~_Lockit.LIBCPMT ref: 00ADF875
std::_Lockit::~_Lockit.LIBCPMT ref: 00ADF89F
std::_Lockit::_Lockit.LIBCPMT ref: 00ADF90D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00ADF959
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00ADF973
std::_Lockit::~_Lockit.LIBCPMT ref: 00ADFA08
std::_Facet_Register.LIBCPMT ref: 00ADFA15

Strings

bad locale name, xrefs: 00ADFA2F
Ps, xrefs: 00ADF96B, 00ADF972

Memory Dump Source

Source File: 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000006.00000002.4111980092.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4112086502.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113915489.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114588753.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114920528.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$Ps
API String ID: 3375549084-1174896957
Opcode ID: e3d010db819d2ba949adbb9fd107647a8fe8e225c4fc84076c3ef0f27ac75fcf
Instruction ID: 38df27924287b8bdba71f8167509716181c8f6f3eff58b70e4349ee376f56cf7
Opcode Fuzzy Hash: e3d010db819d2ba949adbb9fd107647a8fe8e225c4fc84076c3ef0f27ac75fcf
Instruction Fuzzy Hash: DF616EB1D002489FEF20DFA4D845B9EBBF4AF15710F1841A9E816A7341EB74EA05CB92

Function 00A739F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00A73A58
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00A73AA4
__Getctype.LIBCPMT ref: 00A73ABA
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00A73AE6
std::_Lockit::~_Lockit.LIBCPMT ref: 00A73B7B

Strings

bad locale name, xrefs: 00A73B96

Memory Dump Source

Source File: 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000006.00000002.4111980092.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4112086502.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113915489.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114588753.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114920528.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: 7bb4de58a8d44943d33fb7d3e9407b12fee82f9a60f96baebc80b0d1b4934a9a
Instruction ID: 13f73beedc94de9d46bc43e4edce78056c9d25f3c738ebc1e0991ef726e0262d
Opcode Fuzzy Hash: 7bb4de58a8d44943d33fb7d3e9407b12fee82f9a60f96baebc80b0d1b4934a9a
Instruction Fuzzy Hash: 3D5130B2D012489BEF10DFA4DC45B9EBBF8AF54310F1481A9E809AB341E775DA08DB91

Function 00B52E10 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00B52E47
___except_validate_context_record.LIBVCRUNTIME ref: 00B52E4F
_ValidateLocalCookies.LIBCMT ref: 00B52ED8
__IsNonwritableInCurrentImage.LIBCMT ref: 00B52F03
_ValidateLocalCookies.LIBCMT ref: 00B52F58

Strings

csm, xrefs: 00B52EED

Memory Dump Source

Source File: 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000006.00000002.4111980092.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4112086502.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113915489.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114588753.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114920528.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: e98551110e5a50f17180e0d3840e447a36147e15659089685c48d3cd1e519ec2
Instruction ID: bf72ab0f317d4a9128e7928f2bb9fafa319f065582c9d0588044997eb2c39fc9
Opcode Fuzzy Hash: e98551110e5a50f17180e0d3840e447a36147e15659089685c48d3cd1e519ec2
Instruction Fuzzy Hash: 29419130A012099BCF10DF68D885B9EBBF5EF46315F1480D5ED189B392D731DA49CB90

Function 00ADDE70 Relevance: 9.1, APIs: 6, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00ADDE93
std::_Lockit::_Lockit.LIBCPMT ref: 00ADDEB6
std::_Lockit::~_Lockit.LIBCPMT ref: 00ADDED6
std::_Facet_Register.LIBCPMT ref: 00ADDF4B
std::_Lockit::~_Lockit.LIBCPMT ref: 00ADDF63
Concurrency::cancel_current_task.LIBCPMT ref: 00ADDF7B

Memory Dump Source

Source File: 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000006.00000002.4111980092.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4112086502.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113915489.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114588753.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114920528.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: c03016c01924e7dd2e343f5316efa6c5528a095dcd9aa44fc0f0f2ae2c1e6e16
Instruction ID: 0fe2e2e8b9442f6f31ac3a41cd8a7d107d977768cc5ff9ec9ebf5790aac0b60a
Opcode Fuzzy Hash: c03016c01924e7dd2e343f5316efa6c5528a095dcd9aa44fc0f0f2ae2c1e6e16
Instruction Fuzzy Hash: 7C41B2B1900215DFCF14DF58D845AAEBBF4FB05710F14466AE8169B392DB31AE05CBD1

Function 00A74C50 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 442COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00A74F72
___std_exception_destroy.LIBVCRUNTIME ref: 00A74FFF
___std_exception_copy.LIBVCRUNTIME ref: 00A750C8

Strings

recursive_directory_iterator::operator++, xrefs: 00A7504C

Memory Dump Source

Source File: 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000006.00000002.4111980092.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4112086502.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113915489.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114588753.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114920528.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$___std_exception_copy
String ID: recursive_directory_iterator::operator++
API String ID: 1206660477-953255998
Opcode ID: f61041b02dcce777b7efb80a637ca91e61f23187c2b3a857c138110da9025674
Instruction ID: 1d223d151804ccf9954e84bfec9eb3b6e269fdb1fcddcbae671971f847aa0def
Opcode Fuzzy Hash: f61041b02dcce777b7efb80a637ca91e61f23187c2b3a857c138110da9025674
Instruction Fuzzy Hash: 82E1E0719002059FCB28DF68CD45BAEB7F9FF48710F108A6DE45A97781E774AA04CBA1

Function 00A77820 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00A7799A
___std_exception_copy.LIBVCRUNTIME ref: 00A77B75

Strings

type_error, xrefs: 00A7784A
out_of_range, xrefs: 00A77A27

Memory Dump Source

Source File: 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000006.00000002.4111980092.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4112086502.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113915489.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114588753.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114920528.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: out_of_range$type_error
API String ID: 2659868963-3702451861
Opcode ID: 6bfa4a5049e065fe6ed3a58a1bfd0124992e5d7005f5817957fd539e0a02f634
Instruction ID: da9c46fa6771d612c9573084d4125abb46b7b1384140ed26eb9031cbb5b46f7e
Opcode Fuzzy Hash: 6bfa4a5049e065fe6ed3a58a1bfd0124992e5d7005f5817957fd539e0a02f634
Instruction Fuzzy Hash: 5FC157B1D002089FDB18DFA8D984B9DBBF5FF48300F14866AE419EB791E7749980CB54

Function 00A773B0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00A775BE
___std_exception_destroy.LIBVCRUNTIME ref: 00A775CD

Strings

at line , xrefs: 00A773F7
, column , xrefs: 00A77434, 00A7744A

Memory Dump Source

Source File: 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000006.00000002.4111980092.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4112086502.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113915489.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114588753.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114920528.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column
API String ID: 4194217158-191570568
Opcode ID: 9091a30999fdfebd5acf93302cc4f62311a63fcf42c23899d47e387fe6dc1cca
Instruction ID: 666b59668a73a8901c2a4ef0ca271b3ac13544a6a17c5819db1f196ace0c3bb4
Opcode Fuzzy Hash: 9091a30999fdfebd5acf93302cc4f62311a63fcf42c23899d47e387fe6dc1cca
Instruction Fuzzy Hash: 6961C171A042059FDB08DF68DD84BADBBF6FF44300F24C668E419A7782D774AA44CB91

Function 00A73D10 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00A73E7F

Strings

ios_base::badbit set, xrefs: 00A73E17
ios_base::eofbit set, xrefs: 00A73E41, 00A73E63
ios_base::failbit set, xrefs: 00A73D32

Memory Dump Source

Source File: 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000006.00000002.4111980092.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4112086502.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113915489.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114588753.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114920528.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: 28452488a43dcb035f3bf3b75a5b888a8a29e8abaa67a6f0c3779fcff7783aa4
Instruction ID: 059a8d05e346c8d8aa7e86a1f22bdcd0159f869fadf1bdf14e7aba4e97044fab
Opcode Fuzzy Hash: 28452488a43dcb035f3bf3b75a5b888a8a29e8abaa67a6f0c3779fcff7783aa4
Instruction Fuzzy Hash: 8641B4B3900209AFCB14DF68CC45BAEB7F8EF49310F14C56AF919D7641E770AA048BA4

Function 00A73DE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00A73E7F

Strings

ios_base::badbit set, xrefs: 00A73E17
ios_base::eofbit set, xrefs: 00A73E28, 00A73E41, 00A73E63
ios_base::failbit set, xrefs: 00A73D32, 00A73E1E

Memory Dump Source

Source File: 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000006.00000002.4111980092.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4112086502.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113915489.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114588753.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114920528.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: 424749cede513fc4d820d55567ff2eaf55e897bd98a72e7821cdb1c5453097bd
Instruction ID: 896b4465d931b0b46656993ec8364cea8a853c5827bd53b1dfbf60a5e67ae863
Opcode Fuzzy Hash: 424749cede513fc4d820d55567ff2eaf55e897bd98a72e7821cdb1c5453097bd
Instruction Fuzzy Hash: 5D2105B39047056FCB14DF58DC02B96B7E8AB04310F19C8BAFA6C8B641E770EA148B95

Function 00A76F40 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 349COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00A77340

Strings

parse error, xrefs: 00A76FFF, 00A77018
parse_error, xrefs: 00A76F8B

Memory Dump Source

Source File: 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000006.00000002.4111980092.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4112086502.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113915489.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114588753.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114920528.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: parse error$parse_error
API String ID: 2659868963-1820534363
Opcode ID: a36752a6cab398645f967befd0bb0e6696d44aa2d6791be29b7def99e181634e
Instruction ID: 4ab7e2da644a007e83129b465b72869f213f801c41b6c6fb47aea9b8ae204e06
Opcode Fuzzy Hash: a36752a6cab398645f967befd0bb0e6696d44aa2d6791be29b7def99e181634e
Instruction Fuzzy Hash: B7E14E719042449FDB18CF68CD84B9DBBF1BF49304F24C2A9E419AB792D7749A81CF91

Function 00A76C60 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00A76F11
___std_exception_destroy.LIBVCRUNTIME ref: 00A76F20

Strings

[json.exception., xrefs: 00A76CB8

Memory Dump Source

Source File: 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000006.00000002.4111980092.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4112086502.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113915489.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114588753.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114920528.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.
API String ID: 4194217158-791563284
Opcode ID: 8832be2fbdb71314eb89c9a2f451f452099b018f68f12edbacf093a47a539bae
Instruction ID: b1b1f4a20c4a095241b3334a6ac6a30061494df7035c7cad45ff5dcf89cd9f0d
Opcode Fuzzy Hash: 8832be2fbdb71314eb89c9a2f451f452099b018f68f12edbacf093a47a539bae
Instruction Fuzzy Hash: F591C370A006049FDB18CF68DD84BAEBBF5EF48300F20C56CE419AB792D771AA45CB91

Function 00AEE440 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00AEE491

Strings

type must be string, but is , xrefs: 00AEE4F8
type must be boolean, but is , xrefs: 00AEE582

Memory Dump Source

Source File: 00000006.00000002.4112086502.0000000000A71000.00000040.00000001.01000000.00000005.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000006.00000002.4111980092.0000000000A70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4112086502.0000000000BA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113915489.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000BAC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000D42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E25000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4113956720.0000000000E72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114588753.0000000000E73000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4114920528.000000000101B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a70000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: type must be boolean, but is $type must be string, but is
API String ID: 118556049-436076039
Opcode ID: 916f9bc2e0b82d72467c8625bfd0a54e5b9316dac33056446fd169f5e19f6bc6
Instruction ID: 68a442044b90205a71fcba8720537a9ec575fad64cf3470a1dec716514d64847
Opcode Fuzzy Hash: 916f9bc2e0b82d72467c8625bfd0a54e5b9316dac33056446fd169f5e19f6bc6
Instruction Fuzzy Hash: 49417CB5904288AFCB14EBA4DD02B9EB7E8DB00310F1486B9F419D77D1EB36AD44C396

Analysis Process: RageMP131.exePID: 7512, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	3.3%
Dynamic/Decrypted Code Coverage:	1.8%
Signature Coverage:	0%
Total number of Nodes:	1369
Total number of Limit Nodes:	79

Executed Functions

Function 00283A40 Relevance: 2.7, APIs: 2, Instructions: 157
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E9,?,00000001,00000000,?,?,?,?,?,?,?,?,00283DB6), ref: 00283B08
Sleep.KERNELBASE(00000001,?,00000001,00000000,?,?,?,?,?,?,?,?,00283DB6), ref: 00283BBA

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: c48ebb536889ffc06822d6d7de18641272100b2fe5f2821103d8f3fdcf9d6751
Instruction ID: 846ee1bd7b1c16da99e592af9241a5c266f4264b1dd9a9f6fe825da95d4745a3
Opcode Fuzzy Hash: c48ebb536889ffc06822d6d7de18641272100b2fe5f2821103d8f3fdcf9d6751
Instruction Fuzzy Hash: EC51CC39A152168FCB28DF58C4D0EA9B3B1FF44B08F284599D845AF392D731EE16CB80

Function 0023E0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 0023E0CB
socket.WS2_32(?,?,?), ref: 0023E17E
connect.WS2_32(00000000,?,?), ref: 0023E193
closesocket.WS2_32(00000000), ref: 0023E19E

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: 8c76401eaa658f031ddc59ecedf3e4b7a25d2cd5a165d4f9f05e29dd6c89aa47
Instruction ID: aaf35fe4c3da819b3218d2bf218a879c007f468a940f234f788848a109d45653
Opcode Fuzzy Hash: 8c76401eaa658f031ddc59ecedf3e4b7a25d2cd5a165d4f9f05e29dd6c89aa47
Instruction Fuzzy Hash: AE31D2B26053116BDB209F28DC4872BB7E4EB85734F110B1DF9E8A32D0D3359D188AA2

Function 002FF290 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0022220E

Strings

`!", xrefs: 002221FC
`!", xrefs: 00222216

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!"$`!"
API String ID: 2659868963-1599315490
Opcode ID: 36ec796986fb541a9252a135b842b418aa9656e4c26b8627fbc9e1bbf839fe65
Instruction ID: 711bbf83e50ea414fc4eef3d085cc69a644d0c00beb8b0452bddc74780f95ce5
Opcode Fuzzy Hash: 36ec796986fb541a9252a135b842b418aa9656e4c26b8627fbc9e1bbf839fe65
Instruction Fuzzy Hash: E101A77551030DBBCB19AFA8E8119A9B7ACDE00350B508435FF18DB591E770E9648791

Function 04BE000A Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 237
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`, xrefs: 04BE0124

Memory Dump Source

Source File: 00000007.00000002.4119527691.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4be0000_RageMP131.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: c34e028ecd2b0eb330c9312ad9f483b1da1397786046fd778876c89e651e6118
Instruction ID: 13206eb7c0e32ca19c7e7bf56e18fba4f9e9c5d4201fc7273828c4d5b5f9ea52
Opcode Fuzzy Hash: c34e028ecd2b0eb330c9312ad9f483b1da1397786046fd778876c89e651e6118
Instruction Fuzzy Hash: F25117F730C2307DB602A5526B94AFB67ADE6C673073088ABF407D6507F3D52A5A6132

Function 04BE00CD Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`, xrefs: 04BE0124

Memory Dump Source

Source File: 00000007.00000002.4119527691.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4be0000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID: `
API String ID: 2104809126-2679148245
Opcode ID: f93ff4e9d4c17b6135028367b4f18974f15c6f0235019ae25c5f270af6540740
Instruction ID: a4a1cb4441145a70581ce4ba8cc9a269c7313aecfc4192c33975b01c5e035995
Opcode Fuzzy Hash: f93ff4e9d4c17b6135028367b4f18974f15c6f0235019ae25c5f270af6540740
Instruction Fuzzy Hash: F94129F730C2306DB602E5926A94AFB6BADD6C673073088ABF407D6503E3D56A5A2131

Function 00304942 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

O0, xrefs: 00304A93, 00304A61, 00304AAB, 00304AC7

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID: O0
API String ID: 0-2750300066
Opcode ID: 4bf654208c2f4472802baa332f28a80ef4d18b107f99797f6d08dc08d37bf2ca
Instruction ID: 394063c2e7de0e5e58f7e0a0bad31c35c5d25527e322a32eb358e18e342f4d88
Opcode Fuzzy Hash: 4bf654208c2f4472802baa332f28a80ef4d18b107f99797f6d08dc08d37bf2ca
Instruction Fuzzy Hash: 4151C7B0B01208AFDF16CF58CC51AAA7BB5EF49354F258158F9499B292D371DF41CB90

Function 00314623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a04726c7e9921fdb3c0edea9a4e771df6f60af71ec93422dee5745386de71999
Instruction ID: 203721b8e10f6b7b23999dfc3a7c63e3f89b60cb1046cdc51def157c707d6f0e
Opcode Fuzzy Hash: a04726c7e9921fdb3c0edea9a4e771df6f60af71ec93422dee5745386de71999
Instruction Fuzzy Hash: 90B13470E04249AFDB1BDFA8D851BEEBBB9AF4D304F154158F450AB292C771AD81CB60

Function 0022A210 Relevance: 1.7, APIs: 1, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 0022A343

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 0de9245aa8b6cc1f0f036b69a85f6912dfdf545f45e94ec95c033cdb8199f636
Instruction ID: 8f799d7945475ea88ea231ea5de9556110343e469126e506eea610a928eeb966
Opcode Fuzzy Hash: 0de9245aa8b6cc1f0f036b69a85f6912dfdf545f45e94ec95c033cdb8199f636
Instruction Fuzzy Hash: 5A714870911214BFDB18DFA8EC45BAEBBE8EF41700F1085ADF8059B682D7B5DA50C792

Function 0031549C Relevance: 1.7, APIs: 1, Instructions: 198
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000000,00309087,?,00000000,00000000,00000000,?,00000000,?,0022A3EB,00309087,00000000,0022A3EB,?,?), ref: 00315621

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 72070c3e869d4366e0716d46c95cf3a2cd50a8a0b32ea45f10ba0c1887f6a2d3
Instruction ID: a7da6d64203dd7cce2c417072bf3c317c24349e641c245cc797b4d4c5ef42907
Opcode Fuzzy Hash: 72070c3e869d4366e0716d46c95cf3a2cd50a8a0b32ea45f10ba0c1887f6a2d3
Instruction Fuzzy Hash: 6761E471D00509EFDF1ADFA8C884EEEBBBAAF8D304F550145E800AB252D731D991CBA0

Function 04BE0167 Relevance: 1.7, APIs: 1, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04BE01FF

Memory Dump Source

Source File: 00000007.00000002.4119527691.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4be0000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 88febe3a796360c36d12b4d0b88d8f22a8ff52e48fa9159ec05f67ada43fd32e
Instruction ID: 5810a021a4f13feb2bff6b4d27e1cdca854d44c8a4b9f50ab9a19f447c328648
Opcode Fuzzy Hash: 88febe3a796360c36d12b4d0b88d8f22a8ff52e48fa9159ec05f67ada43fd32e
Instruction Fuzzy Hash: 083128F760C225AEF602A5529B90AFA67BDD7C673073049ABF407C6103E3D51A8A6172

Function 04BE0103 Relevance: 1.7, APIs: 1, Instructions: 169
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.4119527691.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4be0000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 4d23038514bed05ab958165bdbba610985f5e3e9a228df7597f2db22c3138776
Instruction ID: c8e9f2253e434feaf3d24f1fc30b0e84b3ffa98fa2183dc0f8304af79392de1e
Opcode Fuzzy Hash: 4d23038514bed05ab958165bdbba610985f5e3e9a228df7597f2db22c3138776
Instruction Fuzzy Hash: AC31C4EB20C2307DB642A4836B90AFB57ADD6C673073089ABF407D5506F3D52E9D2032

Function 04BE0144 Relevance: 1.6, APIs: 1, Instructions: 150
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04BE01FF

Memory Dump Source

Source File: 00000007.00000002.4119527691.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4be0000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: e601816dd4c78b7a800bba4dccf7feb64ed27dd42bd04f4884e8e6e1044c8e6f
Instruction ID: 653715feb6fcd0ab5e774b32a6c0a296591fcd340978939e01dca57c06c103b0
Opcode Fuzzy Hash: e601816dd4c78b7a800bba4dccf7feb64ed27dd42bd04f4884e8e6e1044c8e6f
Instruction Fuzzy Hash: D121BFEB20C1307D7602A5436B90AFB67AED6CA73073089ABF407D6506F3D56E992032

Function 04BE014D Relevance: 1.6, APIs: 1, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.4119527691.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4be0000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 5c7eb8214813ca476e98682de1d00fd8c0b4ae73db1de26c9c6e4c757b9ec4de
Instruction ID: 213bd5b4af8a440febe48bbc57524164ef8c74191b812265312f7d2780e97707
Opcode Fuzzy Hash: 5c7eb8214813ca476e98682de1d00fd8c0b4ae73db1de26c9c6e4c757b9ec4de
Instruction Fuzzy Hash: AF21E4FB20C1307DB642A5436B90AFB67ADD6D673073089ABF407D5506F7D52E992031

Function 00290560 Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 002906AE

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 8afb4dda31499439c88a46ee23b62ada0dab2499db7e3ac0cf80573aa4e67c72
Instruction ID: 12052af80230345eb13ed6e6d9b2918ed2bb9a18aaaed4ea6a9ee2bb06d4a994
Opcode Fuzzy Hash: 8afb4dda31499439c88a46ee23b62ada0dab2499db7e3ac0cf80573aa4e67c72
Instruction Fuzzy Hash: 4F411472A101189FCF15DF68D980AAEBBA9AF89340F150169FC05EB342D730DE709BE1

Function 04BE01F4 Relevance: 1.6, APIs: 1, Instructions: 127
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04BE01FF

Memory Dump Source

Source File: 00000007.00000002.4119527691.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4be0000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 5a8425bb488e4c3cedbbd81b49f29e92e20392cd1b01e0a3110b27fdf221dcd8
Instruction ID: 80c0e7bebade4de3605ba16987b4901dca4cb9807a9737dad6c131e730efc2f2
Opcode Fuzzy Hash: 5a8425bb488e4c3cedbbd81b49f29e92e20392cd1b01e0a3110b27fdf221dcd8
Instruction Fuzzy Hash: D921F8EB60C1307D7A01E443AB90AFA57ADE6CA730730859BF407C5506F3D56A8A6031

Function 04BE018D Relevance: 1.6, APIs: 1, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04BE01FF

Memory Dump Source

Source File: 00000007.00000002.4119527691.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4be0000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 903f3ea0eb584a98c996988e557482d5f1dbf3e68354f70e285e5cbbee3c0593
Instruction ID: bb7f732c2d6ba25ea8285c6221c266b19d9fc8c915874c8f2c50119f41088e75
Opcode Fuzzy Hash: 903f3ea0eb584a98c996988e557482d5f1dbf3e68354f70e285e5cbbee3c0593
Instruction Fuzzy Hash: 5B21D7FB60C1317D7641E042AB90AFA57AEE6CA73073085ABF807D5507F3D56E896071

Function 04BE01CE Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04BE01FF

Memory Dump Source

Source File: 00000007.00000002.4119527691.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4be0000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 80177f990a6084f336a8dcf750d560eacdcb1cb07c9acd7c0973cb2f9aa7c293
Instruction ID: 5a093b0ce06e4a2704f89b235c0d8a34c7193b41f8b8b94cf7447cff097387d8
Opcode Fuzzy Hash: 80177f990a6084f336a8dcf750d560eacdcb1cb07c9acd7c0973cb2f9aa7c293
Instruction Fuzzy Hash: 1A1129AB70C1306DAA41F193A7906FA2BEDD7DA73073089E7E407C9507F3D56A892031

Function 04BE01E7 Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04BE01FF

Memory Dump Source

Source File: 00000007.00000002.4119527691.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4be0000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: ff15d8ad6ec721dfb1abc20ba35c57cb8a1d6d502e1a95cb2092ac7e30783774
Instruction ID: 9b7ed1a8cf972988ae0a6ec1cfcf1ae206745f03e7406ce149939d0f68b7aa9a
Opcode Fuzzy Hash: ff15d8ad6ec721dfb1abc20ba35c57cb8a1d6d502e1a95cb2092ac7e30783774
Instruction Fuzzy Hash: 200149EB70C1306DAA42B0539A846FA1BADD7DA730B304996E40785503F3D57E852471

Function 00314B12 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,003149F9,00000000,CF830579,00351140,0000000C,00314AB5,00308BBD,?), ref: 00314B68

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: b3aa3f07f189473ee2a180f8edf222e22b62106be0e742c759fc86bd7f61838b
Instruction ID: dbae4278f7d4d4c3673a9bf33609c4219558eff71a1128b544e49e76efcc49ac
Opcode Fuzzy Hash: b3aa3f07f189473ee2a180f8edf222e22b62106be0e742c759fc86bd7f61838b
Instruction Fuzzy Hash: 8611483264911416D62F22746C02FFE6B998B8E775F3A8249F8889B1D2EE60E8C14295

Function 0030E05C Relevance: 1.6, APIs: 1, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00350DF8,0022A3EB,00000002,0022A3EB,00000000,?,?,?,0030E166,00000000,?,0022A3EB,00000002,00350DF8), ref: 0030E098

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 94b07340c25b3b508a635ea21005d3fee66eec0f6c05d3eb58db2ec087f411cb
Instruction ID: 3cd1fa9094af53aa60056ecc96dc52291a82c0780220770a4a8f366552c8c555
Opcode Fuzzy Hash: 94b07340c25b3b508a635ea21005d3fee66eec0f6c05d3eb58db2ec087f411cb
Instruction Fuzzy Hash: AE014932711105AFCF169F5ACC11C9E3B69DB81334F250248F8909B2D1EAB1ED418BD0

Function 003163F3 Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,003091F7,00000000,?,00315D79,00000001,00000364,00000000,00000006,000000FF,?,00000000,0030D244,003089C3,003091F7,00000000), ref: 00316434

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: faf66a4cec5286b6318975abbe6052cae69d23731e0576caf6ac0a43bb822310
Instruction ID: 3d3a34c0fd0f1280ada0400a5900162ee3773fcc191f02bc06abaa63e1ddb0dc
Opcode Fuzzy Hash: faf66a4cec5286b6318975abbe6052cae69d23731e0576caf6ac0a43bb822310
Instruction Fuzzy Hash: A1F0B43250522467DB2B6BE39C03BDA3B8C9F49760B268025A804AA590CF20EC8186E1

Function 00293460 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 002934B4

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 004e3c030bac6900f95d76ad2c7de421effcc3f162b0ab6b557a499adc87367b
Instruction ID: c343b50dce8ab253c4b56dedb7556423beb5945c45a76d9b94ea362ec13b9317
Opcode Fuzzy Hash: 004e3c030bac6900f95d76ad2c7de421effcc3f162b0ab6b557a499adc87367b
Instruction Fuzzy Hash: 6BF027B602010D0EEF19EBF0A51696FB3D88E50390B01443AF919CB653EB2AEAB8C555

Function 00316E2D Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0031D635,4D88C033,?,0031D635,00000220,?,003157EF,4D88C033), ref: 00316E60

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f1af0a3a61052c6efc4f1c5bb2d39bf6101b4a19208d4edb17e0049a7d701f56
Instruction ID: 7364399333abbc1d2bf84f2982510842ef5cd810fb5caed085f94f780bf5ab7b
Opcode Fuzzy Hash: f1af0a3a61052c6efc4f1c5bb2d39bf6101b4a19208d4edb17e0049a7d701f56
Instruction Fuzzy Hash: 87E0ED3910162166DE3B22E5EF12BDB768CCF8A3A1F060720BC049A4D0CB20C88081F8

Non-executed Functions

Function 003084A0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction ID: 0e15362745e9895f8ab240e5826507b9ac65b879297298c3367d227b04ef3e85
Opcode Fuzzy Hash: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction Fuzzy Hash: 3C024B71E012199BDF15CFA8C890AAEFBF1FF48314F258269D959E7380DB31A941CB94

Function 0028F810 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0028F833
std::_Lockit::_Lockit.LIBCPMT ref: 0028F855
std::_Lockit::~_Lockit.LIBCPMT ref: 0028F875
std::_Lockit::~_Lockit.LIBCPMT ref: 0028F89F
std::_Lockit::_Lockit.LIBCPMT ref: 0028F90D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0028F959
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0028F973
std::_Lockit::~_Lockit.LIBCPMT ref: 0028FA08
std::_Facet_Register.LIBCPMT ref: 0028FA15

Strings

bad locale name, xrefs: 0028FA2F
"4, xrefs: 0028F96B, 0028F972

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$"4
API String ID: 3375549084-3434465823
Opcode ID: 71fba6ae293065c26d60798ac707a56392d14a75954feca8c2b23fbb2cbb4de1
Instruction ID: 18db57f2bd5518f666affe7b4f0954cc542d08fb880fb98e6cca806cae104b0f
Opcode Fuzzy Hash: 71fba6ae293065c26d60798ac707a56392d14a75954feca8c2b23fbb2cbb4de1
Instruction Fuzzy Hash: 5461DFB5D212099FEF11EFA4D945BAEBBF4AF14750F140078E804AB391EB70E914CBA1

Function 00223D10 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00223E7F

Strings

ios_base::eofbit set, xrefs: 00223E41, 00223E63
@3", xrefs: 00223DBE, 00223E9B
G>", xrefs: 00223DB8
ios_base::badbit set, xrefs: 00223E17
`!", xrefs: 00223E70
@3", xrefs: 00223E84
ios_base::failbit set, xrefs: 00223D32
G>", xrefs: 00223D2B, 00223D67, 00223D6A

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: @3"$@3"$G>"$G>"$`!"$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-956037866
Opcode ID: a1fe4e812b8e86c6d114c96cb5ad3332a1beff58a750652e6eae57fc1b7f87a2
Instruction ID: 986d62206dc3efda9b4777cd9f4f06cdcfb15efe0b8aa0efb497171fb41f4d6a
Opcode Fuzzy Hash: a1fe4e812b8e86c6d114c96cb5ad3332a1beff58a750652e6eae57fc1b7f87a2
Instruction Fuzzy Hash: DE41F8B6910218AFCB04DF98D841BEEB7F8EF49710F14852AF915E7741E774AA14CBA0

Function 00302E10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00302E47
___except_validate_context_record.LIBVCRUNTIME ref: 00302E4F
_ValidateLocalCookies.LIBCMT ref: 00302ED8
__IsNonwritableInCurrentImage.LIBCMT ref: 00302F03
_ValidateLocalCookies.LIBCMT ref: 00302F58

Strings

i5, xrefs: 00302F78
csm, xrefs: 00302EED

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: i5$csm
API String ID: 1170836740-665140769
Opcode ID: 24dc7c5519611c1b2c5330928abfa050b3e30bd1fd132f159d93054b5f048e2e
Instruction ID: 1005daeedd59d601c45edfb1bda55eeab5e4755c0a8d9ac856e6e131d8afa9f9
Opcode Fuzzy Hash: 24dc7c5519611c1b2c5330928abfa050b3e30bd1fd132f159d93054b5f048e2e
Instruction Fuzzy Hash: 0741E630A01209ABCF12DF68C8A9A9FBBB9AF44324F148055FD149B3D2D731EE55CB90

Function 00223DE0 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 79COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00223E7F

Strings

ios_base::eofbit set, xrefs: 00223E28, 00223E41, 00223E63
@3", xrefs: 00223DBE, 00223E9B
ios_base::badbit set, xrefs: 00223E17
`!", xrefs: 00223E70
@3", xrefs: 00223E84
ios_base::failbit set, xrefs: 00223D32, 00223E1E

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: @3"$@3"$`!"$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-108183131
Opcode ID: 461ff189b6c88cecf971a462d53dfdf55009d5550d66a07e872c03249abfd1e5
Instruction ID: f22101a67cea087efa947bca2f41254cd4062ed22376cce1c43ad23371f4dcc8
Opcode Fuzzy Hash: 461ff189b6c88cecf971a462d53dfdf55009d5550d66a07e872c03249abfd1e5
Instruction Fuzzy Hash: 75212BB65107157FC715DF98E801B96B7E8AF04310F18883AFE689B641E7B4EA24CB90

Function 00224C50 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 442COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00224F72
___std_exception_destroy.LIBVCRUNTIME ref: 00224FFF
___std_exception_copy.LIBVCRUNTIME ref: 002250C8

Strings

`!", xrefs: 00224F6B, 00224FF8, 002250B9
@3", xrefs: 002250CD
recursive_directory_iterator::operator++, xrefs: 0022504C

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$___std_exception_copy
String ID: @3"$`!"$recursive_directory_iterator::operator++
API String ID: 1206660477-441038987
Opcode ID: 3c984c599464f7708f9a11be158730619733e06ae9cd25c8ae5d3464386aa76b
Instruction ID: 78f2408fc358ae00273829a6351693c7bdcccca4771ba7aff86d824053450d83
Opcode Fuzzy Hash: 3c984c599464f7708f9a11be158730619733e06ae9cd25c8ae5d3464386aa76b
Instruction Fuzzy Hash: 85E12571910214AFDB28EFA8E845BAEF7F9FF44700F104A2DE41697781D774AA14CBA1

Function 00227820 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0022799A
___std_exception_copy.LIBVCRUNTIME ref: 00227B75

Strings

out_of_range, xrefs: 00227A27
type_error, xrefs: 0022784A
`!", xrefs: 00227985, 00227B60
`!", xrefs: 002279A5, 00227B80

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!"$`!"$out_of_range$type_error
API String ID: 2659868963-4088840996
Opcode ID: f3b2904c7ad04a7ac26de578cebcebc3c67b60ed228da715b889a3c6e6570d98
Instruction ID: a488cffb622bd771bccbdff74e65bfa1e5a8606fb203ab48ebbe0496e6bab297
Opcode Fuzzy Hash: f3b2904c7ad04a7ac26de578cebcebc3c67b60ed228da715b889a3c6e6570d98
Instruction Fuzzy Hash: 7CC179B19142189FDB08CFA8E98479DFBF5FF49300F148269E419EB781E774A980CB50

Function 00223190 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 170COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 002232C6
___std_exception_destroy.LIBVCRUNTIME ref: 00223350

Strings

`!", xrefs: 002232AD, 00223349
@3", xrefs: 00223316
+4", xrefs: 00223190
`!", xrefs: 002232D1

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: +4"$@3"$`!"$`!"
API String ID: 2970364248-3171281168
Opcode ID: 2eb47523b7142958c8b9aa88e4e25dcd8b2ad4c7b5ec5d3c62be4b49343335b2
Instruction ID: 00cf95ea5ebe82e96ce617bb3b05538e7ef1e5bb76d3e8dd5ff559daa5f46100
Opcode Fuzzy Hash: 2eb47523b7142958c8b9aa88e4e25dcd8b2ad4c7b5ec5d3c62be4b49343335b2
Instruction Fuzzy Hash: 0651BF71910218AFDB09CF98D885BEEBBF9FF49300F14812AF815A7391D7749A51CB90

Function 002239F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00223A58
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00223AA4
__Getctype.LIBCPMT ref: 00223ABA
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00223AE6
std::_Lockit::~_Lockit.LIBCPMT ref: 00223B7B

Strings

bad locale name, xrefs: 00223B96

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: b9475e10338f316e019946b472dbda58da4f4792c532a06e9da8655e7e36e937
Instruction ID: e8af071b252a381c908e1e6f86a2bcf6d018afac982573c46d7ec8f59dfefc19
Opcode Fuzzy Hash: b9475e10338f316e019946b472dbda58da4f4792c532a06e9da8655e7e36e937
Instruction Fuzzy Hash: C65181B1D10218AFDF11DFE4D845B9EBBF8AF14714F144069E909AB381E778EA14CB51

Function 0028DE70 Relevance: 9.1, APIs: 6, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0028DE93
std::_Lockit::_Lockit.LIBCPMT ref: 0028DEB6
std::_Lockit::~_Lockit.LIBCPMT ref: 0028DED6
std::_Facet_Register.LIBCPMT ref: 0028DF4B
std::_Lockit::~_Lockit.LIBCPMT ref: 0028DF63
Concurrency::cancel_current_task.LIBCPMT ref: 0028DF7B

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 4bf9923af9929af9c5b3fa4f5861fb0739ba4e48b2c9d48728e64774f23a2dcd
Instruction ID: 184aa7d673d33c7614ee78ee66dd4f2f2d896911e9055e273597f9a2fe0b1d11
Opcode Fuzzy Hash: 4bf9923af9929af9c5b3fa4f5861fb0739ba4e48b2c9d48728e64774f23a2dcd
Instruction Fuzzy Hash: 3B4105799212199FCB15EF54D841B6EBBB8FB20750F144268E9059B3E2D730AD24CFD1

Function 00226F40 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 349COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00227340

Strings

parse_error, xrefs: 00226F8B
`!", xrefs: 00227328
`!", xrefs: 0022734B
parse error, xrefs: 00226FFF, 00227018

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!"$`!"$parse error$parse_error
API String ID: 2659868963-1134234602
Opcode ID: 2ef8bf996febb9c94f310b0fdee7bf64d21bff3fc4d048e43420e337dc1e9f68
Instruction ID: 3417f8d2c26fedfdd2d6587d85a1960698b9eb99bc6f3a773e9d7849250630d2
Opcode Fuzzy Hash: 2ef8bf996febb9c94f310b0fdee7bf64d21bff3fc4d048e43420e337dc1e9f68
Instruction Fuzzy Hash: 42E190709142189FDB18CFA8D88479DBBF5FF49300F2482A9E418EB792D774AA91CF50

Function 002273B0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 002275BE
___std_exception_destroy.LIBVCRUNTIME ref: 002275CD

Strings

`!", xrefs: 002275B6, 002275C6
, column , xrefs: 00227434, 0022744A
at line , xrefs: 002273F7

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column $`!"
API String ID: 4194217158-499326956
Opcode ID: 1ca339b7b9ff87553616978a5407d908f03393d105e50057efdc78fd177fb5f8
Instruction ID: 26e38b049060c617f4fa516276590e1da6a8faead548e671300e916148965055
Opcode Fuzzy Hash: 1ca339b7b9ff87553616978a5407d908f03393d105e50057efdc78fd177fb5f8
Instruction Fuzzy Hash: 4961F670A14215AFDB08DFA8EC84B9DFBB5FF45300F644628F415A7781D774AA64CB90

Function 00223370 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

APIs

Part of subcall function 00223190: ___std_exception_copy.LIBVCRUNTIME ref: 002232C6

___std_exception_copy.LIBVCRUNTIME ref: 0022345F

Strings

@3", xrefs: 002233F3, 0022347B
`!", xrefs: 00223450
@3", xrefs: 00223464
+4", xrefs: 002233B3, 00223410

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: +4"$@3"$@3"$`!"
API String ID: 2659868963-1017541404
Opcode ID: c19bda138227c8b4acceac0ca2bd67c40c9f503f6edb03bcdd0f8b1b3daee13d
Instruction ID: 3205a8271c47af3353714eb4ca41e5790bf7fd0a4e32b948ef78b225f2aabc7c
Opcode Fuzzy Hash: c19bda138227c8b4acceac0ca2bd67c40c9f503f6edb03bcdd0f8b1b3daee13d
Instruction Fuzzy Hash: 563183B5900219AFCB19DFA8D841AEEFBF9FF08710F10856AE514E7641E774A650CB90

Function 00223410 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 47COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0022345F

Strings

@3", xrefs: 002233F3, 0022347B
`!", xrefs: 00223450
@3", xrefs: 00223464
+4", xrefs: 002233B3, 00223410

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: +4"$@3"$@3"$`!"
API String ID: 2659868963-1017541404
Opcode ID: d793f92d6042dd36f368130d28799db8ba156c61fc86472878c747998e233332
Instruction ID: fade0ed19c5f945895701664d35b1001620c689d2cde3220a1238a0c7af254f6
Opcode Fuzzy Hash: d793f92d6042dd36f368130d28799db8ba156c61fc86472878c747998e233332
Instruction Fuzzy Hash: B3014FB6500219AFC709DFA9E401C96FBFCEF04310B00843AE51987611E7B0E524CF90

Function 00226C60 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 247COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00226F11
___std_exception_destroy.LIBVCRUNTIME ref: 00226F20

Strings

[json.exception., xrefs: 00226CB8
`!", xrefs: 00226F09, 00226F19

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.$`!"
API String ID: 4194217158-420608075
Opcode ID: 471a0a8a1c272b6679b0abf4be0f88dd43bab17b3e691e82889d128d9e07e211
Instruction ID: 8f14c163d8835d78a84180a1d1423fd15f9dac5543cb5e01b9405dc96e774017
Opcode Fuzzy Hash: 471a0a8a1c272b6679b0abf4be0f88dd43bab17b3e691e82889d128d9e07e211
Instruction Fuzzy Hash: 39910771A10208AFDB18CFA8D988B9EFBF6FF45300F20856DE415AB792D771A951CB50

Function 00222270 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 218COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00222275

Part of subcall function 002FD6E9: std::invalid_argument::invalid_argument.LIBCONCRT ref: 002FD6F5

Strings

string too long, xrefs: 00222270
L5, xrefs: 00222427
L5, xrefs: 00222347

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: string too long$L5$L5
API String ID: 1997705970-1140454669
Opcode ID: d94d1c15d1a66b5b0bf520cb64902a36cd69095d3af785b71fc7813d7feaddf0
Instruction ID: 5cacd00fe4389ce65c05a25c450b1b729eff51fe102f69f3c70f23506ec5785d
Opcode Fuzzy Hash: d94d1c15d1a66b5b0bf520cb64902a36cd69095d3af785b71fc7813d7feaddf0
Instruction Fuzzy Hash: 1E816535A14295FFCB06CFA8D450BEDBFB5EF5A300F1841AAC894A7342C3768559CBA0

Function 00227620 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 167COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 002277B4

Strings

`!", xrefs: 0022779F
invalid_iterator, xrefs: 00227656
`!", xrefs: 002277BF

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!"$`!"$invalid_iterator
API String ID: 2659868963-1673871702
Opcode ID: ccb096bec8da88c106f77c3f486662282cf30bb80f81ea9d879bd81075e8a9bf
Instruction ID: dd387d85dee1a9859ed81ce90c4265556f528f5f52ff579137c5f7e5a704497b
Opcode Fuzzy Hash: ccb096bec8da88c106f77c3f486662282cf30bb80f81ea9d879bd81075e8a9bf
Instruction Fuzzy Hash: 555168B49042089FDB09CFA8E99479DFBF5FF49300F148669E419EB791E774A980CB90

Function 00227BE0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 156COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00227D67

Strings

other_error, xrefs: 00227C0A
`!", xrefs: 00227D52
`!", xrefs: 00227D72

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!"$`!"$other_error
API String ID: 2659868963-3199201282
Opcode ID: 17eebf203d6030155c347d50f0291e1ac3aa68219c72c3ed550d4aa9e0d19f14
Instruction ID: 0ee71784a0b786b9b5d724684520ee3120ca85e69f4cb07922fad4009ed80f6f
Opcode Fuzzy Hash: 17eebf203d6030155c347d50f0291e1ac3aa68219c72c3ed550d4aa9e0d19f14
Instruction Fuzzy Hash: 165179B09142489FDB08CFA8E8847ADFBF5BF49300F148669E419EB781E774A980CB50

Function 0028D050 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0028D06F
___std_exception_copy.LIBVCRUNTIME ref: 0028D096

Strings

`!", xrefs: 0028D060, 0028D085
`!", xrefs: 0028D09B

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!"$`!"
API String ID: 2659868963-1599315490
Opcode ID: c886cba7ef34ed4228f1c193cedb79fe3252122ec382d1db4ccb85de395db2b2
Instruction ID: d379381fc1f5333b32ac03d168196148b142be1afa0a52b2a4e9f2b3a98f55c9
Opcode Fuzzy Hash: c886cba7ef34ed4228f1c193cedb79fe3252122ec382d1db4ccb85de395db2b2
Instruction Fuzzy Hash: EE01A8B6500615AFC709DF59D545982FBF8FB45710710853BA529CBB10D7B0E528CFA0

Function 0029B3C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0029B3DF
___std_exception_copy.LIBVCRUNTIME ref: 0029B406

Strings

`!", xrefs: 0029B3D0, 0029B3F5
`!", xrefs: 0029B40E

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!"$`!"
API String ID: 2659868963-1599315490
Opcode ID: 4ed869cd28622bbe04335a28791b862d9e8429a9bd1df1d0924bad16bca0d694
Instruction ID: bd724b32999c924496ba743e8e350f03ab66022f47ad07c0342fa7268dc48b55
Opcode Fuzzy Hash: 4ed869cd28622bbe04335a28791b862d9e8429a9bd1df1d0924bad16bca0d694
Instruction Fuzzy Hash: DBF0C4BA50061AAFC70ADF58D505986FBF8FA45710711853BE52ACBB00E7B0E528CBA0

Function 0029B450 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 190COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0029B612

Strings

invalid hash bucket count, xrefs: 0029B60D
Px), xrefs: 0029B456, 0029B5BA, 0029B5F3, 0029B54A, 0029B4F1

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_
String ID: Px)$invalid hash bucket count
API String ID: 909987262-2882725661
Opcode ID: bc1779a20507995047b1f04cf97864b136526bed1ea292dd695f1395653cb32b
Instruction ID: 1d0d4d6c25f1d13771709ff56b2ce79c70110adcc62f35d9fb36ab0c997405bb
Opcode Fuzzy Hash: bc1779a20507995047b1f04cf97864b136526bed1ea292dd695f1395653cb32b
Instruction Fuzzy Hash: C67110B4A10609DFCB15CF49D28086AFBF9FF88300764C5AAD8599B355D731EA61CF90

Function 0029E440 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0029E491

Strings

type must be boolean, but is , xrefs: 0029E582
type must be string, but is , xrefs: 0029E4F8

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: type must be boolean, but is $type must be string, but is
API String ID: 118556049-436076039
Opcode ID: 4973d79152d5a37eb04f31c3fddb097e915a87e1c9a59012b12a41f86b9b92e3
Instruction ID: b4659b11eadb704cd7ac288c66c27dd43deebaa412c11008431f9dafdaff37d7
Opcode Fuzzy Hash: 4973d79152d5a37eb04f31c3fddb097e915a87e1c9a59012b12a41f86b9b92e3
Instruction Fuzzy Hash: 87417AB5910248AFCF15EBA4E812B9EB7A8DB10300F144678F815D76C2EB35A964CB92

Function 00223050 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00223078

Strings

`!", xrefs: 00223063
`!", xrefs: 00223080

Memory Dump Source

Source File: 00000007.00000002.4113799274.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.4112190733.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4113799274.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114042787.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114084490.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114695578.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.4114965276.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!"$`!"
API String ID: 2659868963-1599315490
Opcode ID: 5598f2895bf776948ad46e180210ecdefcbfe18d5f2ea42864490af7bc983e19
Instruction ID: e8dfa3865ee76a8725314a5707e52fbdc186ffbbf71bae73a93a11b7ae5cb687
Opcode Fuzzy Hash: 5598f2895bf776948ad46e180210ecdefcbfe18d5f2ea42864490af7bc983e19
Instruction Fuzzy Hash: A9E0EDB69012189FC711DFA8990598AFBF8AB19701F1086BAE948DB200F6B195548BD1

Analysis Process: RageMP131.exePID: 7820, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	3%
Dynamic/Decrypted Code Coverage:	3.2%
Signature Coverage:	0%
Total number of Nodes:	682
Total number of Limit Nodes:	75

Executed Functions

Function 00283A40 Relevance: 2.7, APIs: 2, Instructions: 157
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E9,?,00000001,00000000,?,?,?,?,?,?,?,?,00283DB6), ref: 00283B08
Sleep.KERNELBASE(00000001,?,00000001,00000000,?,?,?,?,?,?,?,?,00283DB6), ref: 00283BBA

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 5b0a46ea9cdfacd049f92b825fb4cee0e62af97ad1ee6963ec02ac3e2b40bd7b
Instruction ID: f890273ac973af59f1212fdc7b768015b94ca05982a0335733a44a02accbf926
Opcode Fuzzy Hash: 5b0a46ea9cdfacd049f92b825fb4cee0e62af97ad1ee6963ec02ac3e2b40bd7b
Instruction Fuzzy Hash: 4751CC39A152168FCB28DF58C4D0EA9B3B1FF44B08F28459AD845AF391D731EE15CB80

Function 0023E0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 0023E0CB
socket.WS2_32(?,?,?), ref: 0023E17F
connect.WS2_32(00000000,?,?), ref: 0023E192
closesocket.WS2_32(00000000), ref: 0023E19E

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: 07cb1ac4c525f5a54b9cfc399f1bbe1c25f7888098408c3acd241ab47776ec21
Instruction ID: 64aa15dbdec2dd0ce14611932baec1de1b7e020c0b3bb7427cdaee33eaa294e2
Opcode Fuzzy Hash: 07cb1ac4c525f5a54b9cfc399f1bbe1c25f7888098408c3acd241ab47776ec21
Instruction Fuzzy Hash: 9831B2B26153116BDB209F68D84872BB7E4EB85734F014F1DF9E8A72D0D3359D188BA2

Function 002FF290 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0022220E

Strings

`!", xrefs: 002221FC
`!", xrefs: 00222216

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!"$`!"
API String ID: 2659868963-1599315490
Opcode ID: 36ec796986fb541a9252a135b842b418aa9656e4c26b8627fbc9e1bbf839fe65
Instruction ID: 711bbf83e50ea414fc4eef3d085cc69a644d0c00beb8b0452bddc74780f95ce5
Opcode Fuzzy Hash: 36ec796986fb541a9252a135b842b418aa9656e4c26b8627fbc9e1bbf839fe65
Instruction Fuzzy Hash: E101A77551030DBBCB19AFA8E8119A9B7ACDE00350B508435FF18DB591E770E9648791

Function 00304942 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

O0, xrefs: 00304A93, 00304A61, 00304AAB, 00304AC7

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID: O0
API String ID: 0-2750300066
Opcode ID: 4bf654208c2f4472802baa332f28a80ef4d18b107f99797f6d08dc08d37bf2ca
Instruction ID: 394063c2e7de0e5e58f7e0a0bad31c35c5d25527e322a32eb358e18e342f4d88
Opcode Fuzzy Hash: 4bf654208c2f4472802baa332f28a80ef4d18b107f99797f6d08dc08d37bf2ca
Instruction Fuzzy Hash: 4151C7B0B01208AFDF16CF58CC51AAA7BB5EF49354F258158F9499B292D371DF41CB90

Function 00314623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97b0726e1d9e11fc743ff026170cd08c18a1f0f01e838ce2e9cad46a90fc1377
Instruction ID: 55d5d82ba1fafec90fe5094a13b0643d64abcfdf7844795ac76b5ff2a8300ec8
Opcode Fuzzy Hash: 97b0726e1d9e11fc743ff026170cd08c18a1f0f01e838ce2e9cad46a90fc1377
Instruction Fuzzy Hash: C3B13470E04249AFDB1BDFA8D851BEEBBB9AF4D300F144158F550AB292C771AD81CB60

Function 04B707B6 Relevance: 1.8, APIs: 1, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04B7083F

Memory Dump Source

Source File: 00000009.00000002.4119330478.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4b70000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 6783cb0061e3034e27b53aa1809130f92f1e621fdf13c8649a003fe70a95b2c1
Instruction ID: 4a6351caec76cb04470d3301eaadb3be5f1a7bd60806ab0cd5d8dd2bf670ab1a
Opcode Fuzzy Hash: 6783cb0061e3034e27b53aa1809130f92f1e621fdf13c8649a003fe70a95b2c1
Instruction Fuzzy Hash: 7841E3EB34C115BCB552A1452B14AFA6BBEE6E733073084B7F427D6202F2C46E4A7571

Function 04B70752 Relevance: 1.8, APIs: 1, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04B7083F

Memory Dump Source

Source File: 00000009.00000002.4119330478.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4b70000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: a6d00a61d607faffb129b4a09b1ca495cdf3a124d3a68fa4c10e292664a235d9
Instruction ID: 4c66284c24a11fc697c3eac503f2dbc7e4ad9b0642726b2460f034fcbabb8590
Opcode Fuzzy Hash: a6d00a61d607faffb129b4a09b1ca495cdf3a124d3a68fa4c10e292664a235d9
Instruction Fuzzy Hash: 4F41E3EB74C115BCB152A1852B10AFA6B6EE6E7330B3084F7F427D6202F2C42E4A7571

Function 0022A210 Relevance: 1.7, APIs: 1, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 0022A343

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 33bd6c796651e22e8e0eb429b3166b7ef400354e1dc2eeda1361fe122e35dbb7
Instruction ID: 38ce0930f14c508a1213ce8b0c84e9f4b9bc3cb5a7c1c4429aeb6e4590f23233
Opcode Fuzzy Hash: 33bd6c796651e22e8e0eb429b3166b7ef400354e1dc2eeda1361fe122e35dbb7
Instruction Fuzzy Hash: 3D714A70911214BFDB18DFA8DC45BAEBBE8EF41700F1085ADF8059B682D7B5DA50C792

Function 04B707B0 Relevance: 1.7, APIs: 1, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04B7083F

Memory Dump Source

Source File: 00000009.00000002.4119330478.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4b70000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: d6065b67cf610b92a9c18648671ce583138d087afef028862339030a16a37aab
Instruction ID: 7ad8bfcdd80965bd47a60b3102c31e8d7e5fc40d179a44199dfc3400bc563d32
Opcode Fuzzy Hash: d6065b67cf610b92a9c18648671ce583138d087afef028862339030a16a37aab
Instruction Fuzzy Hash: D341B0EB34C115BCB152A1452B24AFA666EE7E7330B3084B7F427D6202F2C46E4E7170

Function 04B707E2 Relevance: 1.7, APIs: 1, Instructions: 217
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04B7083F

Memory Dump Source

Source File: 00000009.00000002.4119330478.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4b70000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 355e28bfb45afc97ca1d5c40d181fde493264aa274ee77ed1c329ec7717745ba
Instruction ID: e1717d2bce86abf7354b12a22e6d1f29347197446bd956a1cd053b1fc028e0ca
Opcode Fuzzy Hash: 355e28bfb45afc97ca1d5c40d181fde493264aa274ee77ed1c329ec7717745ba
Instruction Fuzzy Hash: C54190EB34C115BCB152A1452B14AFA6A6DE6E773073084B7F827D6202F2C46E4E7171

Function 04B707F5 Relevance: 1.7, APIs: 1, Instructions: 209
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04B7083F

Memory Dump Source

Source File: 00000009.00000002.4119330478.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4b70000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 67304dcc38f7318b68e8498625a84ace913953e94cec324b855ed10ee330a165
Instruction ID: 659e606ed378e554791b77cf0d4d01a6888e774d7c6703b8a56f5cc70c1aeaa4
Opcode Fuzzy Hash: 67304dcc38f7318b68e8498625a84ace913953e94cec324b855ed10ee330a165
Instruction Fuzzy Hash: B54191EB74C115BCB142A1452B14AFA6AAEE6E6730B3084B7F427D6102F2D86F4E7171

Function 04B70818 Relevance: 1.7, APIs: 1, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04B7083F

Memory Dump Source

Source File: 00000009.00000002.4119330478.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4b70000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: dc2aa0582cfc82485a28fe0794a52267e9ba5abd577d676f2198c834a586ff02
Instruction ID: f1e664d872d85f20fed9984096509b9afd1e309e7103ce75bef85f15c43557c1
Opcode Fuzzy Hash: dc2aa0582cfc82485a28fe0794a52267e9ba5abd577d676f2198c834a586ff02
Instruction Fuzzy Hash: DD41A0EB74C111BCB142A1852B24AFA6A7DE6E6330B3084B7F427D6602F2C46F4E7171

Function 0031549C Relevance: 1.7, APIs: 1, Instructions: 198
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000000,00309087,?,00000000,00000000,00000000,?,00000000,?,0022A3EB,00309087,00000000,0022A3EB,?,?), ref: 00315621

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 1642c5b298f2dd81213779d63ca286a040edd7fc507130135eb4329955fea5ce
Instruction ID: a457f79464b07067fa10783d6a7d78c6d603079c3bbe03ed417c7b5823a76278
Opcode Fuzzy Hash: 1642c5b298f2dd81213779d63ca286a040edd7fc507130135eb4329955fea5ce
Instruction Fuzzy Hash: 4B61D471D00509EFDF1ADFA8C844EEEBBBAAF8D304F550145E800AB256D771D991CBA0

Function 04B70835 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04B7083F

Memory Dump Source

Source File: 00000009.00000002.4119330478.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4b70000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: f0c868d0191c9686ea22db64f4b434e9d4eca54195b3808d7aa05bc7591e5f83
Instruction ID: f2f55d8a6436f3db15a0618f35b39792f8d422f0f3d701f135de858cfc608a66
Opcode Fuzzy Hash: f0c868d0191c9686ea22db64f4b434e9d4eca54195b3808d7aa05bc7591e5f83
Instruction Fuzzy Hash: AB3180EB74C115BDB142A1852B14AFA6A6DE6E6330B3084B7F427D6102F2D46E4E7171

Function 04B70828 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04B7083F

Memory Dump Source

Source File: 00000009.00000002.4119330478.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4b70000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 2505dfc98fa120b5a1fa5da9ffcbb1ef7f960d51d52ec4d527fd27b04dd57bb7
Instruction ID: 08ec877ca513120715f79ec3f7d2ca5f8c4b7480ec50c001872050dc5cb771ab
Opcode Fuzzy Hash: 2505dfc98fa120b5a1fa5da9ffcbb1ef7f960d51d52ec4d527fd27b04dd57bb7
Instruction Fuzzy Hash: 4431A2EB74C111BCB142A1452B14AFA6A7DE6E6730B3084B7F427D6202F2D46E4E7171

Function 00290560 Relevance: 1.6, APIs: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 002906AE

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction ID: 12052af80230345eb13ed6e6d9b2918ed2bb9a18aaaed4ea6a9ee2bb06d4a994
Opcode Fuzzy Hash: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction Fuzzy Hash: 4F411472A101189FCF15DF68D980AAEBBA9AF89340F150169FC05EB342D730DE709BE1

Function 00314B12 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,003149F9,00000000,CF830579,00351140,0000000C,00314AB5,00308BBD,?), ref: 00314B68

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 9e6d5fd20d4368c8c83ca61d0d41e85b7b779c2878417573cfa5bdafe05a4939
Instruction ID: c42860b4ef1372a75405868a40561432c8fb07f6f2d37b4b33932815a5711c4d
Opcode Fuzzy Hash: 9e6d5fd20d4368c8c83ca61d0d41e85b7b779c2878417573cfa5bdafe05a4939
Instruction Fuzzy Hash: 1511483264A11416D62F22746C02BFE679D8B8E775F3B4209F8949B1D2EE60E8C14195

Function 0030E05C Relevance: 1.6, APIs: 1, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00350DF8,0022A3EB,00000002,0022A3EB,00000000,?,?,?,0030E166,00000000,?,0022A3EB,00000002,00350DF8), ref: 0030E098

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: ab4cacbf740fd83928c7eefde2ff561c2e69f1ea89d097a1c0a690f6270bf61a
Instruction ID: 4478fa4956eff4504fed1618cabe88772d56f3e07960ba8f13b0f9c9bb6bc3b0
Opcode Fuzzy Hash: ab4cacbf740fd83928c7eefde2ff561c2e69f1ea89d097a1c0a690f6270bf61a
Instruction Fuzzy Hash: 1E012632711605AFCF069F5ACC11C9E7B69DB81324F250248F8509B2D1EAB1ED418BD0

Function 003163F3 Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,003091F7,00000000,?,00315D79,00000001,00000364,00000000,00000006,000000FF,?,00000000,0030D244,003089C3,003091F7,00000000), ref: 00316434

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: faf66a4cec5286b6318975abbe6052cae69d23731e0576caf6ac0a43bb822310
Instruction ID: 3d3a34c0fd0f1280ada0400a5900162ee3773fcc191f02bc06abaa63e1ddb0dc
Opcode Fuzzy Hash: faf66a4cec5286b6318975abbe6052cae69d23731e0576caf6ac0a43bb822310
Instruction Fuzzy Hash: A1F0B43250522467DB2B6BE39C03BDA3B8C9F49760B268025A804AA590CF20EC8186E1

Function 00316E2D Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0031D635,4D88C033,?,0031D635,00000220,?,003157EF,4D88C033), ref: 00316E5F

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 04e129e6d2e30d4dc7c16c962e603d4e8b0751dde9387445f6d401d38eaa8721
Instruction ID: 39dd996d991b17caff903a61dda0e38bce0941860c4ce1e09c2b47a36b758340
Opcode Fuzzy Hash: 04e129e6d2e30d4dc7c16c962e603d4e8b0751dde9387445f6d401d38eaa8721
Instruction Fuzzy Hash: 1DE0ED3A14162166DE3B22E5EE03BDB768C8F897A0F170320BC04AA4E0CB20CC8085B8

Function 04B80161 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4119390261.0000000004B80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4b80000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41dd21c8862b36ff418bda8e1f1f429ec5f823d74b2cb4d34d8d2b96295aacc8
Instruction ID: 167255595ef542fe8fbe3b31c57a43aa1266b36c1bfaf0f28ec4b32861ba2b32
Opcode Fuzzy Hash: 41dd21c8862b36ff418bda8e1f1f429ec5f823d74b2cb4d34d8d2b96295aacc8
Instruction Fuzzy Hash: 2E21679234D290EDEA427D654A656F26F5DB7933B032204EEF047DA902F2C4265DF221

Function 04B80181 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4119390261.0000000004B80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4b80000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 644a1fdd5d7bebfdf96e2ed1c8ba248651afe7758674ce3c411901021e5b9886
Instruction ID: f6ef956c20837fec5efa9d31f03a3b6af2b762bf35dbc2e1046f86b9a288ddf1
Opcode Fuzzy Hash: 644a1fdd5d7bebfdf96e2ed1c8ba248651afe7758674ce3c411901021e5b9886
Instruction Fuzzy Hash: 8E0147A764C140AD6242BD9142857B67B48A7877B033344EEF40796600F185666DF071

Function 04B8012C Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4119390261.0000000004B80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4b80000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c3f4c2bfcebe88dadc11dd8ac9335f52e4389058526c7afa5df61618a746b09
Instruction ID: 7ea4f28cadeb7b5e14f9f7422f4c029217b63e99ad181a3c6ccd1c2ff2deed94
Opcode Fuzzy Hash: 1c3f4c2bfcebe88dadc11dd8ac9335f52e4389058526c7afa5df61618a746b09
Instruction Fuzzy Hash: C7F028A734C250FD62427D920606AB67A58A6873F033345FEB407D6501F185666CF031

Function 04B8011C Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4119390261.0000000004B80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4b80000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 762b22c9f6070e3998950cf8a69d5c0523aa301db79e77d9ed694e0cdde89240
Instruction ID: 7385b14b7e91e91ff92a7006aec08287fd5fc0376c22856902d27cf7558ddd07
Opcode Fuzzy Hash: 762b22c9f6070e3998950cf8a69d5c0523aa301db79e77d9ed694e0cdde89240
Instruction Fuzzy Hash: 01F022A734C200FD62427D824600AB67A98BA8B3F033380EEB007D6601F1D4666CF231

Function 04B801B6 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4119390261.0000000004B80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4b80000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 388b567f6e8af9765e2a8eba4ae20e782fe1804c568f57b42a90ea541899b810
Instruction ID: ddb2248106fe02a615bc48027a2af5c863eb26fb3bfa6d5c99acecd6721c0aab
Opcode Fuzzy Hash: 388b567f6e8af9765e2a8eba4ae20e782fe1804c568f57b42a90ea541899b810
Instruction Fuzzy Hash: 65F09E4679C551ED46033D9181552B6A94037672F033355DFF08B98511B0C875FDF261

Function 04B80155 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4119390261.0000000004B80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4b80000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c00a30e322033d2038c7f0981c9b5f33923bfbdd2dea81a3ae1c776fffe23b9
Instruction ID: 45da9b62d952d0ea15cebb2c6a4fca84e8dc6316419e672915ff83ba04465d23
Opcode Fuzzy Hash: 8c00a30e322033d2038c7f0981c9b5f33923bfbdd2dea81a3ae1c776fffe23b9
Instruction Fuzzy Hash: 3FE0229638C150ED5A833D9242563B4AB413B2B3F033280EEF04B95A01B0C833BDF132

Function 04B8019B Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4119390261.0000000004B80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4b80000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bbe701118b5d15c971cf7c0904ccdcec89e22fd08fe911805d72c8b431c397b
Instruction ID: 266ac1b5c1f7507201c93e808020f34e11f1825e739bcab493703e52fb9da3e8
Opcode Fuzzy Hash: 4bbe701118b5d15c971cf7c0904ccdcec89e22fd08fe911805d72c8b431c397b
Instruction Fuzzy Hash: 80E0685A789100ED8A023D625A58372BB94332B2F037201EDF047A6900B0D032ADF220

Non-executed Functions

Function 003084A0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction ID: 0e15362745e9895f8ab240e5826507b9ac65b879297298c3367d227b04ef3e85
Opcode Fuzzy Hash: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction Fuzzy Hash: 3C024B71E012199BDF15CFA8C890AAEFBF1FF48314F258269D959E7380DB31A941CB94

Function 0028F810 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0028F833
std::_Lockit::_Lockit.LIBCPMT ref: 0028F855
std::_Lockit::~_Lockit.LIBCPMT ref: 0028F875
std::_Lockit::~_Lockit.LIBCPMT ref: 0028F89F
std::_Lockit::_Lockit.LIBCPMT ref: 0028F90D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0028F959
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0028F973
std::_Lockit::~_Lockit.LIBCPMT ref: 0028FA08
std::_Facet_Register.LIBCPMT ref: 0028FA15

Strings

bad locale name, xrefs: 0028FA2F
"4, xrefs: 0028F96B, 0028F972

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$"4
API String ID: 3375549084-3434465823
Opcode ID: b8279393318e404ffb77c7ce7cc43fec037bd83f37e50a5a309b20f5a519a545
Instruction ID: 18db57f2bd5518f666affe7b4f0954cc542d08fb880fb98e6cca806cae104b0f
Opcode Fuzzy Hash: b8279393318e404ffb77c7ce7cc43fec037bd83f37e50a5a309b20f5a519a545
Instruction Fuzzy Hash: 5461DFB5D212099FEF11EFA4D945BAEBBF4AF14750F140078E804AB391EB70E914CBA1

Function 00223D10 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00223E7F

Strings

G>", xrefs: 00223DB8
G>", xrefs: 00223D2B, 00223D67, 00223D6A
@3", xrefs: 00223E84
ios_base::eofbit set, xrefs: 00223E41, 00223E63
`!", xrefs: 00223E70
ios_base::failbit set, xrefs: 00223D32
@3", xrefs: 00223DBE, 00223E9B
ios_base::badbit set, xrefs: 00223E17

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: @3"$@3"$G>"$G>"$`!"$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-956037866
Opcode ID: a1fe4e812b8e86c6d114c96cb5ad3332a1beff58a750652e6eae57fc1b7f87a2
Instruction ID: 986d62206dc3efda9b4777cd9f4f06cdcfb15efe0b8aa0efb497171fb41f4d6a
Opcode Fuzzy Hash: a1fe4e812b8e86c6d114c96cb5ad3332a1beff58a750652e6eae57fc1b7f87a2
Instruction Fuzzy Hash: DE41F8B6910218AFCB04DF98D841BEEB7F8EF49710F14852AF915E7741E774AA14CBA0

Function 00302E10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00302E47
___except_validate_context_record.LIBVCRUNTIME ref: 00302E4F
_ValidateLocalCookies.LIBCMT ref: 00302ED8
__IsNonwritableInCurrentImage.LIBCMT ref: 00302F03
_ValidateLocalCookies.LIBCMT ref: 00302F58

Strings

csm, xrefs: 00302EED
i5, xrefs: 00302F78

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: i5$csm
API String ID: 1170836740-665140769
Opcode ID: 24dc7c5519611c1b2c5330928abfa050b3e30bd1fd132f159d93054b5f048e2e
Instruction ID: 1005daeedd59d601c45edfb1bda55eeab5e4755c0a8d9ac856e6e131d8afa9f9
Opcode Fuzzy Hash: 24dc7c5519611c1b2c5330928abfa050b3e30bd1fd132f159d93054b5f048e2e
Instruction Fuzzy Hash: 0741E630A01209ABCF12DF68C8A9A9FBBB9AF44324F148055FD149B3D2D731EE55CB90

Function 00223DE0 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 79COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00223E7F

Strings

@3", xrefs: 00223E84
ios_base::eofbit set, xrefs: 00223E28, 00223E41, 00223E63
`!", xrefs: 00223E70
ios_base::failbit set, xrefs: 00223D32, 00223E1E
@3", xrefs: 00223DBE, 00223E9B
ios_base::badbit set, xrefs: 00223E17

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: @3"$@3"$`!"$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-108183131
Opcode ID: 461ff189b6c88cecf971a462d53dfdf55009d5550d66a07e872c03249abfd1e5
Instruction ID: f22101a67cea087efa947bca2f41254cd4062ed22376cce1c43ad23371f4dcc8
Opcode Fuzzy Hash: 461ff189b6c88cecf971a462d53dfdf55009d5550d66a07e872c03249abfd1e5
Instruction Fuzzy Hash: 75212BB65107157FC715DF98E801B96B7E8AF04310F18883AFE689B641E7B4EA24CB90

Function 00224C50 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 442COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00224F72
___std_exception_destroy.LIBVCRUNTIME ref: 00224FFF
___std_exception_copy.LIBVCRUNTIME ref: 002250C8

Strings

recursive_directory_iterator::operator++, xrefs: 0022504C
@3", xrefs: 002250CD
`!", xrefs: 00224F6B, 00224FF8, 002250B9

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$___std_exception_copy
String ID: @3"$`!"$recursive_directory_iterator::operator++
API String ID: 1206660477-441038987
Opcode ID: 3c984c599464f7708f9a11be158730619733e06ae9cd25c8ae5d3464386aa76b
Instruction ID: 78f2408fc358ae00273829a6351693c7bdcccca4771ba7aff86d824053450d83
Opcode Fuzzy Hash: 3c984c599464f7708f9a11be158730619733e06ae9cd25c8ae5d3464386aa76b
Instruction Fuzzy Hash: 85E12571910214AFDB28EFA8E845BAEF7F9FF44700F104A2DE41697781D774AA14CBA1

Function 00227820 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0022799A
___std_exception_copy.LIBVCRUNTIME ref: 00227B75

Strings

out_of_range, xrefs: 00227A27
`!", xrefs: 00227985, 00227B60
type_error, xrefs: 0022784A
`!", xrefs: 002279A5, 00227B80

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!"$`!"$out_of_range$type_error
API String ID: 2659868963-4088840996
Opcode ID: f3b2904c7ad04a7ac26de578cebcebc3c67b60ed228da715b889a3c6e6570d98
Instruction ID: a488cffb622bd771bccbdff74e65bfa1e5a8606fb203ab48ebbe0496e6bab297
Opcode Fuzzy Hash: f3b2904c7ad04a7ac26de578cebcebc3c67b60ed228da715b889a3c6e6570d98
Instruction Fuzzy Hash: 7CC179B19142189FDB08CFA8E98479DFBF5FF49300F148269E419EB781E774A980CB50

Function 00223190 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 170COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 002232C6
___std_exception_destroy.LIBVCRUNTIME ref: 00223350

Strings

+4", xrefs: 00223190
@3", xrefs: 00223316
`!", xrefs: 002232AD, 00223349
`!", xrefs: 002232D1

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: +4"$@3"$`!"$`!"
API String ID: 2970364248-3171281168
Opcode ID: 2eb47523b7142958c8b9aa88e4e25dcd8b2ad4c7b5ec5d3c62be4b49343335b2
Instruction ID: 00cf95ea5ebe82e96ce617bb3b05538e7ef1e5bb76d3e8dd5ff559daa5f46100
Opcode Fuzzy Hash: 2eb47523b7142958c8b9aa88e4e25dcd8b2ad4c7b5ec5d3c62be4b49343335b2
Instruction Fuzzy Hash: 0651BF71910218AFDB09CF98D885BEEBBF9FF49300F14812AF815A7391D7749A51CB90

Function 002239F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00223A58
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00223AA4
__Getctype.LIBCPMT ref: 00223ABA
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00223AE6
std::_Lockit::~_Lockit.LIBCPMT ref: 00223B7B

Strings

bad locale name, xrefs: 00223B96

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: 1728f1ef9196aaa847dad8771b04cce6bdf9dfc652b9294c6c8f1eccaebe1347
Instruction ID: e8af071b252a381c908e1e6f86a2bcf6d018afac982573c46d7ec8f59dfefc19
Opcode Fuzzy Hash: 1728f1ef9196aaa847dad8771b04cce6bdf9dfc652b9294c6c8f1eccaebe1347
Instruction Fuzzy Hash: C65181B1D10218AFDF11DFE4D845B9EBBF8AF14714F144069E909AB381E778EA14CB51

Function 0028DE70 Relevance: 9.1, APIs: 6, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0028DE93
std::_Lockit::_Lockit.LIBCPMT ref: 0028DEB6
std::_Lockit::~_Lockit.LIBCPMT ref: 0028DED6
std::_Facet_Register.LIBCPMT ref: 0028DF4B
std::_Lockit::~_Lockit.LIBCPMT ref: 0028DF63
Concurrency::cancel_current_task.LIBCPMT ref: 0028DF7B

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 4bf9923af9929af9c5b3fa4f5861fb0739ba4e48b2c9d48728e64774f23a2dcd
Instruction ID: 184aa7d673d33c7614ee78ee66dd4f2f2d896911e9055e273597f9a2fe0b1d11
Opcode Fuzzy Hash: 4bf9923af9929af9c5b3fa4f5861fb0739ba4e48b2c9d48728e64774f23a2dcd
Instruction Fuzzy Hash: 3B4105799212199FCB15EF54D841B6EBBB8FB20750F144268E9059B3E2D730AD24CFD1

Function 00226F40 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 349COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00227340

Strings

parse_error, xrefs: 00226F8B
`!", xrefs: 00227328
parse error, xrefs: 00226FFF, 00227018
`!", xrefs: 0022734B

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!"$`!"$parse error$parse_error
API String ID: 2659868963-1134234602
Opcode ID: 2ef8bf996febb9c94f310b0fdee7bf64d21bff3fc4d048e43420e337dc1e9f68
Instruction ID: 3417f8d2c26fedfdd2d6587d85a1960698b9eb99bc6f3a773e9d7849250630d2
Opcode Fuzzy Hash: 2ef8bf996febb9c94f310b0fdee7bf64d21bff3fc4d048e43420e337dc1e9f68
Instruction Fuzzy Hash: 42E190709142189FDB18CFA8D88479DBBF5FF49300F2482A9E418EB792D774AA91CF50

Function 002273B0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 002275BE
___std_exception_destroy.LIBVCRUNTIME ref: 002275CD

Strings

, column , xrefs: 00227434, 0022744A
`!", xrefs: 002275B6, 002275C6
at line , xrefs: 002273F7

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column $`!"
API String ID: 4194217158-499326956
Opcode ID: 1ca339b7b9ff87553616978a5407d908f03393d105e50057efdc78fd177fb5f8
Instruction ID: 26e38b049060c617f4fa516276590e1da6a8faead548e671300e916148965055
Opcode Fuzzy Hash: 1ca339b7b9ff87553616978a5407d908f03393d105e50057efdc78fd177fb5f8
Instruction Fuzzy Hash: 4961F670A14215AFDB08DFA8EC84B9DFBB5FF45300F644628F415A7781D774AA64CB90

Function 00223370 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

APIs

Part of subcall function 00223190: ___std_exception_copy.LIBVCRUNTIME ref: 002232C6

___std_exception_copy.LIBVCRUNTIME ref: 0022345F

Strings

+4", xrefs: 002233B3, 00223410
@3", xrefs: 00223464
@3", xrefs: 002233F3, 0022347B
`!", xrefs: 00223450

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: +4"$@3"$@3"$`!"
API String ID: 2659868963-1017541404
Opcode ID: c19bda138227c8b4acceac0ca2bd67c40c9f503f6edb03bcdd0f8b1b3daee13d
Instruction ID: 3205a8271c47af3353714eb4ca41e5790bf7fd0a4e32b948ef78b225f2aabc7c
Opcode Fuzzy Hash: c19bda138227c8b4acceac0ca2bd67c40c9f503f6edb03bcdd0f8b1b3daee13d
Instruction Fuzzy Hash: 563183B5900219AFCB19DFA8D841AEEFBF9FF08710F10856AE514E7641E774A650CB90

Function 00223410 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 47COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0022345F

Strings

+4", xrefs: 002233B3, 00223410
@3", xrefs: 00223464
@3", xrefs: 002233F3, 0022347B
`!", xrefs: 00223450

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: +4"$@3"$@3"$`!"
API String ID: 2659868963-1017541404
Opcode ID: d793f92d6042dd36f368130d28799db8ba156c61fc86472878c747998e233332
Instruction ID: fade0ed19c5f945895701664d35b1001620c689d2cde3220a1238a0c7af254f6
Opcode Fuzzy Hash: d793f92d6042dd36f368130d28799db8ba156c61fc86472878c747998e233332
Instruction Fuzzy Hash: B3014FB6500219AFC709DFA9E401C96FBFCEF04310B00843AE51987611E7B0E524CF90

Function 00226C60 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 247COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00226F11
___std_exception_destroy.LIBVCRUNTIME ref: 00226F20

Strings

[json.exception., xrefs: 00226CB8
`!", xrefs: 00226F09, 00226F19

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.$`!"
API String ID: 4194217158-420608075
Opcode ID: 471a0a8a1c272b6679b0abf4be0f88dd43bab17b3e691e82889d128d9e07e211
Instruction ID: 8f14c163d8835d78a84180a1d1423fd15f9dac5543cb5e01b9405dc96e774017
Opcode Fuzzy Hash: 471a0a8a1c272b6679b0abf4be0f88dd43bab17b3e691e82889d128d9e07e211
Instruction Fuzzy Hash: 39910771A10208AFDB18CFA8D988B9EFBF6FF45300F20856DE415AB792D771A951CB50

Function 00222270 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 218COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00222275

Part of subcall function 002FD6E9: std::invalid_argument::invalid_argument.LIBCONCRT ref: 002FD6F5

Strings

L5, xrefs: 00222347
string too long, xrefs: 00222270
L5, xrefs: 00222427

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: string too long$L5$L5
API String ID: 1997705970-1140454669
Opcode ID: d94d1c15d1a66b5b0bf520cb64902a36cd69095d3af785b71fc7813d7feaddf0
Instruction ID: 5cacd00fe4389ce65c05a25c450b1b729eff51fe102f69f3c70f23506ec5785d
Opcode Fuzzy Hash: d94d1c15d1a66b5b0bf520cb64902a36cd69095d3af785b71fc7813d7feaddf0
Instruction Fuzzy Hash: 1E816535A14295FFCB06CFA8D450BEDBFB5EF5A300F1841AAC894A7342C3768559CBA0

Function 00227620 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 167COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 002277B4

Strings

invalid_iterator, xrefs: 00227656
`!", xrefs: 0022779F
`!", xrefs: 002277BF

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!"$`!"$invalid_iterator
API String ID: 2659868963-1673871702
Opcode ID: b249f8a9de8d197c5d8967c3d9526864066400606540b0d9a60d35b2de12369f
Instruction ID: dd387d85dee1a9859ed81ce90c4265556f528f5f52ff579137c5f7e5a704497b
Opcode Fuzzy Hash: b249f8a9de8d197c5d8967c3d9526864066400606540b0d9a60d35b2de12369f
Instruction Fuzzy Hash: 555168B49042089FDB09CFA8E99479DFBF5FF49300F148669E419EB791E774A980CB90

Function 00227BE0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 156COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00227D67

Strings

other_error, xrefs: 00227C0A
`!", xrefs: 00227D52
`!", xrefs: 00227D72

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!"$`!"$other_error
API String ID: 2659868963-3199201282
Opcode ID: 17eebf203d6030155c347d50f0291e1ac3aa68219c72c3ed550d4aa9e0d19f14
Instruction ID: 0ee71784a0b786b9b5d724684520ee3120ca85e69f4cb07922fad4009ed80f6f
Opcode Fuzzy Hash: 17eebf203d6030155c347d50f0291e1ac3aa68219c72c3ed550d4aa9e0d19f14
Instruction Fuzzy Hash: 165179B09142489FDB08CFA8E8847ADFBF5BF49300F148669E419EB781E774A980CB50

Function 0028D050 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0028D06F
___std_exception_copy.LIBVCRUNTIME ref: 0028D096

Strings

`!", xrefs: 0028D060, 0028D085
`!", xrefs: 0028D09B

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!"$`!"
API String ID: 2659868963-1599315490
Opcode ID: c886cba7ef34ed4228f1c193cedb79fe3252122ec382d1db4ccb85de395db2b2
Instruction ID: d379381fc1f5333b32ac03d168196148b142be1afa0a52b2a4e9f2b3a98f55c9
Opcode Fuzzy Hash: c886cba7ef34ed4228f1c193cedb79fe3252122ec382d1db4ccb85de395db2b2
Instruction Fuzzy Hash: EE01A8B6500615AFC709DF59D545982FBF8FB45710710853BA529CBB10D7B0E528CFA0

Function 0029B3C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0029B3DF
___std_exception_copy.LIBVCRUNTIME ref: 0029B406

Strings

`!", xrefs: 0029B3D0, 0029B3F5
`!", xrefs: 0029B40E

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!"$`!"
API String ID: 2659868963-1599315490
Opcode ID: 4ed869cd28622bbe04335a28791b862d9e8429a9bd1df1d0924bad16bca0d694
Instruction ID: bd724b32999c924496ba743e8e350f03ab66022f47ad07c0342fa7268dc48b55
Opcode Fuzzy Hash: 4ed869cd28622bbe04335a28791b862d9e8429a9bd1df1d0924bad16bca0d694
Instruction Fuzzy Hash: DBF0C4BA50061AAFC70ADF58D505986FBF8FA45710711853BE52ACBB00E7B0E528CBA0

Function 0029B450 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 190COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0029B612

Strings

Px), xrefs: 0029B456, 0029B5BA, 0029B5F3, 0029B54A, 0029B4F1
invalid hash bucket count, xrefs: 0029B60D

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_
String ID: Px)$invalid hash bucket count
API String ID: 909987262-2882725661
Opcode ID: bc1779a20507995047b1f04cf97864b136526bed1ea292dd695f1395653cb32b
Instruction ID: 1d0d4d6c25f1d13771709ff56b2ce79c70110adcc62f35d9fb36ab0c997405bb
Opcode Fuzzy Hash: bc1779a20507995047b1f04cf97864b136526bed1ea292dd695f1395653cb32b
Instruction Fuzzy Hash: C67110B4A10609DFCB15CF49D28086AFBF9FF88300764C5AAD8599B355D731EA61CF90

Function 0029E440 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0029E491

Strings

type must be string, but is , xrefs: 0029E4F8
type must be boolean, but is , xrefs: 0029E582

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: type must be boolean, but is $type must be string, but is
API String ID: 118556049-436076039
Opcode ID: 45242f3f5b3360d39e1865c62872e6ba11ee51638a811654f58ff18c42f20d88
Instruction ID: b4659b11eadb704cd7ac288c66c27dd43deebaa412c11008431f9dafdaff37d7
Opcode Fuzzy Hash: 45242f3f5b3360d39e1865c62872e6ba11ee51638a811654f58ff18c42f20d88
Instruction Fuzzy Hash: 87417AB5910248AFCF15EBA4E812B9EB7A8DB10300F144678F815D76C2EB35A964CB92

Function 00223050 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00223078

Strings

`!", xrefs: 00223063
`!", xrefs: 00223080

Memory Dump Source

Source File: 00000009.00000002.4113783507.0000000000221000.00000040.00000001.01000000.00000006.sdmp, Offset: 00220000, based on PE: true

Associated: 00000009.00000002.4112172078.0000000000220000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4113783507.0000000000353000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114026608.0000000000358000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000035C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000004F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.00000000005D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.000000000060C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000613000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114069988.0000000000622000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4114695634.0000000000623000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4115008667.00000000007CB000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_220000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!"$`!"
API String ID: 2659868963-1599315490
Opcode ID: 5598f2895bf776948ad46e180210ecdefcbfe18d5f2ea42864490af7bc983e19
Instruction ID: e8dfa3865ee76a8725314a5707e52fbdc186ffbbf71bae73a93a11b7ae5cb687
Opcode Fuzzy Hash: 5598f2895bf776948ad46e180210ecdefcbfe18d5f2ea42864490af7bc983e19
Instruction Fuzzy Hash: A9E0EDB69012189FC711DFA8990598AFBF8AB19701F1086BAE948DB200F6B195548BD1

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LisectAVT_2403002A_224.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\MPGPH131\MPGPH131.exe

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
LisectAVT_2403002A_224.exe

Function 0018E0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Function 001D3A40 Relevance: 2.7, APIs: 2, Instructions: 157
sleepCOMMON

Function 04CD078E Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 305
COMMON

Function 00254942 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 157
COMMON

Function 00264623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Function 04CD06F3 Relevance: 1.9, APIs: 1, Instructions: 354
COMMON

Function 04CD06E6 Relevance: 1.8, APIs: 1, Instructions: 344
COMMON

Function 04CD0738 Relevance: 1.8, APIs: 1, Instructions: 339
COMMON

Function 04CD071E Relevance: 1.8, APIs: 1, Instructions: 335
COMMON

Function 04CD075B Relevance: 1.8, APIs: 1, Instructions: 315
COMMON

Function 04CD076E Relevance: 1.8, APIs: 1, Instructions: 311
COMMON

Function 04CD0804 Relevance: 1.8, APIs: 1, Instructions: 304
COMMON

Function 04CD07BB Relevance: 1.8, APIs: 1, Instructions: 302
COMMON

Function 04CD082D Relevance: 1.8, APIs: 1, Instructions: 300
COMMON