Edit tour

Windows Analysis Report
LisectAVT_2403002A_376.exe

Overview

General Information

Sample name:	LisectAVT_2403002A_376.exe
Analysis ID:	1482303
MD5:	45d835beaaf607e4ce243297cd053469
SHA1:	f96c5d84a6d93983b106cdd5a3daf5900270285d
SHA256:	e35b5f6aa2e9ffc815083030e2c09a5e55df2a02528db2fc24d6f480910f0036
Tags:	exe
Infos:

Detection

RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Yara detected RisePro Stealer

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Found API chain indicative of sandbox detection

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Uses schtasks.exe or at.exe to add and modify task schedules

Abnormal high CPU Usage

Contains capabilities to detect virtual machines

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

LisectAVT_2403002A_376.exe (PID: 4320 cmdline: "C:\Users\user\Desktop\LisectAVT_2403002A_376.exe" MD5: 45D835BEAAF607E4CE243297CD053469)

schtasks.exe (PID: 6396 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 3140 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MPGPH131.exe (PID: 6284 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 45D835BEAAF607E4CE243297CD053469)

MPGPH131.exe (PID: 4612 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 45D835BEAAF607E4CE243297CD053469)

RageMP131.exe (PID: 4676 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 45D835BEAAF607E4CE243297CD053469)

RageMP131.exe (PID: 7424 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 45D835BEAAF607E4CE243297CD053469)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000007.00000003.2082671106.0000000004980000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000A.00000003.2283677130.0000000004A40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000003.2056094300.0000000004A60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000006.00000003.2082082490.0000000004860000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000008.00000003.2202132987.0000000005210000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: LisectAVT_2403002A_376.exe PID: 4320	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 6284	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 4612	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 4676	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 7424	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe, ProcessId: 4320, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET MALWARE RisePro TCP Heartbeat Packet - Source IP: 192.168.2.5 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T21:01:48.505627+0200
SID:	2049060
Source Port:	49704
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE RisePro TCP Heartbeat Packet - Source IP: 192.168.2.5 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T21:01:50.747098+0200
SID:	2049060
Source Port:	49705
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.127.169.103 - Destination IP: 192.168.2.5

Timestamp:	2024-07-25T21:02:44.930427+0200
SID:	2022930
Source Port:	443
Destination Port:	49716
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE RisePro TCP Heartbeat Packet - Source IP: 192.168.2.5 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T21:01:50.746738+0200
SID:	2049060
Source Port:	49706
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T21:02:13.893192+0200
SID:	2046269
Source Port:	49715
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T21:01:53.721499+0200
SID:	2046269
Source Port:	49706
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.127.169.103 - Destination IP: 192.168.2.5

Timestamp:	2024-07-25T21:02:06.675891+0200
SID:	2022930
Source Port:	443
Destination Port:	49708
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T21:01:53.690409+0200
SID:	2046269
Source Port:	49705
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T21:01:51.487117+0200
SID:	2046269
Source Port:	49704
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T21:02:05.596394+0200
SID:	2046269
Source Port:	49707
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: LisectAVT_2403002A_376.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Avira: detection malicious, Label: TR/AD.Nekark.rxrem
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Avira: detection malicious, Label: TR/AD.Nekark.rxrem

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: LisectAVT_2403002A_376.exe

Joe Sandbox ML: detected

Source: LisectAVT_2403002A_376.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 193.233.132.74 ports 0,5,7,8,58709,9

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 193.233.132.74:58709

Source: Joe Sandbox View

IP Address: 193.233.132.74 193.233.132.74

Source: Joe Sandbox View

ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU

Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74

Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe

Code function: 0_2_0062E0A0 recv,setsockopt,WSAStartup,closesocket,socket,connect,closesocket,

0_2_0062E0A0

Source: LisectAVT_2403002A_376.exe, 00000000.00000003.2056094300.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002A_376.exe, 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.2082082490.0000000004860000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000007.00000003.2082671106.0000000004980000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000003.2202132987.0000000005210000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000003.2283677130.0000000004A40000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: LisectAVT_2403002A_376.exe, 00000000.00000003.2056094300.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002A_376.exe, 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.2082082490.0000000004860000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000007.00000003.2082671106.0000000004980000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000003.2202132987.0000000005210000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000003.2283677130.0000000004A40000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: LisectAVT_2403002A_376.exe, 00000000.00000002.3320586655.000000000113E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3320441207.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3320619593.000000000127A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3320468771.000000000172E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.3319335738.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: MPGPH131.exe, 00000006.00000002.3320441207.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTWj

System Summary

PE file contains section with special chars

Source: LisectAVT_2403002A_376.exe	Static PE information: section name:
Source: LisectAVT_2403002A_376.exe	Static PE information: section name: .idata
Source: LisectAVT_2403002A_376.exe	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name: .idata
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name: .idata
Source: MPGPH131.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Code function: 0_2_00709824	0_2_00709824
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Code function: 0_2_006850B0	0_2_006850B0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Code function: 0_2_00699880	0_2_00699880
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Code function: 0_2_006191A0	0_2_006191A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Code function: 0_2_006873F0	0_2_006873F0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Code function: 0_2_006F646A	0_2_006F646A
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Code function: 0_2_006F2CE0	0_2_006F2CE0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Code function: 0_2_006124F0	0_2_006124F0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Code function: 0_2_006F84A0	0_2_006F84A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Code function: 0_2_00618D70	0_2_00618D70
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Code function: 0_2_00696550	0_2_00696550
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Code function: 0_2_006955B0	0_2_006955B0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Code function: 0_2_006FBEAF	0_2_006FBEAF
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Code function: 0_2_0070F771	0_2_0070F771
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Code function: 0_2_00629F50	0_2_00629F50
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00569824	6_2_00569824
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004F9880	6_2_004F9880
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004E50B0	6_2_004E50B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004791A0	6_2_004791A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004E73F0	6_2_004E73F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0055646A	6_2_0055646A
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00552CE0	6_2_00552CE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004724F0	6_2_004724F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005584A0	6_2_005584A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004F6550	6_2_004F6550
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00478D70	6_2_00478D70
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004F55B0	6_2_004F55B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0055BEAF	6_2_0055BEAF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00489F50	6_2_00489F50
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00569824	7_2_00569824
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_004F9880	7_2_004F9880
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_004E50B0	7_2_004E50B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_004791A0	7_2_004791A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_004E73F0	7_2_004E73F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_0055646A	7_2_0055646A
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00552CE0	7_2_00552CE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_004724F0	7_2_004724F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_005584A0	7_2_005584A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_004F6550	7_2_004F6550
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00478D70	7_2_00478D70
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_004F55B0	7_2_004F55B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_0055BEAF	7_2_0055BEAF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00489F50	7_2_00489F50
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00E950B0	8_2_00E950B0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00EA9880	8_2_00EA9880
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00F19824	8_2_00F19824
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00E291A0	8_2_00E291A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00E973F0	8_2_00E973F0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00F42364	8_2_00F42364
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00F42368	8_2_00F42368
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00F42318	8_2_00F42318
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00F02CE0	8_2_00F02CE0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00E224F0	8_2_00E224F0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00F424C4	8_2_00F424C4
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00F084A0	8_2_00F084A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00F42498	8_2_00F42498
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00F0646A	8_2_00F0646A
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00F42408	8_2_00F42408
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00EA55B0	8_2_00EA55B0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00E28D70	8_2_00E28D70
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00EA6550	8_2_00EA6550
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00F0BEAF	8_2_00F0BEAF
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00F1F771	8_2_00F1F771
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00E39F50	8_2_00E39F50
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00E950B0	10_2_00E950B0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00EA9880	10_2_00EA9880
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00F19824	10_2_00F19824
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00E291A0	10_2_00E291A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00E973F0	10_2_00E973F0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00F42364	10_2_00F42364
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00F42368	10_2_00F42368
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00F42318	10_2_00F42318
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00F02CE0	10_2_00F02CE0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00E224F0	10_2_00E224F0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00F424C4	10_2_00F424C4
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00F084A0	10_2_00F084A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00F42498	10_2_00F42498
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00F0646A	10_2_00F0646A
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00F42408	10_2_00F42408
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00EA55B0	10_2_00EA55B0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00E28D70	10_2_00E28D70
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00EA6550	10_2_00EA6550
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00F0BEAF	10_2_00F0BEAF
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00F1F771	10_2_00F1F771
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00E39F50	10_2_00E39F50

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 0054FED0 appears 52 times
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: String function: 00EFFED0 appears 52 times

Source: LisectAVT_2403002A_376.exe, 00000000.00000000.2049821270.0000000000748000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamefilezilla.exe4 vs LisectAVT_2403002A_376.exe
Source: LisectAVT_2403002A_376.exe	Binary or memory string: OriginalFilenamefilezilla.exe4 vs LisectAVT_2403002A_376.exe

Source: LisectAVT_2403002A_376.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: LisectAVT_2403002A_376.exe	Static PE information: Section: ZLIB complexity 0.9931361607142857
Source: LisectAVT_2403002A_376.exe	Static PE information: Section: sryzlqip ZLIB complexity 0.9946141311689481
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9931361607142857
Source: RageMP131.exe.0.dr	Static PE information: Section: sryzlqip ZLIB complexity 0.9946141311689481
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9931361607142857
Source: MPGPH131.exe.0.dr	Static PE information: Section: sryzlqip ZLIB complexity 0.9946141311689481

Source: classification engine

Classification label: mal100.troj.evad.winEXE@11/5@0/1

Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe

File created: C:\Users\user\AppData\Local\RageMP131

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5664:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6468:120:WilError_03

Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe

File created: C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Command line argument: nIq	0_2_007148C0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Command line argument: nIW	6_2_005748C0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Command line argument: nIW	7_2_005748C0

Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: LisectAVT_2403002A_376.exe, 00000000.00000003.2056094300.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002A_376.exe, 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.2082082490.0000000004860000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000007.00000003.2082671106.0000000004980000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000003.2202132987.0000000005210000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000003.2283677130.0000000004A40000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: LisectAVT_2403002A_376.exe, 00000000.00000003.2056094300.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002A_376.exe, 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.2082082490.0000000004860000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000007.00000003.2082671106.0000000004980000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000003.2202132987.0000000005210000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000003.2283677130.0000000004A40000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

Source: LisectAVT_2403002A_376.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: MPGPH131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: MPGPH131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: RageMP131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: RageMP131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe

File read: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe "C:\Users\user\Desktop\LisectAVT_2403002A_376.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll	Jump to behavior

Source: LisectAVT_2403002A_376.exe

Static file information: File size 2038792 > 1048576

Source: LisectAVT_2403002A_376.exe

Static PE information: Raw size of sryzlqip is bigger than: 0x100000 < 0x15b000

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Unpacked PE file: 0.2.LisectAVT_2403002A_376.exe.610000.0.unpack :EW;.rsrc:W;.idata :W; :EW;sryzlqip:EW;dhhlsvvc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;sryzlqip:EW;dhhlsvvc:EW;.taggant:EW;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 6.2.MPGPH131.exe.470000.0.unpack :EW;.rsrc:W;.idata :W; :EW;sryzlqip:EW;dhhlsvvc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;sryzlqip:EW;dhhlsvvc:EW;.taggant:EW;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 7.2.MPGPH131.exe.470000.0.unpack :EW;.rsrc:W;.idata :W; :EW;sryzlqip:EW;dhhlsvvc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;sryzlqip:EW;dhhlsvvc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 8.2.RageMP131.exe.e20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;sryzlqip:EW;dhhlsvvc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;sryzlqip:EW;dhhlsvvc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 10.2.RageMP131.exe.e20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;sryzlqip:EW;dhhlsvvc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;sryzlqip:EW;dhhlsvvc:EW;.taggant:EW;

Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe

Code function: 0_2_00629F50 LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,

0_2_00629F50

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: LisectAVT_2403002A_376.exe	Static PE information: real checksum: 0x1f712c should be: 0x1ff09e
Source: RageMP131.exe.0.dr	Static PE information: real checksum: 0x1f712c should be: 0x1ff09e
Source: MPGPH131.exe.0.dr	Static PE information: real checksum: 0x1f712c should be: 0x1ff09e

Source: LisectAVT_2403002A_376.exe	Static PE information: section name:
Source: LisectAVT_2403002A_376.exe	Static PE information: section name: .idata
Source: LisectAVT_2403002A_376.exe	Static PE information: section name:
Source: LisectAVT_2403002A_376.exe	Static PE information: section name: sryzlqip
Source: LisectAVT_2403002A_376.exe	Static PE information: section name: dhhlsvvc
Source: LisectAVT_2403002A_376.exe	Static PE information: section name: .taggant
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name: .idata
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name: sryzlqip
Source: RageMP131.exe.0.dr	Static PE information: section name: dhhlsvvc
Source: RageMP131.exe.0.dr	Static PE information: section name: .taggant
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name: .idata
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name: sryzlqip
Source: MPGPH131.exe.0.dr	Static PE information: section name: dhhlsvvc
Source: MPGPH131.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Code function: 0_2_006EFA97 push ecx; ret	0_2_006EFAAA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0054FA97 push ecx; ret	6_2_0054FAAA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_0054FA97 push ecx; ret	7_2_0054FAAA
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00EFFA97 push ecx; ret	8_2_00EFFAAA
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00EFFA97 push ecx; ret	10_2_00EFFAAA

Source: LisectAVT_2403002A_376.exe	Static PE information: section name: entropy: 7.9345365893427315
Source: LisectAVT_2403002A_376.exe	Static PE information: section name: sryzlqip entropy: 7.95317001843216
Source: RageMP131.exe.0.dr	Static PE information: section name: entropy: 7.9345365893427315
Source: RageMP131.exe.0.dr	Static PE information: section name: sryzlqip entropy: 7.95317001843216
Source: MPGPH131.exe.0.dr	Static PE information: section name: entropy: 7.9345365893427315
Source: MPGPH131.exe.0.dr	Static PE information: section name: sryzlqip entropy: 7.95317001843216

Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe			Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe			Jump to dropped file

Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe

File created: C:\ProgramData\MPGPH131\MPGPH131.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe

Code function: 0_2_006955B0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_006955B0

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Sandbox detection routine: GetCursorPos, DecisionNode, Sleep	graph_8-18170
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Sandbox detection routine: GetCursorPos, DecisionNode, Sleep	graph_6-16597
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Sandbox detection routine: GetCursorPos, DecisionNode, Sleep	graph_0-17152

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep	graph_6-16598
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep	graph_8-18171
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep	graph_0-17153

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8C9887 second address: 8C989B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB75D0E6D8Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8C989B second address: 8C98E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FB75C865F96h 0x0000000a popad 0x0000000b pop esi 0x0000000c pushad 0x0000000d js 00007FB75C865FB0h 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007FB75C865FA8h 0x0000001a push eax 0x0000001b pushad 0x0000001c popad 0x0000001d jnl 00007FB75C865F96h 0x00000023 pop eax 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FB75C865F9Fh 0x0000002b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8C98E3 second address: 8C98E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8B94A4 second address: 8B94F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edx 0x00000007 jmp 00007FB75C865FA9h 0x0000000c jmp 00007FB75C865FA8h 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FB75C865FA2h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8B94F3 second address: 8B9510 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB75D0E6D86h 0x00000008 jmp 00007FB75D0E6D93h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8C88AF second address: 8C88B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8C88B3 second address: 8C88D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FB75D0E6D97h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8C88D3 second address: 8C88D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8C88D9 second address: 8C8900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FB75D0E6D96h 0x0000000c jmp 00007FB75D0E6D8Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8C8D62 second address: 8C8D68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8C9025 second address: 8C9031 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FB75D0E6D86h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8C9031 second address: 8C903A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8EBC45 second address: 8EBC4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8EBC4A second address: 8EBC56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8E9BCD second address: 8E9BD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8E9BD1 second address: 8E9BD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8E9BD5 second address: 8E9BDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8E9BDF second address: 8E9BE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8E9BE5 second address: 8E9BE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8E9BE9 second address: 8E9BF3 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB75C865F96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8EA5A3 second address: 8EA5B5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jl 00007FB75D0E6D86h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007FB75D0E6D86h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8EAC46 second address: 8EAC50 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8EAC50 second address: 8EAC68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB75D0E6D94h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8EB370 second address: 8EB376 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8EB376 second address: 8EB38E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB75D0E6D90h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8EB513 second address: 8EB517 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8EB517 second address: 8EB51D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8EB51D second address: 8EB54B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB75C865FA9h 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FB75C865F9Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8EB68E second address: 8EB694 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8EB694 second address: 8EB6A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB75C865F9Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8EB6A6 second address: 8EB6B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8EB6B2 second address: 8EB6B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8EBAA8 second address: 8EBAC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB75D0E6D8Fh 0x00000009 jnl 00007FB75D0E6D86h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8EBAC2 second address: 8EBACA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8EBACA second address: 8EBB03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007FB75D0E6D86h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB75D0E6D90h 0x00000015 jmp 00007FB75D0E6D99h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8EBB03 second address: 8EBB10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FB75C865F96h 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8EEC36 second address: 8EEC3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8EEC3C second address: 8EEC41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8EEC41 second address: 8EEC57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB75D0E6D91h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8EEC57 second address: 8EEC8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB75C865FA2h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007FB75C865FA3h 0x00000014 push eax 0x00000015 push edx 0x00000016 push edx 0x00000017 pop edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8EEC8C second address: 8EEC90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8F02C7 second address: 8F02E0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB75C865F9Eh 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8F246F second address: 8F2474 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8F36F9 second address: 8F3712 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jbe 00007FB75C865F98h 0x0000000e push edx 0x0000000f pop edx 0x00000010 pushad 0x00000011 ja 00007FB75C865F96h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8F715F second address: 8F7164 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8F7164 second address: 8F7189 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007FB75C865F9Dh 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 jno 00007FB75C865F96h 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8F7189 second address: 8F71CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB75D0E6D8Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jmp 00007FB75D0E6D8Dh 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 jmp 00007FB75D0E6D8Eh 0x00000019 pop eax 0x0000001a mov di, cx 0x0000001d push FE6F782Ch 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 je 00007FB75D0E6D86h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8F71CE second address: 8F71D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8F71D2 second address: 8F71D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8F75B2 second address: 8F75BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FB75C865F96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8F75BC second address: 8F75CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b push edi 0x0000000c pop edi 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8F79C9 second address: 8F79D8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8F79D8 second address: 8F79E2 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB75D0E6D86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8F8012 second address: 8F8016 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8F82AC second address: 8F82CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB75D0E6D94h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8F8512 second address: 8F8518 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8F8518 second address: 8F851C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8F8A23 second address: 8F8A37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB75C865FA0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8F9235 second address: 8F9239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8F9239 second address: 8F9247 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8F9247 second address: 8F924D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8FA757 second address: 8FA75D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8FB128 second address: 8FB137 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8FB137 second address: 8FB13B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8FB13B second address: 8FB141 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8FB141 second address: 8FB147 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8FB147 second address: 8FB1A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007FB75D0E6D88h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 0000001Ah 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 mov di, C544h 0x00000027 push 00000000h 0x00000029 call 00007FB75D0E6D8Ch 0x0000002e mov edi, dword ptr [ebp+122D37AEh] 0x00000034 pop edi 0x00000035 push 00000000h 0x00000037 pushad 0x00000038 jne 00007FB75D0E6D8Bh 0x0000003e add edx, dword ptr [ebp+12474F4Ah] 0x00000044 popad 0x00000045 xchg eax, ebx 0x00000046 push eax 0x00000047 push edx 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8FB1A6 second address: 8FB1AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8FC76E second address: 8FC7CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push esi 0x0000000c pop esi 0x0000000d popad 0x0000000e jp 00007FB75D0E6D8Ch 0x00000014 jne 00007FB75D0E6D86h 0x0000001a popad 0x0000001b nop 0x0000001c mov si, 893Fh 0x00000020 push 00000000h 0x00000022 movsx edi, cx 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push edx 0x0000002a call 00007FB75D0E6D88h 0x0000002f pop edx 0x00000030 mov dword ptr [esp+04h], edx 0x00000034 add dword ptr [esp+04h], 0000001Dh 0x0000003c inc edx 0x0000003d push edx 0x0000003e ret 0x0000003f pop edx 0x00000040 ret 0x00000041 mov di, 8A13h 0x00000045 xchg eax, ebx 0x00000046 je 00007FB75D0E6D92h 0x0000004c jp 00007FB75D0E6D8Ch 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8FC7CD second address: 8FC7D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8FC7D8 second address: 8FC7DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8FE98B second address: 8FE98F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8FD084 second address: 8FD090 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8FE98F second address: 8FE995 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8FD090 second address: 8FD094 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 90034A second address: 9003AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007FB75C865F98h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 0000001Ah 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 mov ebx, dword ptr [ebp+122D3101h] 0x0000002a push 00000000h 0x0000002c jmp 00007FB75C865FA3h 0x00000031 push 00000000h 0x00000033 sub ebx, dword ptr [ebp+122D29AAh] 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007FB75C865FA2h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 901362 second address: 901367 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 9004C1 second address: 9004CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FB75C865F96h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 902195 second address: 902199 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 90314C second address: 90317B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB75C865FA6h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB75C865F9Eh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 9042A3 second address: 904314 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007FB75D0E6D88h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 or ebx, dword ptr [ebp+122D2BFAh] 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push edi 0x0000002f call 00007FB75D0E6D88h 0x00000034 pop edi 0x00000035 mov dword ptr [esp+04h], edi 0x00000039 add dword ptr [esp+04h], 0000001Bh 0x00000041 inc edi 0x00000042 push edi 0x00000043 ret 0x00000044 pop edi 0x00000045 ret 0x00000046 push 00000000h 0x00000048 jmp 00007FB75D0E6D91h 0x0000004d push eax 0x0000004e pushad 0x0000004f pushad 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 9054AC second address: 9054B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 90639A second address: 9063A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FB75D0E6D86h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 907479 second address: 90747F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 9082F4 second address: 9082F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 9082F8 second address: 908311 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 jbe 00007FB75C865F9Ch 0x0000000f jnc 00007FB75C865F96h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 908311 second address: 908369 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB75D0E6D86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007FB75D0E6D88h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 00000015h 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 pushad 0x00000027 mov dx, bx 0x0000002a cmc 0x0000002b popad 0x0000002c sub dword ptr [ebp+122D2FF1h], eax 0x00000032 push 00000000h 0x00000034 mov edi, dword ptr [ebp+122D2E0Ah] 0x0000003a push 00000000h 0x0000003c xchg eax, esi 0x0000003d jnl 00007FB75D0E6D91h 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 908369 second address: 90837F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB75C865FA2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 90A29C second address: 90A2B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB75D0E6D8Fh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 90A2B4 second address: 90A2B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 90A530 second address: 90A535 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 9093E7 second address: 9093F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 90B4BB second address: 90B4BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 90D40F second address: 90D414 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 90B4BF second address: 90B4C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 90C59B second address: 90C59F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8F9A91 second address: 8F9A95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 90C59F second address: 90C5A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 90B5BE second address: 90B5C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 90D751 second address: 90D755 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 90C5A9 second address: 90C5AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 90B5C4 second address: 90B5D7 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB75C865F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edi 0x0000000e pushad 0x0000000f push edx 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 90E6E8 second address: 90E6EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 90C5AD second address: 90C5B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 90F631 second address: 90F636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 90F636 second address: 90F6ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB75C865FA6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007FB75C865F98h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push esi 0x0000002b call 00007FB75C865F98h 0x00000030 pop esi 0x00000031 mov dword ptr [esp+04h], esi 0x00000035 add dword ptr [esp+04h], 00000017h 0x0000003d inc esi 0x0000003e push esi 0x0000003f ret 0x00000040 pop esi 0x00000041 ret 0x00000042 js 00007FB75C865F9Ch 0x00000048 mov ebx, dword ptr [ebp+122D3791h] 0x0000004e push 00000000h 0x00000050 pushad 0x00000051 mov bl, ah 0x00000053 pushad 0x00000054 jns 00007FB75C865F96h 0x0000005a popad 0x0000005b popad 0x0000005c xchg eax, esi 0x0000005d jne 00007FB75C865FADh 0x00000063 push eax 0x00000064 pushad 0x00000065 push eax 0x00000066 push edx 0x00000067 jmp 00007FB75C865FA8h 0x0000006c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 90E7B2 second address: 90E7B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 90F6ED second address: 90F6F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 90F8D5 second address: 90F8D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 912829 second address: 91282F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 91282F second address: 912842 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB75D0E6D8Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 912842 second address: 91284B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ecx 0x00000006 push edx 0x00000007 pop edx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 91F116 second address: 91F11A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 91F11A second address: 91F157 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FB75C865FA9h 0x00000008 jmp 00007FB75C865FA2h 0x0000000d pop edi 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB75C865F9Ah 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 91F157 second address: 91F194 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB75D0E6DA0h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB75D0E6D99h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 91F194 second address: 91F198 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 91F890 second address: 91F8A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB75D0E6D8Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 91F8A0 second address: 91F8BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FB75C865FA0h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 91F8BD second address: 91F8E2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007FB75D0E6D8Eh 0x0000000e push edi 0x0000000f pop edi 0x00000010 jng 00007FB75D0E6D86h 0x00000016 pushad 0x00000017 jp 00007FB75D0E6D86h 0x0000001d jp 00007FB75D0E6D86h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 91FB84 second address: 91FB8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 91FB8C second address: 91FB98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB75D0E6D86h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 91FE1A second address: 91FE32 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB75C865F9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jns 00007FB75C865F96h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 9200F7 second address: 9200FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 9200FB second address: 9200FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 9200FF second address: 920105 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 920105 second address: 92010F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 92010F second address: 920113 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 920113 second address: 920119 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 920119 second address: 920123 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FB75D0E6D86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 92BD5E second address: 92BD6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 92BD6C second address: 92BD83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB75D0E6D8Bh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 92BD83 second address: 92BD87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 92BD87 second address: 92BDA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB75D0E6D93h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8B283D second address: 8B2843 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8B2843 second address: 8B2851 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB75D0E6D8Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 929FA1 second address: 929FA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 929FA7 second address: 929FAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 929FAD second address: 929FC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FB75C865F9Dh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 92A29A second address: 92A2BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB75D0E6D97h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 92A44D second address: 92A462 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FB75C865F96h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jp 00007FB75C865F96h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 92A462 second address: 92A468 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 92A786 second address: 92A793 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB75C865F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 92A8E1 second address: 92A906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jns 00007FB75D0E6D8Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FB75D0E6D8Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 92A906 second address: 92A90A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 92AA60 second address: 92AA6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FB75D0E6D86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 92AA6A second address: 92AA75 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 92AA75 second address: 92AA8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 pushad 0x00000007 push edx 0x00000008 jmp 00007FB75D0E6D8Ch 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 92AA8E second address: 92AA92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 92AD9E second address: 92ADA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 92B467 second address: 92B489 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FB75C865F96h 0x0000000a popad 0x0000000b jmp 00007FB75C865FA3h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 92B489 second address: 92B48F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 92B48F second address: 92B493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 92BBC8 second address: 92BC1C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB75D0E6D99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a pushad 0x0000000b popad 0x0000000c je 00007FB75D0E6D86h 0x00000012 pop ecx 0x00000013 jc 00007FB75D0E6D88h 0x00000019 push eax 0x0000001a pop eax 0x0000001b ja 00007FB75D0E6D8Eh 0x00000021 push eax 0x00000022 pop eax 0x00000023 jl 00007FB75D0E6D86h 0x00000029 popad 0x0000002a pushad 0x0000002b jmp 00007FB75D0E6D8Dh 0x00000030 push eax 0x00000031 push edx 0x00000032 jng 00007FB75D0E6D86h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 9299CC second address: 9299D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 933369 second address: 933396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB75D0E6D94h 0x00000009 pop ebx 0x0000000a jmp 00007FB75D0E6D8Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pop edi 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 933396 second address: 93339C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8BC9C5 second address: 8BC9E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FB75D0E6D97h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 932E9D second address: 932EB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB75C865F9Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 932EB2 second address: 932EDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnl 00007FB75D0E6D8Ch 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB75D0E6D92h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 932EDC second address: 932EE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 932EE0 second address: 932EEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007FB75D0E6D86h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 933039 second address: 93303D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 93303D second address: 933043 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 933043 second address: 93307F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB75C865F96h 0x00000008 jmp 00007FB75C865FA1h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007FB75C865F9Fh 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 jns 00007FB75C865F96h 0x0000001f jne 00007FB75C865F96h 0x00000025 pop esi 0x00000026 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 93307F second address: 933092 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB75D0E6D8Dh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 933092 second address: 933096 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 9503C8 second address: 9503CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 9558C9 second address: 9558FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FB75C865FA2h 0x0000000a pushad 0x0000000b jmp 00007FB75C865FA1h 0x00000010 jc 00007FB75C865F96h 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 9558FB second address: 955905 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 955905 second address: 95590D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 9555F1 second address: 9555FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FB75D0E6D86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 9555FB second address: 955605 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB75C865F96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 957AAD second address: 957AB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FB75D0E6D86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 957AB7 second address: 957ABB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 963009 second address: 96300E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 96300E second address: 96304E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c jmp 00007FB75C865FA5h 0x00000011 pushad 0x00000012 popad 0x00000013 jo 00007FB75C865F96h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FB75C865FA0h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 96304E second address: 96305E instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB75D0E6D86h 0x00000008 js 00007FB75D0E6D86h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 8B5D77 second address: 8B5DBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jne 00007FB75C865F96h 0x0000000c popad 0x0000000d jmp 00007FB75C865FA0h 0x00000012 pushad 0x00000013 jmp 00007FB75C865FA5h 0x00000018 jng 00007FB75C865F9Ah 0x0000001e push edx 0x0000001f pop edx 0x00000020 pushad 0x00000021 popad 0x00000022 jc 00007FB75C865F9Eh 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 96F878 second address: 96F886 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FB75D0E6D8Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 96F886 second address: 96F8B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB75C865F9Bh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d ja 00007FB75C865F96h 0x00000013 jg 00007FB75C865F96h 0x00000019 pop eax 0x0000001a jl 00007FB75C865F9Eh 0x00000020 jbe 00007FB75C865F96h 0x00000026 push esi 0x00000027 pop esi 0x00000028 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 96F8B4 second address: 96F8CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB75D0E6D92h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 972299 second address: 9722A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FB75C865F96h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 9722A4 second address: 9722E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB75D0E6D97h 0x00000009 ja 00007FB75D0E6D86h 0x0000000f popad 0x00000010 pushad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 push esi 0x00000014 pop esi 0x00000015 jmp 00007FB75D0E6D95h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 9956BB second address: 9956C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ecx 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 9949F5 second address: 994A0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB75D0E6D96h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 994A0F second address: 994A15 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 994A15 second address: 994A23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007FB75D0E6D86h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 994A23 second address: 994A2F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 994A2F second address: 994A3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push esi 0x00000009 pushad 0x0000000a popad 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 994A3F second address: 994A49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FB75C865F96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 994A49 second address: 994A78 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB75D0E6D86h 0x00000008 jmp 00007FB75D0E6D99h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ecx 0x00000010 pushad 0x00000011 popad 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 jnp 00007FB75D0E6D86h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 994BA1 second address: 994BAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 994BAC second address: 994BB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 994E42 second address: 994E52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 js 00007FB75C865F96h 0x0000000c popad 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 99800F second address: 998013 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 9985E4 second address: 998626 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB75C865F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c sub dx, E1FFh 0x00000011 push dword ptr [ebp+122D3076h] 0x00000017 jg 00007FB75C865FA2h 0x0000001d push EF668F1Ch 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 jmp 00007FB75C865F9Eh 0x0000002a push edi 0x0000002b pop edi 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 9997E5 second address: 999803 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB75D0E6D86h 0x00000008 ja 00007FB75D0E6D86h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007FB75D0E6D8Eh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 99B4E8 second address: 99B50F instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB75C865F96h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnl 00007FB75C865FABh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 99B50F second address: 99B519 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB75D0E6D8Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 99CEC2 second address: 99CEEF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FB75C865F9Eh 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e jmp 00007FB75C865FA2h 0x00000013 pop eax 0x00000014 push ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 99CEEF second address: 99CEF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	RDTSC instruction interceptor: First address: 99CEF4 second address: 99CEFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FB75C865F96h 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 729887 second address: 72989B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB75D0E6D8Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 72989B second address: 7298E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FB75C865F96h 0x0000000a popad 0x0000000b pop esi 0x0000000c pushad 0x0000000d js 00007FB75C865FB0h 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007FB75C865FA8h 0x0000001a push eax 0x0000001b pushad 0x0000001c popad 0x0000001d jnl 00007FB75C865F96h 0x00000023 pop eax 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FB75C865F9Fh 0x0000002b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7298E3 second address: 7298E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7194A4 second address: 7194F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edx 0x00000007 jmp 00007FB75C865FA9h 0x0000000c jmp 00007FB75C865FA8h 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FB75C865FA2h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7194F3 second address: 719510 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB75D0E6D86h 0x00000008 jmp 00007FB75D0E6D93h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7288AF second address: 7288B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7288B3 second address: 7288D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FB75D0E6D97h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7288D3 second address: 7288D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7288D9 second address: 728900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FB75D0E6D96h 0x0000000c jmp 00007FB75D0E6D8Ah 0x00000011 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 728D62 second address: 728D68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 729025 second address: 729031 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FB75D0E6D86h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 729031 second address: 72903A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 74BC45 second address: 74BC4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 74BC4A second address: 74BC56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 749BCD second address: 749BD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 749BD1 second address: 749BD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 749BD5 second address: 749BDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 749BDF second address: 749BE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 749BE5 second address: 749BE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 749BE9 second address: 749BF3 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB75C865F96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 74A5A3 second address: 74A5B5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jl 00007FB75D0E6D86h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007FB75D0E6D86h 0x00000012 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 74AC46 second address: 74AC50 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 74AC50 second address: 74AC68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB75D0E6D94h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 74B370 second address: 74B376 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 74B376 second address: 74B38E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB75D0E6D90h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 74B513 second address: 74B517 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 74B517 second address: 74B51D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 74B51D second address: 74B54B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB75C865FA9h 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FB75C865F9Bh 0x00000014 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 74B68E second address: 74B694 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 74B694 second address: 74B6A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB75C865F9Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 74B6A6 second address: 74B6B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 74B6B2 second address: 74B6B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 74BAA8 second address: 74BAC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB75D0E6D8Fh 0x00000009 jnl 00007FB75D0E6D86h 0x0000000f popad 0x00000010 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 74BAC2 second address: 74BACA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 74BACA second address: 74BB03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007FB75D0E6D86h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB75D0E6D90h 0x00000015 jmp 00007FB75D0E6D99h 0x0000001a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 74BB03 second address: 74BB10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FB75C865F96h 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 74EC36 second address: 74EC3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 74EC3C second address: 74EC41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 74EC41 second address: 74EC57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB75D0E6D91h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 74EC57 second address: 74EC8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB75C865FA2h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007FB75C865FA3h 0x00000014 push eax 0x00000015 push edx 0x00000016 push edx 0x00000017 pop edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 74EC8C second address: 74EC90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7502C7 second address: 7502E0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB75C865F9Eh 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 75246F second address: 752474 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7536F9 second address: 753712 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jbe 00007FB75C865F98h 0x0000000e push edx 0x0000000f pop edx 0x00000010 pushad 0x00000011 ja 00007FB75C865F96h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 75715F second address: 757164 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 757164 second address: 757189 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007FB75C865F9Dh 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 jno 00007FB75C865F96h 0x0000001c popad 0x0000001d rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 757189 second address: 7571CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB75D0E6D8Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jmp 00007FB75D0E6D8Dh 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 jmp 00007FB75D0E6D8Eh 0x00000019 pop eax 0x0000001a mov di, cx 0x0000001d push FE6F782Ch 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 je 00007FB75D0E6D86h 0x0000002c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7571CE second address: 7571D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7571D2 second address: 7571D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7575B2 second address: 7575BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FB75C865F96h 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7575BC second address: 7575CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b push edi 0x0000000c pop edi 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7579C9 second address: 7579D8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7579D8 second address: 7579E2 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB75D0E6D86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 758012 second address: 758016 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7582AC second address: 7582CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB75D0E6D94h 0x0000000f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 758512 second address: 758518 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 758518 second address: 75851C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 758A23 second address: 758A37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB75C865FA0h 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 759235 second address: 759239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 759239 second address: 759247 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 759247 second address: 75924D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 75A757 second address: 75A75D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 75B128 second address: 75B137 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 75B137 second address: 75B13B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 75B13B second address: 75B141 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 75B141 second address: 75B147 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 75B147 second address: 75B1A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007FB75D0E6D88h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 0000001Ah 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 mov di, C544h 0x00000027 push 00000000h 0x00000029 call 00007FB75D0E6D8Ch 0x0000002e mov edi, dword ptr [ebp+122D37AEh] 0x00000034 pop edi 0x00000035 push 00000000h 0x00000037 pushad 0x00000038 jne 00007FB75D0E6D8Bh 0x0000003e add edx, dword ptr [ebp+12474F4Ah] 0x00000044 popad 0x00000045 xchg eax, ebx 0x00000046 push eax 0x00000047 push edx 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 75B1A6 second address: 75B1AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 75C76E second address: 75C7CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push esi 0x0000000c pop esi 0x0000000d popad 0x0000000e jp 00007FB75D0E6D8Ch 0x00000014 jne 00007FB75D0E6D86h 0x0000001a popad 0x0000001b nop 0x0000001c mov si, 893Fh 0x00000020 push 00000000h 0x00000022 movsx edi, cx 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push edx 0x0000002a call 00007FB75D0E6D88h 0x0000002f pop edx 0x00000030 mov dword ptr [esp+04h], edx 0x00000034 add dword ptr [esp+04h], 0000001Dh 0x0000003c inc edx 0x0000003d push edx 0x0000003e ret 0x0000003f pop edx 0x00000040 ret 0x00000041 mov di, 8A13h 0x00000045 xchg eax, ebx 0x00000046 je 00007FB75D0E6D92h 0x0000004c jp 00007FB75D0E6D8Ch 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 75C7CD second address: 75C7D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 75C7D8 second address: 75C7DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 75E98B second address: 75E98F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 75E98F second address: 75E995 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 75D084 second address: 75D090 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 75D090 second address: 75D094 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 76034A second address: 7603AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007FB75C865F98h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 0000001Ah 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 mov ebx, dword ptr [ebp+122D3101h] 0x0000002a push 00000000h 0x0000002c jmp 00007FB75C865FA3h 0x00000031 push 00000000h 0x00000033 sub ebx, dword ptr [ebp+122D29AAh] 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007FB75C865FA2h 0x00000041 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 761362 second address: 761367 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7604C1 second address: 7604CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FB75C865F96h 0x0000000a popad 0x0000000b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 762195 second address: 762199 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 76314C second address: 76317B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB75C865FA6h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB75C865F9Eh 0x00000015 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7642A3 second address: 764314 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007FB75D0E6D88h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 or ebx, dword ptr [ebp+122D2BFAh] 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push edi 0x0000002f call 00007FB75D0E6D88h 0x00000034 pop edi 0x00000035 mov dword ptr [esp+04h], edi 0x00000039 add dword ptr [esp+04h], 0000001Bh 0x00000041 inc edi 0x00000042 push edi 0x00000043 ret 0x00000044 pop edi 0x00000045 ret 0x00000046 push 00000000h 0x00000048 jmp 00007FB75D0E6D91h 0x0000004d push eax 0x0000004e pushad 0x0000004f pushad 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7654AC second address: 7654B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 76639A second address: 7663A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FB75D0E6D86h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7682F4 second address: 7682F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7682F8 second address: 768311 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 jbe 00007FB75D0E6D8Ch 0x0000000f jnc 00007FB75D0E6D86h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 768311 second address: 768369 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB75C865F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007FB75C865F98h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 00000015h 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 pushad 0x00000027 mov dx, bx 0x0000002a cmc 0x0000002b popad 0x0000002c sub dword ptr [ebp+122D2FF1h], eax 0x00000032 push 00000000h 0x00000034 mov edi, dword ptr [ebp+122D2E0Ah] 0x0000003a push 00000000h 0x0000003c xchg eax, esi 0x0000003d jnl 00007FB75C865FA1h 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 popad 0x0000004a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 768369 second address: 76837F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB75D0E6D92h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 767479 second address: 76747F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 76A29C second address: 76A2B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB75D0E6D8Fh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 76A2B4 second address: 76A2B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7693E7 second address: 7693F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 76A530 second address: 76A535 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 76B4BB second address: 76B4BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 76B4BF second address: 76B4C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 76B5BE second address: 76B5C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 76B5C4 second address: 76B5D7 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB75C865F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edi 0x0000000e pushad 0x0000000f push edx 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 76D40F second address: 76D414 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 76C59B second address: 76C59F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 76C59F second address: 76C5A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 76C5A9 second address: 76C5AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 76C5AD second address: 76C5B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 76D751 second address: 76D755 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 76F631 second address: 76F636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 76F636 second address: 76F6ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB75C865FA6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007FB75C865F98h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push esi 0x0000002b call 00007FB75C865F98h 0x00000030 pop esi 0x00000031 mov dword ptr [esp+04h], esi 0x00000035 add dword ptr [esp+04h], 00000017h 0x0000003d inc esi 0x0000003e push esi 0x0000003f ret 0x00000040 pop esi 0x00000041 ret 0x00000042 js 00007FB75C865F9Ch 0x00000048 mov ebx, dword ptr [ebp+122D3791h] 0x0000004e push 00000000h 0x00000050 pushad 0x00000051 mov bl, ah 0x00000053 pushad 0x00000054 jns 00007FB75C865F96h 0x0000005a popad 0x0000005b popad 0x0000005c xchg eax, esi 0x0000005d jne 00007FB75C865FADh 0x00000063 push eax 0x00000064 pushad 0x00000065 push eax 0x00000066 push edx 0x00000067 jmp 00007FB75C865FA8h 0x0000006c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 76F6ED second address: 76F6F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 76E6E8 second address: 76E6EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 76E7B2 second address: 76E7B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 772829 second address: 77282F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 77282F second address: 772842 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB75D0E6D8Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 772842 second address: 77284B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ecx 0x00000006 push edx 0x00000007 pop edx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 76F8D5 second address: 76F8D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 77F116 second address: 77F11A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 77F11A second address: 77F157 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FB75D0E6D99h 0x00000008 jmp 00007FB75D0E6D92h 0x0000000d pop edi 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB75D0E6D8Ah 0x00000017 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 77F157 second address: 77F194 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB75C865FB0h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB75C865FA9h 0x0000000f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 77F194 second address: 77F198 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 77F890 second address: 77F8A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB75C865F9Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 77F8A0 second address: 77F8BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FB75D0E6D90h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 77F8BD second address: 77F8E2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007FB75C865F9Eh 0x0000000e push edi 0x0000000f pop edi 0x00000010 jng 00007FB75C865F96h 0x00000016 pushad 0x00000017 jp 00007FB75C865F96h 0x0000001d jp 00007FB75C865F96h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 77FB84 second address: 77FB8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 77FB8C second address: 77FB98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB75C865F96h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 77FE1A second address: 77FE32 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB75D0E6D8Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jns 00007FB75D0E6D86h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7800F7 second address: 7800FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7800FB second address: 7800FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7800FF second address: 780105 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 780105 second address: 78010F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 78010F second address: 780113 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 780113 second address: 780119 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 780119 second address: 780123 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FB75C865F96h 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 78BD5E second address: 78BD6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 78BD6C second address: 78BD83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB75C865F9Bh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 78BD83 second address: 78BD87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 78BD87 second address: 78BDA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB75C865FA3h 0x0000000b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 71283D second address: 712843 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 712843 second address: 712851 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB75C865F9Ah 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 789FA1 second address: 789FA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 789FA7 second address: 789FAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 789FAD second address: 789FC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FB75D0E6D8Dh 0x0000000b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 78A29A second address: 78A2BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB75C865FA7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 78A44D second address: 78A462 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FB75D0E6D86h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jp 00007FB75D0E6D86h 0x00000015 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 78A462 second address: 78A468 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 78A786 second address: 78A793 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB75D0E6D86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 78A8E1 second address: 78A906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jns 00007FB75C865F9Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FB75C865F9Eh 0x00000014 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 78A906 second address: 78A90A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 78AA60 second address: 78AA6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FB75C865F96h 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 78AA6A second address: 78AA75 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 78AA75 second address: 78AA8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 pushad 0x00000007 push edx 0x00000008 jmp 00007FB75C865F9Ch 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 78AA8E second address: 78AA92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 78AD9E second address: 78ADA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 78B467 second address: 78B489 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FB75D0E6D86h 0x0000000a popad 0x0000000b jmp 00007FB75D0E6D93h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 78B489 second address: 78B48F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 78B48F second address: 78B493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 759A91 second address: 759A95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 78BBC8 second address: 78BC1C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB75D0E6D99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a pushad 0x0000000b popad 0x0000000c je 00007FB75D0E6D86h 0x00000012 pop ecx 0x00000013 jc 00007FB75D0E6D88h 0x00000019 push eax 0x0000001a pop eax 0x0000001b ja 00007FB75D0E6D8Eh 0x00000021 push eax 0x00000022 pop eax 0x00000023 jl 00007FB75D0E6D86h 0x00000029 popad 0x0000002a pushad 0x0000002b jmp 00007FB75D0E6D8Dh 0x00000030 push eax 0x00000031 push edx 0x00000032 jng 00007FB75D0E6D86h 0x00000038 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7899CC second address: 7899D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 793369 second address: 793396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB75D0E6D94h 0x00000009 pop ebx 0x0000000a jmp 00007FB75D0E6D8Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pop edi 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 793396 second address: 79339C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 71C9C5 second address: 71C9E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FB75D0E6D97h 0x0000000e rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 792E9D second address: 792EB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB75C865F9Ch 0x0000000e rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 792EB2 second address: 792EDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnl 00007FB75D0E6D8Ch 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB75D0E6D92h 0x00000017 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 792EDC second address: 792EE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 792EE0 second address: 792EEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007FB75D0E6D86h 0x0000000e rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 793039 second address: 79303D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 79303D second address: 793043 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 793043 second address: 79307F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB75C865F96h 0x00000008 jmp 00007FB75C865FA1h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007FB75C865F9Fh 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 jns 00007FB75C865F96h 0x0000001f jne 00007FB75C865F96h 0x00000025 pop esi 0x00000026 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 79307F second address: 793092 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB75D0E6D8Dh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 793092 second address: 793096 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 76314C second address: 76317B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB75D0E6D96h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB75D0E6D8Eh 0x00000015 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7642A3 second address: 764314 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007FB75C865F98h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 or ebx, dword ptr [ebp+122D2BFAh] 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push edi 0x0000002f call 00007FB75C865F98h 0x00000034 pop edi 0x00000035 mov dword ptr [esp+04h], edi 0x00000039 add dword ptr [esp+04h], 0000001Bh 0x00000041 inc edi 0x00000042 push edi 0x00000043 ret 0x00000044 pop edi 0x00000045 ret 0x00000046 push 00000000h 0x00000048 jmp 00007FB75C865FA1h 0x0000004d push eax 0x0000004e pushad 0x0000004f pushad 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7B03C8 second address: 7B03CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 77282F second address: 772842 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB75C865F9Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7B58C9 second address: 7B58FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FB75C865FA2h 0x0000000a pushad 0x0000000b jmp 00007FB75C865FA1h 0x00000010 jc 00007FB75C865F96h 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7B58FB second address: 7B5905 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7B5905 second address: 7B590D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7B55F1 second address: 7B55FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FB75D0E6D86h 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7B55FB second address: 7B5605 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB75C865F96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7B7AAD second address: 7B7AB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FB75D0E6D86h 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7B7AB7 second address: 7B7ABB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 77F11A second address: 77F157 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FB75C865FA9h 0x00000008 jmp 00007FB75C865FA2h 0x0000000d pop edi 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB75C865F9Ah 0x00000017 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 77F157 second address: 77F194 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB75D0E6DA0h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB75D0E6D99h 0x0000000f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 77F890 second address: 77F8A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB75D0E6D8Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 77F8A0 second address: 77F8BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FB75C865FA0h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 77F8BD second address: 77F8E2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007FB75D0E6D8Eh 0x0000000e push edi 0x0000000f pop edi 0x00000010 jng 00007FB75D0E6D86h 0x00000016 pushad 0x00000017 jp 00007FB75D0E6D86h 0x0000001d jp 00007FB75D0E6D86h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 77FB8C second address: 77FB98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB75D0E6D86h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7C3009 second address: 7C300E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7C300E second address: 7C304E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c jmp 00007FB75D0E6D95h 0x00000011 pushad 0x00000012 popad 0x00000013 jo 00007FB75D0E6D86h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FB75D0E6D90h 0x00000025 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7C304E second address: 7C305E instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB75C865F96h 0x00000008 js 00007FB75C865F96h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 715D77 second address: 715DBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jne 00007FB75D0E6D86h 0x0000000c popad 0x0000000d jmp 00007FB75D0E6D90h 0x00000012 pushad 0x00000013 jmp 00007FB75D0E6D95h 0x00000018 jng 00007FB75D0E6D8Ah 0x0000001e push edx 0x0000001f pop edx 0x00000020 pushad 0x00000021 popad 0x00000022 jc 00007FB75D0E6D8Eh 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7CF878 second address: 7CF886 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FB75C865F9Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7CF886 second address: 7CF8B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB75D0E6D8Bh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d ja 00007FB75D0E6D86h 0x00000013 jg 00007FB75D0E6D86h 0x00000019 pop eax 0x0000001a jl 00007FB75D0E6D8Eh 0x00000020 jbe 00007FB75D0E6D86h 0x00000026 push esi 0x00000027 pop esi 0x00000028 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7CF8B4 second address: 7CF8CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB75C865FA2h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7D2299 second address: 7D22A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FB75D0E6D86h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7D22A4 second address: 7D22E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB75C865FA7h 0x00000009 ja 00007FB75C865F96h 0x0000000f popad 0x00000010 pushad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 push esi 0x00000014 pop esi 0x00000015 jmp 00007FB75C865FA5h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7F56BB second address: 7F56C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ecx 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7F49F5 second address: 7F4A0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB75C865FA6h 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7F4A0F second address: 7F4A15 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7F4A15 second address: 7F4A23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007FB75C865F96h 0x0000000e rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7F4A23 second address: 7F4A2F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7F4A2F second address: 7F4A3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push esi 0x00000009 pushad 0x0000000a popad 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7F4A3F second address: 7F4A49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FB75D0E6D86h 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7F4A49 second address: 7F4A78 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB75C865F96h 0x00000008 jmp 00007FB75C865FA9h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ecx 0x00000010 pushad 0x00000011 popad 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 jnp 00007FB75C865F96h 0x0000001b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7F4BA1 second address: 7F4BAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7F4BAC second address: 7F4BB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7F4E42 second address: 7F4E52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 js 00007FB75D0E6D86h 0x0000000c popad 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7F800F second address: 7F8013 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7F85E4 second address: 7F8626 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB75D0E6D86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c sub dx, E1FFh 0x00000011 push dword ptr [ebp+122D3076h] 0x00000017 jg 00007FB75D0E6D92h 0x0000001d push EF668F1Ch 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 jmp 00007FB75D0E6D8Eh 0x0000002a push edi 0x0000002b pop edi 0x0000002c popad 0x0000002d rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7F97E5 second address: 7F9803 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB75C865F96h 0x00000008 ja 00007FB75C865F96h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007FB75C865F9Eh 0x00000015 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7FB4E8 second address: 7FB50F instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB75D0E6D86h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnl 00007FB75D0E6D9Bh 0x00000012 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7FB50F second address: 7FB519 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB75C865F9Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7FCEC2 second address: 7FCEEF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FB75D0E6D8Eh 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e jmp 00007FB75D0E6D92h 0x00000013 pop eax 0x00000014 push ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7FCEEF second address: 7FCEF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 7FCEF4 second address: 7FCEFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FB75D0E6D86h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10D9887 second address: 10D989B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB75C865F9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10D989B second address: 10D98E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FB75D0E6D86h 0x0000000a popad 0x0000000b pop esi 0x0000000c pushad 0x0000000d js 00007FB75D0E6DA0h 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007FB75D0E6D98h 0x0000001a push eax 0x0000001b pushad 0x0000001c popad 0x0000001d jnl 00007FB75D0E6D86h 0x00000023 pop eax 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FB75D0E6D8Fh 0x0000002b rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10D98E3 second address: 10D98E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10C94A4 second address: 10C94F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edx 0x00000007 jmp 00007FB75D0E6D99h 0x0000000c jmp 00007FB75D0E6D98h 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FB75D0E6D92h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10C94F3 second address: 10C9510 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB75C865F96h 0x00000008 jmp 00007FB75C865FA3h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10D88AF second address: 10D88B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10D88B3 second address: 10D88D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FB75C865FA7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10D88D3 second address: 10D88D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10D88D9 second address: 10D8900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FB75C865FA6h 0x0000000c jmp 00007FB75C865F9Ah 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10D8D62 second address: 10D8D68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10D9025 second address: 10D9031 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FB75C865F96h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10D9031 second address: 10D903A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10FBC45 second address: 10FBC4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10FBC4A second address: 10FBC56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10F9BCD second address: 10F9BD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10F9BD1 second address: 10F9BD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10F9BD5 second address: 10F9BDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10F9BDF second address: 10F9BE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10F9BE5 second address: 10F9BE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10F9BE9 second address: 10F9BF3 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB75D0E6D86h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10FA5A3 second address: 10FA5B5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jl 00007FB75C865F96h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007FB75C865F96h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10FAC46 second address: 10FAC50 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10FAC50 second address: 10FAC68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB75C865FA4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10FB370 second address: 10FB376 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10FB376 second address: 10FB38E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB75C865FA0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10FB513 second address: 10FB517 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10FB517 second address: 10FB51D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10FB51D second address: 10FB54B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB75D0E6D99h 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FB75D0E6D8Bh 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10FB68E second address: 10FB694 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10FB694 second address: 10FB6A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB75D0E6D8Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10FB6A6 second address: 10FB6B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10FB6B2 second address: 10FB6B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10FBAA8 second address: 10FBAC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB75C865F9Fh 0x00000009 jnl 00007FB75C865F96h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10FBAC2 second address: 10FBACA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10FBACA second address: 10FBB03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007FB75C865F96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB75C865FA0h 0x00000015 jmp 00007FB75C865FA9h 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10FBB03 second address: 10FBB10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FB75D0E6D86h 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10FEC36 second address: 10FEC3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10FEC3C second address: 10FEC41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10FEC41 second address: 10FEC57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB75C865FA1h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10FEC57 second address: 10FEC8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB75D0E6D92h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007FB75D0E6D93h 0x00000014 push eax 0x00000015 push edx 0x00000016 push edx 0x00000017 pop edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 10FEC8C second address: 10FEC90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 11002C7 second address: 11002E0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB75D0E6D8Eh 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 110246F second address: 1102474 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 11036F9 second address: 1103712 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jbe 00007FB75D0E6D88h 0x0000000e push edx 0x0000000f pop edx 0x00000010 pushad 0x00000011 ja 00007FB75D0E6D86h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 110715F second address: 1107164 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 1107164 second address: 1107189 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007FB75D0E6D8Dh 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 jno 00007FB75D0E6D86h 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 1107189 second address: 11071CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB75C865F9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jmp 00007FB75C865F9Dh 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 jmp 00007FB75C865F9Eh 0x00000019 pop eax 0x0000001a mov di, cx 0x0000001d push FE6F782Ch 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 je 00007FB75C865F96h 0x0000002c rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 11071CE second address: 11071D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 11071D2 second address: 11071D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 11075B2 second address: 11075BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FB75D0E6D86h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 11075BC second address: 11075CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b push edi 0x0000000c pop edi 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 11079C9 second address: 11079D8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 11079D8 second address: 11079E2 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB75C865F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 1108012 second address: 1108016 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 11082AC second address: 11082CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB75C865FA4h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 1108512 second address: 1108518 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 1108518 second address: 110851C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 1108A23 second address: 1108A37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB75D0E6D90h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 1109235 second address: 1109239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 1109239 second address: 1109247 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 1109247 second address: 110924D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 110A757 second address: 110A75D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 110B128 second address: 110B137 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 110B137 second address: 110B13B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 110B13B second address: 110B141 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 110B141 second address: 110B147 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 110B147 second address: 110B1A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007FB75C865F98h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 0000001Ah 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 mov di, C544h 0x00000027 push 00000000h 0x00000029 call 00007FB75C865F9Ch 0x0000002e mov edi, dword ptr [ebp+122D37AEh] 0x00000034 pop edi 0x00000035 push 00000000h 0x00000037 pushad 0x00000038 jne 00007FB75C865F9Bh 0x0000003e add edx, dword ptr [ebp+12474F4Ah] 0x00000044 popad 0x00000045 xchg eax, ebx 0x00000046 push eax 0x00000047 push edx 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 110B1A6 second address: 110B1AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 110C76E second address: 110C7CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push esi 0x0000000c pop esi 0x0000000d popad 0x0000000e jp 00007FB75C865F9Ch 0x00000014 jne 00007FB75C865F96h 0x0000001a popad 0x0000001b nop 0x0000001c mov si, 893Fh 0x00000020 push 00000000h 0x00000022 movsx edi, cx 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push edx 0x0000002a call 00007FB75C865F98h 0x0000002f pop edx 0x00000030 mov dword ptr [esp+04h], edx 0x00000034 add dword ptr [esp+04h], 0000001Dh 0x0000003c inc edx 0x0000003d push edx 0x0000003e ret 0x0000003f pop edx 0x00000040 ret 0x00000041 mov di, 8A13h 0x00000045 xchg eax, ebx 0x00000046 je 00007FB75C865FA2h 0x0000004c jp 00007FB75C865F9Ch 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 110C7CD second address: 110C7D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 110C7D8 second address: 110C7DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 110E98B second address: 110E98F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 110E98F second address: 110E995 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 110D084 second address: 110D090 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 110D090 second address: 110D094 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 111034A second address: 11103AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007FB75D0E6D88h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 0000001Ah 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 mov ebx, dword ptr [ebp+122D3101h] 0x0000002a push 00000000h 0x0000002c jmp 00007FB75D0E6D93h 0x00000031 push 00000000h 0x00000033 sub ebx, dword ptr [ebp+122D29AAh] 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007FB75D0E6D92h 0x00000041 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 1111362 second address: 1111367 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 11104C1 second address: 11104CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FB75D0E6D86h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 1112195 second address: 1112199 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 111314C second address: 111317B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB75D0E6D96h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB75D0E6D8Eh 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 11142A3 second address: 1114314 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007FB75C865F98h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 or ebx, dword ptr [ebp+122D2BFAh] 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push edi 0x0000002f call 00007FB75C865F98h 0x00000034 pop edi 0x00000035 mov dword ptr [esp+04h], edi 0x00000039 add dword ptr [esp+04h], 0000001Bh 0x00000041 inc edi 0x00000042 push edi 0x00000043 ret 0x00000044 pop edi 0x00000045 ret 0x00000046 push 00000000h 0x00000048 jmp 00007FB75C865FA1h 0x0000004d push eax 0x0000004e pushad 0x0000004f pushad 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 11154AC second address: 11154B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 111639A second address: 11163A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FB75C865F96h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 11182F4 second address: 11182F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 11182F8 second address: 1118311 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 jbe 00007FB75C865F9Ch 0x0000000f jnc 00007FB75C865F96h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 1118311 second address: 1118369 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB75D0E6D86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007FB75D0E6D88h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 00000015h 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 pushad 0x00000027 mov dx, bx 0x0000002a cmc 0x0000002b popad 0x0000002c sub dword ptr [ebp+122D2FF1h], eax 0x00000032 push 00000000h 0x00000034 mov edi, dword ptr [ebp+122D2E0Ah] 0x0000003a push 00000000h 0x0000003c xchg eax, esi 0x0000003d jnl 00007FB75D0E6D91h 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 1118369 second address: 111837F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB75C865FA2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Special instruction interceptor: First address: 93A2F8 instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: 79A2F8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: 114A2F8 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Code function: GetCursorPos,GetCursorPos,GetCursorPos,Sleep,Sleep,GetCursorPos,	0_2_00673A40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetCursorPos,GetCursorPos,GetCursorPos,Sleep,Sleep,GetCursorPos,	6_2_004D3A40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetCursorPos,GetCursorPos,GetCursorPos,Sleep,Sleep,GetCursorPos,	7_2_004D3A40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: GetCursorPos,GetCursorPos,GetCursorPos,Sleep,Sleep,GetCursorPos,	8_2_00E83A40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: GetCursorPos,GetCursorPos,GetCursorPos,Sleep,Sleep,GetCursorPos,	10_2_00E83A40

Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Window / User API: threadDelayed 875	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Window / User API: threadDelayed 877	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Window / User API: threadDelayed 2321	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 1013	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 437	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 1069	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 420	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1426	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1221	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1251	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe TID: 360	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe TID: 2892	Thread sleep count: 875 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe TID: 2892	Thread sleep time: -1750875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe TID: 3144	Thread sleep count: 284 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe TID: 4524	Thread sleep count: 251 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe TID: 5680	Thread sleep count: 877 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe TID: 5680	Thread sleep time: -1754877s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe TID: 5532	Thread sleep count: 2321 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe TID: 5532	Thread sleep time: -4644321s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5508	Thread sleep count: 105 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5508	Thread sleep time: -210105s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5780	Thread sleep count: 122 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5780	Thread sleep time: -244122s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4112	Thread sleep count: 1013 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4112	Thread sleep time: -102313s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1272	Thread sleep count: 437 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1272	Thread sleep count: 159 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 2408	Thread sleep count: 100 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 2408	Thread sleep time: -200100s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4080	Thread sleep count: 83 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4080	Thread sleep time: -166083s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3436	Thread sleep count: 75 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3436	Thread sleep time: -150075s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 2508	Thread sleep count: 1069 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 2508	Thread sleep time: -107969s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1784	Thread sleep count: 420 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1784	Thread sleep count: 159 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5732	Thread sleep count: 74 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5732	Thread sleep time: -148074s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 6020	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 6020	Thread sleep time: -62031s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 1900	Thread sleep count: 1426 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 1900	Thread sleep time: -2853426s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 3924	Thread sleep count: 297 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7220	Thread sleep count: 257 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7468	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7468	Thread sleep time: -76038s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7460	Thread sleep count: 1221 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7460	Thread sleep time: -2443221s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7428	Thread sleep count: 280 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7552	Thread sleep count: 226 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7452	Thread sleep count: 1251 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7452	Thread sleep time: -2503251s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Last function: Thread delayed

Source: RageMP131.exe, RageMP131.exe, 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: MPGPH131.exe, 00000006.00000002.3320441207.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: RageMP131.exe, 00000008.00000002.3320468771.000000000172E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}e
Source: LisectAVT_2403002A_376.exe, 00000000.00000002.3320586655.000000000117E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&0000
Source: RageMP131.exe, 00000008.00000002.3320468771.000000000172E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 00000007.00000002.3320411319.0000000000EFD000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}&
Source: MPGPH131.exe, 00000006.00000002.3320441207.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}j4h-
Source: RageMP131.exe, 0000000A.00000002.3319335738.0000000000B12000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: RageMP131.exe, 0000000A.00000002.3319335738.0000000000B12000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: scsi#disk&ven_vmware&prosb
Source: RageMP131.exe, 0000000A.00000002.3319335738.0000000000B00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&+
Source: RageMP131.exe, 0000000A.00000002.3319335738.0000000000B12000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: RageMP131.exe, 00000008.00000002.3320468771.000000000176E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_52766DF3
Source: LisectAVT_2403002A_376.exe, 00000000.00000002.3320586655.000000000113E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_52766DF3
Source: RageMP131.exe, 00000008.00000002.3320468771.000000000172E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: RageMP131.exe, 00000008.00000003.2213925700.000000000176E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: LisectAVT_2403002A_376.exe, 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: MPGPH131.exe, 00000007.00000002.3320619593.000000000127A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&]9
Source: LisectAVT_2403002A_376.exe, 00000000.00000002.3320586655.000000000117E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}U
Source: LisectAVT_2403002A_376.exe, 00000000.00000002.3320586655.000000000113E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000s\user\AppData\Local\Temp\h
Source: LisectAVT_2403002A_376.exe, 00000000.00000002.3320586655.0000000001130000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000s
Source: LisectAVT_2403002A_376.exe, 00000000.00000002.3320586655.000000000113E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3320441207.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3320619593.000000000127A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3320468771.000000000172E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: MPGPH131.exe, 00000006.00000002.3320441207.0000000000F0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_52766DF37
Source: RageMP131.exe, 0000000A.00000002.3319335738.0000000000B00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll$

Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe

Code function: 0_2_00629F50 LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,

0_2_00629F50

Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Code function: 0_2_00673A40 mov eax, dword ptr fs:[00000030h]	0_2_00673A40
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Code function: 0_2_00673A40 mov eax, dword ptr fs:[00000030h]	0_2_00673A40
Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Code function: 0_2_00624100 mov eax, dword ptr fs:[00000030h]	0_2_00624100
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004D3A40 mov eax, dword ptr fs:[00000030h]	6_2_004D3A40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004D3A40 mov eax, dword ptr fs:[00000030h]	6_2_004D3A40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00484100 mov eax, dword ptr fs:[00000030h]	6_2_00484100
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_004D3A40 mov eax, dword ptr fs:[00000030h]	7_2_004D3A40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_004D3A40 mov eax, dword ptr fs:[00000030h]	7_2_004D3A40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00484100 mov eax, dword ptr fs:[00000030h]	7_2_00484100
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00E83A40 mov eax, dword ptr fs:[00000030h]	8_2_00E83A40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00E83A40 mov eax, dword ptr fs:[00000030h]	8_2_00E83A40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00E34100 mov eax, dword ptr fs:[00000030h]	8_2_00E34100
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00E83A40 mov eax, dword ptr fs:[00000030h]	10_2_00E83A40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00E83A40 mov eax, dword ptr fs:[00000030h]	10_2_00E83A40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00E34100 mov eax, dword ptr fs:[00000030h]	10_2_00E34100

Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe

Code function: 0_2_006EF26A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_006EF26A

Source: C:\Users\user\Desktop\LisectAVT_2403002A_376.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected RisePro Stealer

Source: Yara match	File source: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2082671106.0000000004980000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2283677130.0000000004A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2056094300.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2082082490.0000000004860000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2202132987.0000000005210000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_376.exe PID: 4320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 6284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 4612, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 4676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7424, type: MEMORYSTR

Remote Access Functionality

Yara detected RisePro Stealer

Source: Yara match	File source: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2082671106.0000000004980000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2283677130.0000000004A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2056094300.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2082082490.0000000004860000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2202132987.0000000005210000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_376.exe PID: 4320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 6284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 4612, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 4676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7424, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	12 Virtualization/Sandbox Evasion	LSASS Memory	421 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	11 Native API	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 Process Injection	Security Account Manager	12 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	213 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
LisectAVT_2403002A_376.exe	100%	Avira	TR/AD.Nekark.rxrem
LisectAVT_2403002A_376.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	100%	Avira	TR/AD.Nekark.rxrem
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Avira	TR/AD.Nekark.rxrem
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.winimage.com/zLibDll	0%	URL Reputation	safe
https://t.me/RiseProSUPPORT	0%	Avira URL Cloud	safe
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORTWj	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	LisectAVT_2403002A_376.exe, 00000000.00000003.2056094300.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002A_376.exe, 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.2082082490.0000000004860000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000007.00000003.2082671106.0000000004980000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000003.2202132987.0000000005210000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000003.2283677130.0000000004A40000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDll	LisectAVT_2403002A_376.exe, 00000000.00000003.2056094300.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002A_376.exe, 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.2082082490.0000000004860000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000007.00000003.2082671106.0000000004980000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000003.2202132987.0000000005210000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000003.2283677130.0000000004A40000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp	false	URL Reputation: safe	unknown
https://t.me/RiseProSUPPORT	LisectAVT_2403002A_376.exe, 00000000.00000002.3320586655.000000000113E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3320441207.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3320619593.000000000127A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3320468771.000000000172E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.3319335738.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORTWj	MPGPH131.exe, 00000006.00000002.3320441207.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.233.132.74	unknown	Russian Federation		2895	FREE-NET-ASFREEnetEU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1482303
Start date and time:	2024-07-25 21:00:53 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LisectAVT_2403002A_376.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@11/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: LisectAVT_2403002A_376.exe

Simulations

Behavior and APIs

Time	Type	Description
15:02:16	API Interceptor	2246693x Sleep call for process: LisectAVT_2403002A_376.exe modified
15:02:18	API Interceptor	4715x Sleep call for process: MPGPH131.exe modified
15:02:30	API Interceptor	1863722x Sleep call for process: RageMP131.exe modified
21:01:47	Task Scheduler	Run new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
21:01:47	Task Scheduler	Run new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
21:01:51	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
21:01:59	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
193.233.132.74	LisectAVT_2403002B_242.exe	Get hash	malicious	RisePro Stealer	Browse
	LisectAVT_2403002A_224.exe	Get hash	malicious	RisePro Stealer	Browse
	80OrFCsz0u.exe	Get hash	malicious	GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse
	SecuriteInfo.com.Win64.Evo-gen.28136.30716.exe	Get hash	malicious	GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse
	file.exe	Get hash	malicious	RisePro Stealer	Browse
	vGDqFBB1Jz.exe	Get hash	malicious	RisePro Stealer	Browse
	iKV7MCWDJF.exe	Get hash	malicious	RisePro Stealer	Browse
	8TFD6H44Pz.exe	Get hash	malicious	RisePro Stealer	Browse
	uRLTbkeYF7.exe	Get hash	malicious	RisePro Stealer	Browse
	7mIgg1hm7Q.exe	Get hash	malicious	RisePro Stealer	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FREE-NET-ASFREEnetEU	LisectAVT_2403002A_389.exe	Get hash	malicious	Amadey	Browse	193.233.132.56
	LisectAVT_2403002A_419.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.67
	LisectAVT_2403002A_419.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.67
	LisectAVT_2403002A_464.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.109
	LisectAVT_2403002A_464.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.109
	LisectAVT_2403002A_79.exe	Get hash	malicious	Amadey	Browse	193.233.132.56
	LisectAVT_2403002B_242.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.74
	LisectAVT_2403002B_433.exe	Get hash	malicious	Amadey	Browse	193.233.132.56
	Lisect_AVT_24003_G1B_108.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.62
	Lisect_AVT_24003_G1A_89.exe	Get hash	malicious	Bdaejec, RisePro Stealer	Browse	193.233.132.62

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_376.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2038792
Entropy (8bit):	7.945230933175329
Encrypted:	false
SSDEEP:	49152:giBIW7AlKGoEcd/sQmgKkQCsGwJdK9paQNX+x:giyWMlKGoEWsHvNGII7
MD5:	45D835BEAAF607E4CE243297CD053469
SHA1:	F96C5D84A6D93983B106CDD5A3DAF5900270285D
SHA-256:	E35B5F6AA2E9FFC815083030E2C09A5E55DF2A02528DB2FC24D6F480910F0036
SHA-512:	FCAC66D6D78B23E879C9CF993BD79C27EDB5E5251C0A347967047C0B7D4D384A5350C45A601E50C70B505631269F53D93CF51B5BADE2E3FCE669ABC31A2202E0
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$......."...f.{Tf.{Tf.{T-.xUk.{T-.~U..{T-.\|Ug.{T)..Tb.{T)..Ut.{T).xUq.{T).~U3.{T-..U..{T-.}Ug.{T-.zU}.{Tf.zT@.{T..rUz.{T..{Ug.{T...Tg.{Tf..Tg.{T..yUg.{TRichf.{T................PE..L....b.e...............".....0....... O...........@..........................PO.....,q....@.........................$.O.L...U...i.......X+.......................................................................................................... . .p..........................@....rsrc...X+.......,..................@....idata .............B..............@... ..%..........D..............@...sryzlqip.....`9......F..............@...dhhlsvvc......O.....................@....taggant.0... O.."..................@...................................................................................................................................................................................

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_376.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_376.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2038792
Entropy (8bit):	7.945230933175329
Encrypted:	false
SSDEEP:	49152:giBIW7AlKGoEcd/sQmgKkQCsGwJdK9paQNX+x:giyWMlKGoEWsHvNGII7
MD5:	45D835BEAAF607E4CE243297CD053469
SHA1:	F96C5D84A6D93983B106CDD5A3DAF5900270285D
SHA-256:	E35B5F6AA2E9FFC815083030E2C09A5E55DF2A02528DB2FC24D6F480910F0036
SHA-512:	FCAC66D6D78B23E879C9CF993BD79C27EDB5E5251C0A347967047C0B7D4D384A5350C45A601E50C70B505631269F53D93CF51B5BADE2E3FCE669ABC31A2202E0
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$......."...f.{Tf.{Tf.{T-.xUk.{T-.~U..{T-.\|Ug.{T)..Tb.{T)..Ut.{T).xUq.{T).~U3.{T-..U..{T-.}Ug.{T-.zU}.{Tf.zT@.{T..rUz.{T..{Ug.{T...Tg.{Tf..Tg.{T..yUg.{TRichf.{T................PE..L....b.e...............".....0....... O...........@..........................PO.....,q....@.........................$.O.L...U...i.......X+.......................................................................................................... . .p..........................@....rsrc...X+.......,..................@....idata .............B..............@... ..%..........D..............@...sryzlqip.....`9......F..............@...dhhlsvvc......O.....................@....taggant.0... O.."..................@...................................................................................................................................................................................

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_376.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_376.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	13
Entropy (8bit):	3.085055102756477
Encrypted:	false
SSDEEP:	3:LEtc1:b
MD5:	39493A7B7A0E39B64089776ABB9C6016
SHA1:	C9C88320AEC613944361A072D457F9C71162D100
SHA-256:	AC0BEF624CAB47942600C9B67612C7BAF3EEF4951E1493C1D46B9419873B54B8
SHA-512:	606AE9D6CDB3C0206532DD5B75AD0434FC8A829A34C675C7F0F4830CA462C5D3EBC6E56ABB1E5345866A2E8D74AA20EEFADFF708BA4367D050D09F60D412F4D3
Malicious:	false
Reputation:	low
Preview:	1721940529336

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.945230933175329
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	LisectAVT_2403002A_376.exe
File size:	2'038'792 bytes
MD5:	45d835beaaf607e4ce243297cd053469
SHA1:	f96c5d84a6d93983b106cdd5a3daf5900270285d
SHA256:	e35b5f6aa2e9ffc815083030e2c09a5e55df2a02528db2fc24d6f480910f0036
SHA512:	fcac66d6d78b23e879c9cf993bd79c27edb5e5251c0a347967047c0b7d4d384a5350c45a601e50c70b505631269f53d93cf51b5bade2e3fce669abc31a2202e0
SSDEEP:	49152:giBIW7AlKGoEcd/sQmgKkQCsGwJdK9paQNX+x:giyWMlKGoEWsHvNGII7
TLSH:	439533550E66973AEDD4A7B200A3C7ABAFC07E200672337950956CFBB73F4A81712971
File Content Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$......."...f.{Tf.{Tf.{T-.xUk.{T-.~U..{T-.\|Ug.{T)..Tb.{T)..Ut.{T).xUq.{T).~U3.{T-..U..{T-.}Ug.{T-.zU}.{Tf.zT@.{T..rUz.{T..{Ug.{T...Tg.{

File Icon


Icon Hash:	c769eccc64f6e2bb

Static PE Info

General

Entrypoint:	0x8f2000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x65FD62AE [Fri Mar 22 10:51:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FB75C6AB62Ah
psubd mm3, qword ptr [esi]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx+04h], ch
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bl
add dword ptr [eax], eax
add byte ptr [esi], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
jnle 00007FB75C6AB5A2h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x4f0f24	0x4c	sryzlqip
IMAGE_DIRECTORY_ENTRY_IMPORT	0x13b055	0x69	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x138000	0x2b58	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x13b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x137000	0x90600	2f75480034760f340c257fb5748e85ab	False	0.9931361607142857	data	7.9345365893427315	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x138000	0x2b58	0x2c00	b606861556e06d174e42b11831f5e5db	False	0.22487571022727273	data	3.9665421773066165	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x13b000	0x1000	0x200	745dea56938759dccaf9e183aa01b020	False	0.146484375	data	0.998472215956371	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x13c000	0x25a000	0x200	a2f941d88d17dd610b77ee1fa39c8c4a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
sryzlqip	0x396000	0x15b000	0x15b000	cba0fcb5db96c6ccd9120b45c7808805	False	0.9946141311689481	data	7.95317001843216	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
dhhlsvvc	0x4f1000	0x1000	0x400	1c6cd4ed6c4700f65c7f37736a35a312	False	0.69921875	data	5.645539648822601	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4f2000	0x3000	0x2200	96b6ea8681cebabbf3bec9ceed5be3b9	False	0.06904871323529412	DOS executable (COM)	0.7825328856348389	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x138418	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Russian	Russia	0.1892116182572614
RT_GROUP_ICON	0x13a9c0	0x14	data	Russian	Russia	1.15
RT_VERSION	0x138130	0x2e4	data	Russian	Russia	0.4689189189189189
RT_MANIFEST	0x13a9d8	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Exports

Name	Ordinal	Address
Start	1	0x466e80

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-25T21:01:48.505627+0200	TCP	2049060	ET MALWARE RisePro TCP Heartbeat Packet	49704	58709	192.168.2.5	193.233.132.74
2024-07-25T21:01:50.747098+0200	TCP	2049060	ET MALWARE RisePro TCP Heartbeat Packet	49705	58709	192.168.2.5	193.233.132.74
2024-07-25T21:02:44.930427+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49716	40.127.169.103	192.168.2.5
2024-07-25T21:01:50.746738+0200	TCP	2049060	ET MALWARE RisePro TCP Heartbeat Packet	49706	58709	192.168.2.5	193.233.132.74
2024-07-25T21:02:13.893192+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49715	58709	192.168.2.5	193.233.132.74
2024-07-25T21:01:53.721499+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49706	58709	192.168.2.5	193.233.132.74
2024-07-25T21:02:06.675891+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49708	40.127.169.103	192.168.2.5
2024-07-25T21:01:53.690409+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49705	58709	192.168.2.5	193.233.132.74
2024-07-25T21:01:51.487117+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49704	58709	192.168.2.5	193.233.132.74
2024-07-25T21:02:05.596394+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49707	58709	192.168.2.5	193.233.132.74

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 21:01:48.476885080 CEST	49704	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 21:01:48.485491991 CEST	58709	49704	193.233.132.74	192.168.2.5
Jul 25, 2024 21:01:48.485595942 CEST	49704	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 21:01:48.505626917 CEST	49704	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 21:01:48.510518074 CEST	58709	49704	193.233.132.74	192.168.2.5
Jul 25, 2024 21:01:50.698812008 CEST	49705	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 21:01:50.703902006 CEST	58709	49705	193.233.132.74	192.168.2.5
Jul 25, 2024 21:01:50.703977108 CEST	49705	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 21:01:50.707576990 CEST	49706	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 21:01:50.713259935 CEST	58709	49706	193.233.132.74	192.168.2.5
Jul 25, 2024 21:01:50.713434935 CEST	49706	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 21:01:50.746737957 CEST	49706	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 21:01:50.747097969 CEST	49705	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 21:01:50.752547979 CEST	58709	49706	193.233.132.74	192.168.2.5
Jul 25, 2024 21:01:50.752624989 CEST	58709	49705	193.233.132.74	192.168.2.5
Jul 25, 2024 21:01:51.487117052 CEST	49704	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 21:01:51.492244005 CEST	58709	49704	193.233.132.74	192.168.2.5
Jul 25, 2024 21:01:53.690408945 CEST	49705	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 21:01:53.695713043 CEST	58709	49705	193.233.132.74	192.168.2.5
Jul 25, 2024 21:01:53.721498966 CEST	49706	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 21:01:53.728646994 CEST	58709	49706	193.233.132.74	192.168.2.5
Jul 25, 2024 21:02:02.586004972 CEST	49707	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 21:02:02.591368914 CEST	58709	49707	193.233.132.74	192.168.2.5
Jul 25, 2024 21:02:02.591644049 CEST	49707	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 21:02:02.606394053 CEST	49707	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 21:02:02.611345053 CEST	58709	49707	193.233.132.74	192.168.2.5
Jul 25, 2024 21:02:05.596394062 CEST	49707	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 21:02:05.605756998 CEST	58709	49707	193.233.132.74	192.168.2.5
Jul 25, 2024 21:02:09.892503023 CEST	58709	49704	193.233.132.74	192.168.2.5
Jul 25, 2024 21:02:09.892610073 CEST	49704	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 21:02:10.881210089 CEST	49715	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 21:02:10.886512041 CEST	58709	49715	193.233.132.74	192.168.2.5
Jul 25, 2024 21:02:10.886595964 CEST	49715	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 21:02:10.909859896 CEST	49715	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 21:02:10.914855003 CEST	58709	49715	193.233.132.74	192.168.2.5
Jul 25, 2024 21:02:12.077375889 CEST	58709	49706	193.233.132.74	192.168.2.5
Jul 25, 2024 21:02:12.077533007 CEST	49706	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 21:02:12.082139969 CEST	58709	49705	193.233.132.74	192.168.2.5
Jul 25, 2024 21:02:12.082227945 CEST	49705	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 21:02:13.893192053 CEST	49715	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 21:02:13.898690939 CEST	58709	49715	193.233.132.74	192.168.2.5
Jul 25, 2024 21:02:23.957034111 CEST	58709	49707	193.233.132.74	192.168.2.5
Jul 25, 2024 21:02:23.957154989 CEST	49707	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 21:02:32.253662109 CEST	58709	49715	193.233.132.74	192.168.2.5
Jul 25, 2024 21:02:32.253779888 CEST	49715	58709	192.168.2.5	193.233.132.74

Target ID:	0
Start time:	15:01:45
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\LisectAVT_2403002A_376.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LisectAVT_2403002A_376.exe"
Imagebase:	0x610000
File size:	2'038'792 bytes
MD5 hash:	45D835BEAAF607E4CE243297CD053469
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000003.2056094300.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	15:01:47
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0xd90000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:01:47
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:01:47
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0xd90000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:01:47
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:01:47
Start date:	25/07/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x470000
File size:	2'038'792 bytes
MD5 hash:	45D835BEAAF607E4CE243297CD053469
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000006.00000003.2082082490.0000000004860000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	15:01:47
Start date:	25/07/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x470000
File size:	2'038'792 bytes
MD5 hash:	45D835BEAAF607E4CE243297CD053469
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000003.2082671106.0000000004980000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	15:01:59
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0xe20000
File size:	2'038'792 bytes
MD5 hash:	45D835BEAAF607E4CE243297CD053469
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000008.00000003.2202132987.0000000005210000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	15:02:07
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0xe20000
File size:	2'038'792 bytes
MD5 hash:	45D835BEAAF607E4CE243297CD053469
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000000A.00000003.2283677130.0000000004A40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.3%
Total number of Nodes:	608
Total number of Limit Nodes:	61

Executed Functions

Function 00673A40 Relevance: 6.2, APIs: 4, Instructions: 157
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCursorPos.USER32(?), ref: 00673A53
GetCursorPos.USER32(?), ref: 00673A59
Sleep.KERNELBASE(000003E9,?,00000001,00000000,?,?,?,?,?,?,?,?,00673DB6), ref: 00673B08
Sleep.KERNELBASE(00000001,?,00000001,00000000,?,?,?,?,?,?,?,?,00673DB6), ref: 00673BBA

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: CursorSleep
String ID:
API String ID: 4211308429-0
Opcode ID: 1a6c66d1f91b64bbbdbf2df32c91999887f9e42ad697f3bda6fb30372ddc29c8
Instruction ID: fa5d62b1121d82edbf2bd534d88a2bbf9c87efa4ef183b09cb100396b2e5f199
Opcode Fuzzy Hash: 1a6c66d1f91b64bbbdbf2df32c91999887f9e42ad697f3bda6fb30372ddc29c8
Instruction Fuzzy Hash: 6451BA35A04229CFCB14CF58C8D1EAAB3B2EF54B04B29859AD4499F351D731EE05DB80

Function 0062E0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 0062E0CB
socket.WS2_32(?,?,?), ref: 0062E17F
connect.WS2_32(00000000,?,?), ref: 0062E193
closesocket.WS2_32(00000000), ref: 0062E19E

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: 0ccef1acc478b5bed8063c03673029e0c2f31180099cea1248d3798682adcd6c
Instruction ID: f35e13b18c0c8e7fb5ca36850d11f2aef7e887fb5a2c61788880153eb54bb5b8
Opcode Fuzzy Hash: 0ccef1acc478b5bed8063c03673029e0c2f31180099cea1248d3798682adcd6c
Instruction Fuzzy Hash: 9731E4716047116FD7209F24DC89B6BB7E5EB85338F015F2DF9A8963E0D33298148B92

Function 006EF290 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0061220E

Strings

`!a, xrefs: 006121FC
`!a, xrefs: 00612216

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!a$`!a
API String ID: 2659868963-2950016145
Opcode ID: f1364c98bf1024390b41e834fd73481cedb719d3e7c816810c62d8f3936c0c84
Instruction ID: 10c2a0084bb832a8a033c887293b96a7c7965a603d361288eb2e8dc991dcd90c
Opcode Fuzzy Hash: f1364c98bf1024390b41e834fd73481cedb719d3e7c816810c62d8f3936c0c84
Instruction Fuzzy Hash: D6012B7540030DABCB14EFA9E8068E977EE9A00320B448439FB18DB691EB30E9908795

Function 006F4942 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Oo, xrefs: 006F4A93, 006F4A61, 006F4AAB, 006F4AC7

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID:
String ID: Oo
API String ID: 0-1480225735
Opcode ID: ccd0d4c27a2b258e28fb89644e39586041ab14c8e1aa3a09db835466aa095f96
Instruction ID: 7f43d7ecdf5556cde8d6a00a133b6f6c59ad04af4e779adc276e92dddb292f8f
Opcode Fuzzy Hash: ccd0d4c27a2b258e28fb89644e39586041ab14c8e1aa3a09db835466aa095f96
Instruction Fuzzy Hash: C451E370A0010CAFDB14CF58C881ABBBBB2EF49364F248158F9499B756D772AE41CB94

Function 00704623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc428bf1f2cf1594aa54424dec068d3bf6b08b75b1ac6b25dd85ed2ce1e381b8
Instruction ID: e37efaa3ced52b8256df5faaa12cee5a01e54cca756fdecb75af6ad8ee35d2e5
Opcode Fuzzy Hash: bc428bf1f2cf1594aa54424dec068d3bf6b08b75b1ac6b25dd85ed2ce1e381b8
Instruction Fuzzy Hash: 8BB106B0A04249EFDB11DFA8D881BBE7BF2AF46304F148658E740972C1D778A941CBA5

Function 0061A210 Relevance: 1.7, APIs: 1, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 0061A343

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: f5ca7058737cd4a74cb10bcdbb07855ec283289a2c5dd834be772ec48a9ea0ed
Instruction ID: 32e2797657fd3bff721036d3cb28ec1490138d9b334bbb4009215ad15df755fa
Opcode Fuzzy Hash: f5ca7058737cd4a74cb10bcdbb07855ec283289a2c5dd834be772ec48a9ea0ed
Instruction Fuzzy Hash: 7C715870901208AFDB14DFA8DC45BEFB7EAEF41300F14816DF918DB282D7B59A818792

Function 0070549C Relevance: 1.7, APIs: 1, Instructions: 198
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000000,006F9087,?,00000000,00000000,00000000,?,00000000,?,0061A3EB,006F9087,00000000,0061A3EB,?,?), ref: 00705622

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: b5c943fdd9fed001374c8abdcc4c1787279e9af277cd0f5ac2ad8bf7b05409fb
Instruction ID: f0a894bd11c60ae4755404657222e98d8f495e4b8b9c543cee303613c9e617cf
Opcode Fuzzy Hash: b5c943fdd9fed001374c8abdcc4c1787279e9af277cd0f5ac2ad8bf7b05409fb
Instruction Fuzzy Hash: 5B6191B1904519EFDF11DFA8C884AEFBBFAAF09304F140249E904A7295D37AD951CFA0

Function 00680560 Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 006806AE

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction ID: 2fd6d8195ccf0a4ecc9ce930314de95d601755ec1b29172e5eab2bd1191b67fd
Opcode Fuzzy Hash: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction Fuzzy Hash: EB412772A001189FDB45EF68DD805AE7BA7AF85340F1406A9FC05EB302E730DE648BE5

Function 00704B12 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,007049F9,00000000,CF830579,00741140,0000000C,00704AB5,006F8BBD,?), ref: 00704B69

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 148b28cdeda08621171fdf856ed42d9691d1f84b6593a6718f935262a93f4a1d
Instruction ID: 7c8668310b72909ef3975bc24f54b0f216b9fa86795e425af11b2f25fa9b2b70
Opcode Fuzzy Hash: 148b28cdeda08621171fdf856ed42d9691d1f84b6593a6718f935262a93f4a1d
Instruction Fuzzy Hash: 6F1148B3A44264E6C7256234A945B7E77DA8B837B4F290709FA048F0C2EF6EE8415195

Function 006FE05C Relevance: 1.6, APIs: 1, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00740DF8,0061A3EB,00000002,0061A3EB,00000000,?,?,?,006FE166,00000000,?,0061A3EB,00000002,00740DF8), ref: 006FE099

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e37926a81bdd21529b2abab843b40432898de7f5058721369356c74b6a121806
Instruction ID: 156a3563355b68792aef6ef27d2aefc6b47ef8e51204f0093e576454ed1eb507
Opcode Fuzzy Hash: e37926a81bdd21529b2abab843b40432898de7f5058721369356c74b6a121806
Instruction Fuzzy Hash: DF012B3261411DABCF05CF18CC45CAE3F2ADB86334F240248F9509B291FA72E9518BD0

Function 007063F3 Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,006F91F7,00000000,?,00705D79,00000001,00000364,00000000,00000006,000000FF,?,00000000,006FD244,006F89C3,006F91F7,00000000), ref: 00706435

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a5613ae9b2ef08fce4082612bd87980eb6fd0916f81166bad8d6b5fc5ccf4a92
Instruction ID: 0e44b87bf9687aafac9a1fafab33556d069abc2b9029903437b67f80a803b4c7
Opcode Fuzzy Hash: a5613ae9b2ef08fce4082612bd87980eb6fd0916f81166bad8d6b5fc5ccf4a92
Instruction Fuzzy Hash: 19F0E931501165E6DB216B62DC26B6B3BC9DF41760F258312FD04961C0CB78EA3042F1

Function 00706E2D Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,0070D635,4D88C033,?,0070D635,00000220,?,007057EF,4D88C033), ref: 00706E60

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5a14fda28295d16836cc2fd18007d12cf7e007d0a3c8e3f9a0293257e01ffa9e
Instruction ID: 6b7c116df67b63f1d35e92882f3e00c712b87bfc7fa372c7baa774604345bb15
Opcode Fuzzy Hash: 5a14fda28295d16836cc2fd18007d12cf7e007d0a3c8e3f9a0293257e01ffa9e
Instruction Fuzzy Hash: 0DE0ED39101726EADB302265CD25B6B76CDAB823E0F450321FD04920D0CB28D92081E8

Non-executed Functions

Function 00629F50 Relevance: 32.1, APIs: 2, Strings: 15, Instructions: 2331injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(00000000,00000000,?,00000218,00000000), ref: 0062A1BC
WriteProcessMemory.KERNEL32(?,00000218,00629E30,00000110,00000000), ref: 0062A1DB

Strings

$, xrefs: 0062BD6D
|Nt, xrefs: 0062A2D3
type must be boolean, but is , xrefs: 0062BF3C, 0062BF6D, 0062C02B
arqt, xrefs: 0062A4C7
er, xrefs: 0062A659
v|, xrefs: 0062A52E
,, xrefs: 0062A5D2
:, xrefs: 0062A097
irvl, xrefs: 0062A527
,, xrefs: 0062A6AF
., xrefs: 0062AB30
|Nt, xrefs: 0062A321
131, xrefs: 0062A178, 0062A17F, 0062A190
%s|%s, xrefs: 0062A198
., xrefs: 0062B0E2

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: MemoryProcessWrite
String ID: $$%s|%s$,$,$.$.$131$:$arqt$er$irvl$type must be boolean, but is $v|$|Nt$|Nt
API String ID: 3559483778-4098214756
Opcode ID: 9a4f1503f810c4e76020804e40dd4439fe9852e628aea9cd553807e1f97e9482
Instruction ID: 8dd9c5b605c01edd0afa6740988dcb6b4d68f29da5595c476c71a9597218c324
Opcode Fuzzy Hash: 9a4f1503f810c4e76020804e40dd4439fe9852e628aea9cd553807e1f97e9482
Instruction Fuzzy Hash: 6523DD70D002688FDB64DFA8D858BEDBBB2EF05300F14819DE449AB392DB759A85CF51

Function 00618D70 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 327libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,?), ref: 00618E0E
GetProcAddress.KERNEL32(00000000,?), ref: 00618E1B
GetModuleHandleA.KERNEL32(?), ref: 00618E85
GetProcAddress.KERNEL32(00000000,?), ref: 00618E8C
CloseHandle.KERNEL32(?), ref: 00619092
CloseHandle.KERNEL32(?), ref: 006190F4
CloseHandle.KERNEL32(00000000), ref: 00619121

Strings

lwcf, xrefs: 00618FA9
eHlW, xrefs: 00618FA2
l, xrefs: 00618FB0
File, xrefs: 00618F73
t, xrefs: 00618E37
bkg`, xrefs: 00618DB7
p, xrefs: 00618DBE

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: Handle$Close$AddressModuleProc
String ID: File$bkg`$eHlW$l$lwcf$p$t
API String ID: 4110381430-3184506882
Opcode ID: 980ffea9b0d86130c63b95cb9d1c26636e5b8e82e8e63cc8961d5ed3b60470d1
Instruction ID: 69c952dbac37682729eec341a0087861d46b201d04a2a88b37ebcd2ffd765150
Opcode Fuzzy Hash: 980ffea9b0d86130c63b95cb9d1c26636e5b8e82e8e63cc8961d5ed3b60470d1
Instruction Fuzzy Hash: D1C1AE70D00259ABEF20CFA4CC95BEEBBBAEF05304F14446DE504AB281DB71A985CB65

Function 006955B0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 187libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,92829BBD), ref: 006955FC
GetProcAddress.KERNEL32(00000000,92829BBD), ref: 0069563E
GetProcAddress.KERNEL32(00000000,878281BC), ref: 00695686
GetProcAddress.KERNEL32(00000000,92829BBD), ref: 006956C7
GetProcAddress.KERNEL32(00000000,92829BBD), ref: 00695708
GetProcAddress.KERNEL32(00000000,878281BC), ref: 00695746
GetProcAddress.KERNEL32(00000000,92829BBD), ref: 0069578E
GetProcAddress.KERNEL32(00000000,878281BC), ref: 006957D6
GetProcAddress.KERNEL32(00000000,92829BBD), ref: 00695817
GetProcAddress.KERNEL32(00000000,92829BBD), ref: 0069585D

Strings

Fhnf, xrefs: 006957F4
yNrw, xrefs: 00695764
eIcm, xrefs: 00695835

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID: Fhnf$eIcm$yNrw
API String ID: 190572456-2794250838
Opcode ID: cc1b92fb83cfd9d2eba76f637669e992031e342bb7508b95d11d355c7687c298
Instruction ID: 5ab02f13958028b2d673b048749998c225e8651e77635798805834b5494a0d8d
Opcode Fuzzy Hash: cc1b92fb83cfd9d2eba76f637669e992031e342bb7508b95d11d355c7687c298
Instruction Fuzzy Hash: 54816EB0C1834CAEDF09CFA4C9456EEBBB9EF46300F50809ED841AB651D3794309CBA5

Function 006191A0 Relevance: 9.9, APIs: 2, Strings: 3, Instructions: 1146COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32(00000000,?), ref: 006192B0

Strings

/\/, xrefs: 0061956A, 0061959C
\, xrefs: 00619528
/, xrefs: 006194E2

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: NextProcess32
String ID: /$/\/$\
API String ID: 1850201408-1523196992
Opcode ID: a9684c0b79aa8be1dfa5fccc264561247d97b42fa1f4e09e42d0dc442a232cba
Instruction ID: 0380aa0d1a26930a455ec833e3b967968ed394f2f689566c53cb9858c3bea315
Opcode Fuzzy Hash: a9684c0b79aa8be1dfa5fccc264561247d97b42fa1f4e09e42d0dc442a232cba
Instruction Fuzzy Hash: DF92E571D002498FDF19CFA8C8A46EEFBB7AF45314F1842ADD445A7381E7315A86CBA1

Function 006873F0 Relevance: 7.9, APIs: 3, Strings: 1, Instructions: 897COMMON

Download Yara Rule

Strings

unordered_map/set too long, xrefs: 006878C7

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID:
String ID: unordered_map/set too long
API String ID: 0-306623848
Opcode ID: f5e83e82ab866aaf896b5aecc9f2510040d4ea2f7c5472b63c06232874b9f1ed
Instruction ID: 0f10fa7d28e249df8eccebe9a3e87feee8fa10c82ce84aad0ebdb87377bebee7
Opcode Fuzzy Hash: f5e83e82ab866aaf896b5aecc9f2510040d4ea2f7c5472b63c06232874b9f1ed
Instruction Fuzzy Hash: 6A6252B5E046099FCB14DF5DC88069DFBB6FF48310F248669E819AB395E730E951CB90

Function 006F84A0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction ID: 7d66f33b0a0f35218b4392936faf11a567083fd4a5c8e033234c70605f176e6e
Opcode Fuzzy Hash: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction Fuzzy Hash: 85021C71E012199FDF14CFA9C8806EEFBB2FF48314F2482A9D615E7381DB31A9418B94

Function 006850B0 Relevance: 5.3, Strings: 4, Instructions: 268COMMON

Download Yara Rule

Strings

type must be number, but is , xrefs: 00685241
/Kim, xrefs: 006852A9
/Kim, xrefs: 006852C2
type must be string, but is , xrefs: 00685114

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID:
String ID: /Kim$/Kim$type must be number, but is $type must be string, but is
API String ID: 0-1144537432
Opcode ID: e64c9402b1c65142fa15b23e57eca0f69f9c9eb675bff3c905ad8b009b2bc7f5
Instruction ID: e95ac3110a608121644531c6c79464c34aa92de507e52775e02e79b21d1776eb
Opcode Fuzzy Hash: e64c9402b1c65142fa15b23e57eca0f69f9c9eb675bff3c905ad8b009b2bc7f5
Instruction Fuzzy Hash: 76911771E006089FCB08DF6CD8557DDB7AAEB48310F14826EE81AD7391EB759E45CB84

Function 006124F0 Relevance: 2.7, Strings: 2, Instructions: 221COMMON

Download Yara Rule

Strings

Lt, xrefs: 006126B7
Lt, xrefs: 006125C7

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID:
String ID: Lt$Lt
API String ID: 0-3389236196
Opcode ID: 91e3a1db4e71e5e10073fb7e0bece2af96cee4d3681a0fcde250511906edf46e
Instruction ID: 182111e95044c21ebbdd3156a29b2b4e3e1ba8fa4407e007277fae8e3ec1dfaf
Opcode Fuzzy Hash: 91e3a1db4e71e5e10073fb7e0bece2af96cee4d3681a0fcde250511906edf46e
Instruction Fuzzy Hash: 4D7104B4E001478FDB14CF68D8F17FEBBB6EB1A300F080169D85597382C7289996D7A4

Function 006FBEAF Relevance: 1.5, Strings: 1, Instructions: 293COMMON

Download Yara Rule

Strings

0, xrefs: 006FC01F

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: f59973421acec0401f60baae4ff95d8dffc18c2ec8935f19df41d739d6144e87
Instruction ID: 15752cfa0dfd80659947a274824a8d884aae97067e6dd2604a8cf944c663e183
Opcode Fuzzy Hash: f59973421acec0401f60baae4ff95d8dffc18c2ec8935f19df41d739d6144e87
Instruction Fuzzy Hash: DCB1DF7490064ECFDB28CF68CA90ABAB7B3AF45320F14461DD69697392C731AD46CF51

Function 006EF26A Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,?,006EEC78,?,?,?,?,006240EB,?,00673C2E), ref: 006EF283

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 4ab0699eaa22abc8f7f4b345cca613462131a1c13eb5ede7bbe1551415ace10c
Instruction ID: f6056513073b0e9c639c321269754008fb535b288633e6fa3820b08f8c748575
Opcode Fuzzy Hash: 4ab0699eaa22abc8f7f4b345cca613462131a1c13eb5ede7bbe1551415ace10c
Instruction Fuzzy Hash: 02D022366023BC5B8A012FD5AC008ADBB19DA0ABD03008036EA0847214CB112E114BC9

Function 00699880 Relevance: .7, Instructions: 748COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79dd3f20e16991c15d1267149b7d153a0cd8f80b80f67dee2f78a6fbb2c20c66
Instruction ID: 490225665cf96448911b3d4bd793a20d3912e3689d48c856defc566809157fb9
Opcode Fuzzy Hash: 79dd3f20e16991c15d1267149b7d153a0cd8f80b80f67dee2f78a6fbb2c20c66
Instruction Fuzzy Hash: D7625FB0E002159BDF14CF9DC5846ADBBF6AF88308F2881ADD804AB756D735D946CB91

Function 0070F771 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4caeb42d6e3ca6b97ade45ed590790097d377850a4ef7fc359fe3da07204474
Instruction ID: 3a57aa204e9bcbb2ad35e9d14f48da149560d77495609b72be920f4de815d9a0
Opcode Fuzzy Hash: f4caeb42d6e3ca6b97ade45ed590790097d377850a4ef7fc359fe3da07204474
Instruction Fuzzy Hash: 26B1C575600745DBDB389B24CC92BB7B3E9EB45308F14863DE946C69C0EB79B985CB10

Function 00709824 Relevance: .3, Instructions: 270COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b6a5086b1900c1d5daa96ed89da9641b9abe26cbe81264f5dbb23adc8cfb83e
Instruction ID: bca37213a3932e650bb07ecb692ed22880529b3b7ae5b96dd73cf140bfe576b8
Opcode Fuzzy Hash: 3b6a5086b1900c1d5daa96ed89da9641b9abe26cbe81264f5dbb23adc8cfb83e
Instruction Fuzzy Hash: C3B10771620609DFD715CF28C48AB657BE0FF45364F298658EA99CF2E2C339E991CB40

Function 00696550 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba4c367d3561a128af2175b357766f99b7406bfb9e26fe2074cce3ab5bed38c7
Instruction ID: 4ea219070c4199a322093710a7bbfe4828fa70e05f025f3755c24dad56520d0f
Opcode Fuzzy Hash: ba4c367d3561a128af2175b357766f99b7406bfb9e26fe2074cce3ab5bed38c7
Instruction Fuzzy Hash: 7F610F716101658BD728CF5EECC04663352A79A301386861EEAC1DB3A6C73DF927DBA4

Function 00624100 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b6f8d91b258ddd366aa127feaa82e056cdafcf91b599d92903cb28a9ff09b4d
Instruction ID: b4558189d96283d10e1c2ed566ea64e467b6890010d49629dceaf4aeb78555b8
Opcode Fuzzy Hash: 8b6f8d91b258ddd366aa127feaa82e056cdafcf91b599d92903cb28a9ff09b4d
Instruction Fuzzy Hash: 2551B171E016299FCB14DF98D885AEEBBB6FF48310F14456DE415A7340DB319A44CFA4

Function 006F646A Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 920c44e739ca4d08db5b5969fbc7a5a158caad0a814d8dad7807257cb044add9
Instruction ID: 5d70da5b4fc8b9d8b89316e1cc3b8cb928f49fb33a214e1a0c792a47a223e989
Opcode Fuzzy Hash: 920c44e739ca4d08db5b5969fbc7a5a158caad0a814d8dad7807257cb044add9
Instruction Fuzzy Hash: 23516C72D00219EFDF14CF98C941AEEBBB6FF88314F198469E915AB341D734AA50DB90

Function 006F2CE0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: ece7320d628382092acfe88d7ac4c5936d32b2fff10cfb40f05a4a0b022c6e9f
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 9C113AB724108B43E6148A7DD8B46F7A397FFCA32072C437AD3828B758D222ED459E00

Function 0067F810 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0067F833
std::_Lockit::_Lockit.LIBCPMT ref: 0067F855
std::_Lockit::~_Lockit.LIBCPMT ref: 0067F875
std::_Lockit::~_Lockit.LIBCPMT ref: 0067F89F
std::_Lockit::_Lockit.LIBCPMT ref: 0067F90D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0067F959
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0067F973
std::_Lockit::~_Lockit.LIBCPMT ref: 0067FA08
std::_Facet_Register.LIBCPMT ref: 0067FA15

Strings

bad locale name, xrefs: 0067FA2F
"s, xrefs: 0067F96B, 0067F972

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$"s
API String ID: 3375549084-604839468
Opcode ID: 338c329a5bc349a56c39bf84e326abfe73db452155e6677f678be87274f20396
Instruction ID: c0a508141fa9e65212525170eaadcaacac9c8aad03f981879389293afb6b5d04
Opcode Fuzzy Hash: 338c329a5bc349a56c39bf84e326abfe73db452155e6677f678be87274f20396
Instruction Fuzzy Hash: BF619FB1D003489FEF10DFA4D845BDEBBB6AF05310F148469E909AB341EB75E905CB96

Function 00613D10 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00613E7F

Strings

ios_base::failbit set, xrefs: 00613D32
G>a, xrefs: 00613DB8
`!a, xrefs: 00613E70
ios_base::eofbit set, xrefs: 00613E41, 00613E63
@3a, xrefs: 00613DBE, 00613E9B
@3a, xrefs: 00613E84
ios_base::badbit set, xrefs: 00613E17
G>a, xrefs: 00613D2B, 00613D67, 00613D6A

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: @3a$@3a$G>a$G>a$`!a$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-527727151
Opcode ID: d9fba3af672d89c2a6776905a383dbbe5fa038a8d9542d0597eb35bb8330b0e3
Instruction ID: 225a63e647def3f9941bbc60f09c5979456d5dc87bd85b92b244f56d45e7c04b
Opcode Fuzzy Hash: d9fba3af672d89c2a6776905a383dbbe5fa038a8d9542d0597eb35bb8330b0e3
Instruction Fuzzy Hash: 0141B7B6900208AFC704DF68D845BEEB7F9EF49310F18852EF919D7741E774AA418BA4

Function 006F2E10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 006F2E47
___except_validate_context_record.LIBVCRUNTIME ref: 006F2E4F
_ValidateLocalCookies.LIBCMT ref: 006F2ED8
__IsNonwritableInCurrentImage.LIBCMT ref: 006F2F03
_ValidateLocalCookies.LIBCMT ref: 006F2F58

Strings

it, xrefs: 006F2F78
csm, xrefs: 006F2EED

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: it$csm
API String ID: 1170836740-3264412754
Opcode ID: 8736156fafcbef0299cdcfbbd07f350fe764fd22a6180758b8d5efc534791d65
Instruction ID: 9de664588bef6b4e3f8948067bb9506ea3f6714aa4b7939b3c0c1d849a66753c
Opcode Fuzzy Hash: 8736156fafcbef0299cdcfbbd07f350fe764fd22a6180758b8d5efc534791d65
Instruction Fuzzy Hash: 7B41E670A0020EABCF10DF68C895AEEBBB7AF44314F148159EA149B392D735EE55CF91

Function 00613DE0 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 79COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00613E7F

Strings

ios_base::failbit set, xrefs: 00613D32, 00613E1E
`!a, xrefs: 00613E70
ios_base::eofbit set, xrefs: 00613E28, 00613E41, 00613E63
@3a, xrefs: 00613E84
@3a, xrefs: 00613DBE, 00613E9B
ios_base::badbit set, xrefs: 00613E17

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: @3a$@3a$`!a$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-2969703582
Opcode ID: f48c951cf8818892d9afb48e0a46600bec45ee106fb853a914306a69b68e9c92
Instruction ID: ce355c44fff13ecf1932621c745f5de2de64d06d2331a9da3d6c3c273bc8b061
Opcode Fuzzy Hash: f48c951cf8818892d9afb48e0a46600bec45ee106fb853a914306a69b68e9c92
Instruction Fuzzy Hash: 532105B29003156BC714DF58D801BD6B7EDAB04310F18883EFA69CB782E774EA558B95

Function 00614C50 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 442COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00614F72
___std_exception_destroy.LIBVCRUNTIME ref: 00614FFF
___std_exception_copy.LIBVCRUNTIME ref: 006150C8

Strings

`!a, xrefs: 00614F6B, 00614FF8, 006150B9
recursive_directory_iterator::operator++, xrefs: 0061504C
@3a, xrefs: 006150CD

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$___std_exception_copy
String ID: @3a$`!a$recursive_directory_iterator::operator++
API String ID: 1206660477-3323244774
Opcode ID: 8ed24b8f2d759d10d6cf0664cf88d20b5ca656af8b1bc86a47da826170ebc4e0
Instruction ID: f49576336a6b2270542f94e8f29f7a7e4a826725d814c4635a455442063ea4bb
Opcode Fuzzy Hash: 8ed24b8f2d759d10d6cf0664cf88d20b5ca656af8b1bc86a47da826170ebc4e0
Instruction Fuzzy Hash: A8E106B19006049FDB18DF68D845BAEF7FAFF44300F148A2DE45693781DB74A944CBA5

Function 00617820 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0061799A
___std_exception_copy.LIBVCRUNTIME ref: 00617B75

Strings

`!a, xrefs: 00617985, 00617B60
`!a, xrefs: 006179A5, 00617B80
out_of_range, xrefs: 00617A27
type_error, xrefs: 0061784A

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!a$`!a$out_of_range$type_error
API String ID: 2659868963-2932849461
Opcode ID: 884423ed977d23769f0438695abc4b1e9d907763bf88919e0cab3b5aa6c85ab7
Instruction ID: 8a508275156c77be0f89056ea029d4fa6be501922bd991d7f2fb37e4d41c1578
Opcode Fuzzy Hash: 884423ed977d23769f0438695abc4b1e9d907763bf88919e0cab3b5aa6c85ab7
Instruction Fuzzy Hash: 30C159B19042488FDB58CFA8D88479DBBF6FF48310F14866DE419EB782E774A984CB54

Function 00613190 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 170COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 006132C6
___std_exception_destroy.LIBVCRUNTIME ref: 00613350

Strings

`!a, xrefs: 006132AD, 00613349
+4a, xrefs: 00613190
@3a, xrefs: 00613316
`!a, xrefs: 006132D1

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: +4a$@3a$`!a$`!a
API String ID: 2970364248-2866485508
Opcode ID: f145c6ad978ab518fd571b1c3c2b9d0474699c698534927ca1b0bd49f692599e
Instruction ID: e44043c3e0ab9d3d75962f9797dcc0a680733bb55b1093d0cfacac44eddbd370
Opcode Fuzzy Hash: f145c6ad978ab518fd571b1c3c2b9d0474699c698534927ca1b0bd49f692599e
Instruction Fuzzy Hash: CC5190719002589FDB08DF98D885BDEBBF6FF48310F14812DE815A7391D7749A85CB94

Function 006139F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00613A58
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00613AA4
__Getctype.LIBCPMT ref: 00613ABA
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00613AE6
std::_Lockit::~_Lockit.LIBCPMT ref: 00613B7B

Strings

bad locale name, xrefs: 00613B96

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: d03b691699653f84564e9d1d3cf68f16d630c6973f7999d2d156a437ba651611
Instruction ID: 87c156b5c43f2455967ef5b8aae992c0c0985d4faef21df3496067d1520c80f9
Opcode Fuzzy Hash: d03b691699653f84564e9d1d3cf68f16d630c6973f7999d2d156a437ba651611
Instruction Fuzzy Hash: 7651A3B1D003589FEF10DFA4D845BDEBBBAAF14310F184069E80AAB341E775EA44CB55

Function 0067DE70 Relevance: 9.1, APIs: 6, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0067DE93
std::_Lockit::_Lockit.LIBCPMT ref: 0067DEB6
std::_Lockit::~_Lockit.LIBCPMT ref: 0067DED6
std::_Facet_Register.LIBCPMT ref: 0067DF4B
std::_Lockit::~_Lockit.LIBCPMT ref: 0067DF63
Concurrency::cancel_current_task.LIBCPMT ref: 0067DF7B

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 1e0889e3bcbe921f94f16d2c04c36142f8f307979d70559e7513844dbde259d4
Instruction ID: 7a50dfa148f05645daab2e9572cab965cd48fb1a50b22c94f7305f6399f605c5
Opcode Fuzzy Hash: 1e0889e3bcbe921f94f16d2c04c36142f8f307979d70559e7513844dbde259d4
Instruction Fuzzy Hash: 2D4122719002599FCB14DF54D841AAEBBB6FF02720F148A6DE81A6B392D735AD00CBD5

Function 00616F40 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 349COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00617340

Strings

`!a, xrefs: 00617328
parse error, xrefs: 00616FFF, 00617018
`!a, xrefs: 0061734B
parse_error, xrefs: 00616F8B

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!a$`!a$parse error$parse_error
API String ID: 2659868963-518157307
Opcode ID: 0b38351919e88d80d53c3245a54333f215dc351a80c5bfdcc485ea16816008c6
Instruction ID: fd4282aee81379ba642bbf660b519deb2d4f09f91db1702688a9e3255d544a2d
Opcode Fuzzy Hash: 0b38351919e88d80d53c3245a54333f215dc351a80c5bfdcc485ea16816008c6
Instruction Fuzzy Hash: A3E160719042489FDB58CF68C88579DBBB2FF48300F2482ADE418EB792D774AA85CF55

Function 006173B0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 006175BE
___std_exception_destroy.LIBVCRUNTIME ref: 006175CD

Strings

`!a, xrefs: 006175B6, 006175C6
, column , xrefs: 00617434, 0061744A
at line , xrefs: 006173F7

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column $`!a
API String ID: 4194217158-4061532102
Opcode ID: fac936b3dadb10fa525367be681f9442e85a384f8480138d553411cf73e1b2f5
Instruction ID: 6474454c34ea9d5d4748950f1e47fe732f13f4cb84c3b98c5ec7acc5a0989fba
Opcode Fuzzy Hash: fac936b3dadb10fa525367be681f9442e85a384f8480138d553411cf73e1b2f5
Instruction Fuzzy Hash: 3861E571A042449FDB08DF68DC84BADBBB7FF44300F24866CE415A7782D774AA85CB95

Function 00613370 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

APIs

Part of subcall function 00613190: ___std_exception_copy.LIBVCRUNTIME ref: 006132C6

___std_exception_copy.LIBVCRUNTIME ref: 0061345F

Strings

`!a, xrefs: 00613450
+4a, xrefs: 006133B3, 00613410
@3a, xrefs: 006133F3, 0061347B
@3a, xrefs: 00613464

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: +4a$@3a$@3a$`!a
API String ID: 2659868963-729318152
Opcode ID: 5d52550c5cfb9c09c8be2772ce6ad9e2af489f0bd4a1364bc5bc475ab947eb6a
Instruction ID: a795d330ea3ed3ebc014253bc1cc80fcbcf3aa6d11de0337fa6a530aa877856d
Opcode Fuzzy Hash: 5d52550c5cfb9c09c8be2772ce6ad9e2af489f0bd4a1364bc5bc475ab947eb6a
Instruction Fuzzy Hash: 3B3165B5900209AFCB18DFA8D841AEDFBF9FB08310F14452AE515D7741E774AA90CBA5

Function 00613410 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 47COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0061345F

Strings

`!a, xrefs: 00613450
+4a, xrefs: 006133B3, 00613410
@3a, xrefs: 006133F3, 0061347B
@3a, xrefs: 00613464

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: +4a$@3a$@3a$`!a
API String ID: 2659868963-729318152
Opcode ID: e2796519b44458ba33d7c2ede9e207a3778f8b21074329a406267bfbe8570812
Instruction ID: 1c4bb9fab6f24ef6ec70d90399ddf6efce9662bb49fa8b85aabffb986181e5ab
Opcode Fuzzy Hash: e2796519b44458ba33d7c2ede9e207a3778f8b21074329a406267bfbe8570812
Instruction Fuzzy Hash: 9301FFB6500609AF8704DFA9D445C96FBFDBF44310704843AE62987651E7B4E564CBA4

Function 00616C60 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 247COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00616F11
___std_exception_destroy.LIBVCRUNTIME ref: 00616F20

Strings

[json.exception., xrefs: 00616CB8
`!a, xrefs: 00616F09, 00616F19

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.$`!a
API String ID: 4194217158-4140099681
Opcode ID: 92714117c6c7d830026bf179bc54a5fa14520a958e0683c124f2acaf32348c74
Instruction ID: 79557fa2316915cb5276b363b918c199adf2f4ab16a818f48250d609eba9ae73
Opcode Fuzzy Hash: 92714117c6c7d830026bf179bc54a5fa14520a958e0683c124f2acaf32348c74
Instruction Fuzzy Hash: 9191C274A002089FDB18CF68D884BDEBBF6EF45300F24866CF415AB792D775A985CB90

Function 00612270 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 218COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00612275

Part of subcall function 006ED6E9: std::invalid_argument::invalid_argument.LIBCONCRT ref: 006ED6F5

Strings

Lt, xrefs: 00612347
Lt, xrefs: 00612427
string too long, xrefs: 00612270

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: string too long$Lt$Lt
API String ID: 1997705970-2690579142
Opcode ID: e1367337e72a3654317d53a53353d9f7070d28b766d47b46050b4a9892611573
Instruction ID: 8deb64e3bb234c8146c45d913012e5f92180ff21536f733a6fa5d0aa67348669
Opcode Fuzzy Hash: e1367337e72a3654317d53a53353d9f7070d28b766d47b46050b4a9892611573
Instruction Fuzzy Hash: CD81F375A042869FDB05CF68C4A17EDBFF2EF5A300F1841AEC89497742C3798595CBA0

Function 00617620 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 167COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 006177B4

Strings

`!a, xrefs: 0061779F
invalid_iterator, xrefs: 00617656
`!a, xrefs: 006177BF

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!a$`!a$invalid_iterator
API String ID: 2659868963-3237503699
Opcode ID: 11f8d1eeddd601b00f409e306ac83064df6aaa92451a87d43612bf6deef0454a
Instruction ID: ea9ca5d7b9f33d6d998e1fdb7713af002e13ac65612d80bd0ed542e07428a795
Opcode Fuzzy Hash: 11f8d1eeddd601b00f409e306ac83064df6aaa92451a87d43612bf6deef0454a
Instruction Fuzzy Hash: 32514CB49002489FDB58CFA8D88479DFBF2FB48310F14866DE419EB792E774A980CB54

Function 00617BE0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 156COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00617D67

Strings

`!a, xrefs: 00617D52
`!a, xrefs: 00617D72
other_error, xrefs: 00617C0A

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!a$`!a$other_error
API String ID: 2659868963-2956210967
Opcode ID: bdea8a00d3216ffdc99e80c19f2004326f861809700b199995d20276ead4eeff
Instruction ID: 28df2186c7ebb224a20863398a0030cea5bea2e3cf665f8df192d4b06b27557b
Opcode Fuzzy Hash: bdea8a00d3216ffdc99e80c19f2004326f861809700b199995d20276ead4eeff
Instruction Fuzzy Hash: 1C514AB0D042488FDB48CFA8E8847DDBBF2BF48300F148669E459EB792D774A984CB55

Function 0067D050 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0067D06F
___std_exception_copy.LIBVCRUNTIME ref: 0067D096

Strings

`!a, xrefs: 0067D060, 0067D085
`!a, xrefs: 0067D09B

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!a$`!a
API String ID: 2659868963-2950016145
Opcode ID: 7fc8f6e7b5caad27095f023d575f6b83fa16a16d898d90fd65a25be53f7d1770
Instruction ID: fc6705a75d7eb4a5cd1f120d5c4da8df22a9418e8d339ab610109cc272735738
Opcode Fuzzy Hash: 7fc8f6e7b5caad27095f023d575f6b83fa16a16d898d90fd65a25be53f7d1770
Instruction Fuzzy Hash: 9101A4B650060AAF9704DF59D405892FBF9FB48710701853FE529CBB11E7B4E568CFA4

Function 0068B3C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0068B3DF
___std_exception_copy.LIBVCRUNTIME ref: 0068B406

Strings

`!a, xrefs: 0068B3D0, 0068B3F5
`!a, xrefs: 0068B40E

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!a$`!a
API String ID: 2659868963-2950016145
Opcode ID: d2c42db6790996b948ea0e3629afee07429951a929504ba9eac4dac7aeaba6cb
Instruction ID: 2ad8a0dac1ed10ab9413a387feaba99b608e6c0b84de971438b02f3445dc83a0
Opcode Fuzzy Hash: d2c42db6790996b948ea0e3629afee07429951a929504ba9eac4dac7aeaba6cb
Instruction Fuzzy Hash: 1FF0C4B650060AAF8708DF58D405896BBE9FB48710301853FE52ACBB02E7B4E568CFA4

Function 0068B450 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 190COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0068B612

Strings

invalid hash bucket count, xrefs: 0068B60D
Pxh, xrefs: 0068B456, 0068B5BA, 0068B5F3, 0068B54A, 0068B4F1

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_
String ID: Pxh$invalid hash bucket count
API String ID: 909987262-1744656201
Opcode ID: ccaf16c674c6138a76b4165122e7fb0dc3fcb254c6061b8da2e7a043fc4d6136
Instruction ID: 78883b0a48c40bddc078fbfb384fa7658b3e8ae9a440f10f45c582f08baa179e
Opcode Fuzzy Hash: ccaf16c674c6138a76b4165122e7fb0dc3fcb254c6061b8da2e7a043fc4d6136
Instruction Fuzzy Hash: B471F1B5A00605DFCB14DF49C18086AFBF6FF89310724C6AAD8599B356D771EA42CF90

Function 0068E440 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0068E491

Strings

type must be boolean, but is , xrefs: 0068E582
type must be string, but is , xrefs: 0068E4F8

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: type must be boolean, but is $type must be string, but is
API String ID: 118556049-436076039
Opcode ID: a68be40628d99d1458a421483f23cb6b44ee77ced1bc248a5541c8ae08079dd4
Instruction ID: cedaccc09c038b6dd72189f5571ed5c5477d54305a3b96dcf2ad6c83ea201573
Opcode Fuzzy Hash: a68be40628d99d1458a421483f23cb6b44ee77ced1bc248a5541c8ae08079dd4
Instruction Fuzzy Hash: 70413DB59002489FD714FBA4D802BDE77AADB00310F14867CF519D7782EB36E944C796

Function 00613050 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00613078

Strings

`!a, xrefs: 00613063
`!a, xrefs: 00613080

Memory Dump Source

Source File: 00000000.00000002.3319167481.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.3319079187.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319167481.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319487653.0000000000748000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.000000000074C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000008CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000990000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.0000000000997000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3319543415.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320092164.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320291056.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3320330323.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_LisectAVT_2403002A_376.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!a$`!a
API String ID: 2659868963-2950016145
Opcode ID: 7eb3a86287353dc55b1317e325ceed5a2d7e526aacdef3094f2a39781f1bd2a8
Instruction ID: e9342a2ceff3dd3d0c920b6bdbbc43443496ba9f0c73f0ea91b615df7cce7e38
Opcode Fuzzy Hash: 7eb3a86287353dc55b1317e325ceed5a2d7e526aacdef3094f2a39781f1bd2a8
Instruction Fuzzy Hash: ACE012B69013089BC710DFACD8059CAFFF9AB19711F0086BAE948D7301F6B0D5A48BD5

Analysis Process: MPGPH131.exePID: 6284, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	3.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	608
Total number of Limit Nodes:	61

Executed Functions

Function 004D3A40 Relevance: 6.2, APIs: 4, Instructions: 157
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCursorPos.USER32(?), ref: 004D3A53
GetCursorPos.USER32(?), ref: 004D3A59
Sleep.KERNELBASE(000003E9,?,00000001,00000000,?,?,?,?,?,?,?,?,004D3DB6), ref: 004D3B08
Sleep.KERNELBASE(00000001,?,00000001,00000000,?,?,?,?,?,?,?,?,004D3DB6), ref: 004D3BBA

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: CursorSleep
String ID:
API String ID: 4211308429-0
Opcode ID: 272e416546be557eb93d1227ba28ac064895928067bbcbfb31781c068874adb5
Instruction ID: 0de6e657d77e4024e5898b878d92f7b56296577fcde8be37aa0d9ac107edadb7
Opcode Fuzzy Hash: 272e416546be557eb93d1227ba28ac064895928067bbcbfb31781c068874adb5
Instruction Fuzzy Hash: 4E51A635A042198FCB24CF48C8E0EAAB3B1EF49705B29859BD445AF312D735FE06CB81

Function 0048E0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 0048E0CB
socket.WS2_32(?,?,?), ref: 0048E17F
connect.WS2_32(00000000,?,?), ref: 0048E193
closesocket.WS2_32(00000000), ref: 0048E19E

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: 12279827b1743ee00079240155b449fcf416dcbc49fae234058b515c81fd4ef5
Instruction ID: 150e1a53596166d5c7dadf4aa246144e89e79688dc4927ffb3297b41a569938d
Opcode Fuzzy Hash: 12279827b1743ee00079240155b449fcf416dcbc49fae234058b515c81fd4ef5
Instruction Fuzzy Hash: 5631C4716043116FD720AF268C8972FB7E4EB85338F055F1EF9A8963E0D33598048B96

Function 0054F290 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0047220E

Strings

`!G, xrefs: 004721FC
`!G, xrefs: 00472216

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!G$`!G
API String ID: 2659868963-861533128
Opcode ID: a2d64584a69703c529089ed5d72c6a9d8f268314ba9ef04f55727482c384dd39
Instruction ID: ea9b829a6813ae5cb2a36d30b38be6e42d71b7d1f02cb08aa8abca3b16971e9c
Opcode Fuzzy Hash: a2d64584a69703c529089ed5d72c6a9d8f268314ba9ef04f55727482c384dd39
Instruction Fuzzy Hash: 7501F73950420EABCB14AF98EC068997FECFA00314B54843AFE1CDB591E770E9548794

Function 00554942 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

OU, xrefs: 00554A93, 00554A61, 00554AAB, 00554AC7

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID: OU
API String ID: 0-2654382709
Opcode ID: 56a5bcf26af79f9dd0356ef96a19cf4d7dfc845bd8d4193fde18e20232a3abae
Instruction ID: add63043ac34d7a46c6e2f7f28e60beb6d91446766a48b601665dc828cb9d66d
Opcode Fuzzy Hash: 56a5bcf26af79f9dd0356ef96a19cf4d7dfc845bd8d4193fde18e20232a3abae
Instruction Fuzzy Hash: 9251B670A00108AFDB54CF58C855AAEBFB6FF85369F24815AFC495B252D3319E85CF90

Function 00564623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df09affec0faeaae770c997c72fa4a3ac647c7ac5199ed70f23d5b8dc15444cd
Instruction ID: cb987b40ad037e426a4c0bcbc8f9c1f960165fee2d5183613dcaaf7bcd53e040
Opcode Fuzzy Hash: df09affec0faeaae770c997c72fa4a3ac647c7ac5199ed70f23d5b8dc15444cd
Instruction Fuzzy Hash: 15B12575A0424AAFDB11DFA8D890BBEBFB1FF8A314F144159E8549B282C7709D46CF60

Function 0047A210 Relevance: 1.7, APIs: 1, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 0047A343

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 07eed9a159fc66b2ba514cc8a44c6a2bba44b52673c12348f8450c7f256577f6
Instruction ID: f82f81f92c42d92669c2b0ec9a5c99ea3ab7bda3b872a70b15e0c44f920ec420
Opcode Fuzzy Hash: 07eed9a159fc66b2ba514cc8a44c6a2bba44b52673c12348f8450c7f256577f6
Instruction Fuzzy Hash: 6C712A71900205ABDB14DF68DD49BDFBBE8EF81304F10855EF8089B382E7B99945C796

Function 0056549C Relevance: 1.7, APIs: 1, Instructions: 198
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000000,00559087,?,00000000,00000000,00000000,?,00000000,?,0047A3EB,00559087,00000000,0047A3EB,?,?), ref: 00565622

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 7545f1637d64250e1338682d5aad4b3841452b3dcf7b9383ab18719d1900c393
Instruction ID: 3c93ae1709f9fb722470ed2f912aeb4859218ef1a149646d326cf90d37a68504
Opcode Fuzzy Hash: 7545f1637d64250e1338682d5aad4b3841452b3dcf7b9383ab18719d1900c393
Instruction Fuzzy Hash: 4D61C172D4451AAFDF11DFA8C888EEEBFBABF59304F140589E801A7215E731D915CBA0

Function 004E0560 Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004E06AE

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction ID: f618768c6266538dd77c15a6d8daef243134769be093fadf45a63ab83ffcd639
Opcode Fuzzy Hash: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction Fuzzy Hash: 5C412472A00154ABCB15DF69DD806AE7BA5EF89302F1001ABFC15DB302D7B0DDA08BE5

Function 00564B12 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,005649F9,00000000,CF830579,005A1140,0000000C,00564AB5,00558BBD,?), ref: 00564B69

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 9347b99ea81f54fd447820527e9137325d7151829f76753a88647aa202aff755
Instruction ID: a9a268f30dc744d2c27efd438f81ddf9702a35d87f64ce09db50f61aa4e8e5ed
Opcode Fuzzy Hash: 9347b99ea81f54fd447820527e9137325d7151829f76753a88647aa202aff755
Instruction Fuzzy Hash: 4E116B33B0416417CF246234E855B7FBF4AEBC3774F290609F8149B0E2EE21DC815A55

Function 0055E05C Relevance: 1.6, APIs: 1, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,005A0DF8,0047A3EB,00000002,0047A3EB,00000000,?,?,?,0055E166,00000000,?,0047A3EB,00000002,005A0DF8), ref: 0055E099

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 4db73a2f5911e53e88013511818d0e6502e55c9e3909b94fb222e3d1a57e5908
Instruction ID: 4c9ef94dac46f682939e475c204705d672533eee2113522c041bc75af487a63a
Opcode Fuzzy Hash: 4db73a2f5911e53e88013511818d0e6502e55c9e3909b94fb222e3d1a57e5908
Instruction Fuzzy Hash: 61012632614119ABCF09DF18CC2AC9E3F29EB86335F240649FC519B1E1E6B1EE419BD0

Function 005663F3 Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,005591F7,00000000,?,00565D79,00000001,00000364,00000000,00000006,000000FF,?,00000000,0055D244,005589C3,005591F7,00000000), ref: 00566435

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1c51e08a1af482999d875eb021a30c228d0427eb6f1f995526b01aebcb534ef8
Instruction ID: 7fa4d5591f0b0000b30e013cbd03d3aaccf6f31e8b697396419403a96014f7fe
Opcode Fuzzy Hash: 1c51e08a1af482999d875eb021a30c228d0427eb6f1f995526b01aebcb534ef8
Instruction Fuzzy Hash: B1F0E93150412566DF316B629C86B6B7F4CFF917A2F158511EC0897080EE30E81046F1

Function 00566E2D Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,0056D635,4D88C033,?,0056D635,00000220,?,005657EF,4D88C033), ref: 00566E60

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 58f8284e770a78821ddc6c44c507d2df3f1ab1eb24d3611ac4aefc14bffa2b35
Instruction ID: 975f91dd20dea68610f05eff3444def97b3b877b771e5caeb075400635749a1b
Opcode Fuzzy Hash: 58f8284e770a78821ddc6c44c507d2df3f1ab1eb24d3611ac4aefc14bffa2b35
Instruction Fuzzy Hash: EBE0223A9006266ADB302266CD08B6B7F8CFF923B0F050521FC04D30D0DB22CC4082F8

Non-executed Functions

Function 00478D70 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 327libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,?), ref: 00478E0E
GetProcAddress.KERNEL32(00000000,?), ref: 00478E1B
GetModuleHandleA.KERNEL32(?), ref: 00478E85
GetProcAddress.KERNEL32(00000000,?), ref: 00478E8C
CloseHandle.KERNEL32(?), ref: 00479092
CloseHandle.KERNEL32(?), ref: 004790F4
CloseHandle.KERNEL32(00000000), ref: 00479121

Strings

t, xrefs: 00478E37
bkg`, xrefs: 00478DB7
eHlW, xrefs: 00478FA2
File, xrefs: 00478F73
p, xrefs: 00478DBE
lwcf, xrefs: 00478FA9
l, xrefs: 00478FB0

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Handle$Close$AddressModuleProc
String ID: File$bkg`$eHlW$l$lwcf$p$t
API String ID: 4110381430-3184506882
Opcode ID: b74ec0f29035aa3a3a308ab28fcd2dad0d3a044eb3670960dc467d2a00721248
Instruction ID: 364cf3e49dce4f86d66f46625d63d85431607bb2214cecbc0495c45ece8b2751
Opcode Fuzzy Hash: b74ec0f29035aa3a3a308ab28fcd2dad0d3a044eb3670960dc467d2a00721248
Instruction Fuzzy Hash: 43C1C170D102599AEF20DFA4CC85BEEBBB9FF05300F10846EE508BB291DB759945CB69

Function 004F55B0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 187libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,92829BBD), ref: 004F55FC
GetProcAddress.KERNEL32(00000000,92829BBD), ref: 004F563E
GetProcAddress.KERNEL32(00000000,878281BC), ref: 004F5686
GetProcAddress.KERNEL32(00000000,92829BBD), ref: 004F56C7
GetProcAddress.KERNEL32(00000000,92829BBD), ref: 004F5708
GetProcAddress.KERNEL32(00000000,878281BC), ref: 004F5746
GetProcAddress.KERNEL32(00000000,92829BBD), ref: 004F578E
GetProcAddress.KERNEL32(00000000,878281BC), ref: 004F57D6
GetProcAddress.KERNEL32(00000000,92829BBD), ref: 004F5817
GetProcAddress.KERNEL32(00000000,92829BBD), ref: 004F585D

Strings

Fhnf, xrefs: 004F57F4
eIcm, xrefs: 004F5835
yNrw, xrefs: 004F5764

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID: Fhnf$eIcm$yNrw
API String ID: 190572456-2794250838
Opcode ID: cdb6aa0b2b11038018ea66bd777482d024b75d1533eaaa1fb2f9dbc52c3f22a9
Instruction ID: d8ab32376093c22d7b34103e1964970333fc6507b1881b6f39c6a0090ad12990
Opcode Fuzzy Hash: cdb6aa0b2b11038018ea66bd777482d024b75d1533eaaa1fb2f9dbc52c3f22a9
Instruction Fuzzy Hash: DC816CB0C1834CAEDF04CFA4C9456EEBFB9EF56300F50809ED851AB251D379420ADBA5

Function 005584A0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77daf1e02919214b38c828b06974f8b377adcd4eb335215fb80a36f6c106dec3
Instruction ID: fdeaaa3ebf0b10747bb9f0a00c45aa8294b30e96e2f7feb6652133174872ed00
Opcode Fuzzy Hash: 77daf1e02919214b38c828b06974f8b377adcd4eb335215fb80a36f6c106dec3
Instruction Fuzzy Hash: D3025B71E002199BDF14CFA8C8906AEFBF1FF48315F24826AD919F7381DB31A9458B90

Function 004DF810 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004DF833
std::_Lockit::_Lockit.LIBCPMT ref: 004DF855
std::_Lockit::~_Lockit.LIBCPMT ref: 004DF875
std::_Lockit::~_Lockit.LIBCPMT ref: 004DF89F
std::_Lockit::_Lockit.LIBCPMT ref: 004DF90D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 004DF959
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 004DF973
std::_Lockit::~_Lockit.LIBCPMT ref: 004DFA08
std::_Facet_Register.LIBCPMT ref: 004DFA15

Strings

bad locale name, xrefs: 004DFA2F
"Y, xrefs: 004DF96B, 004DF972

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$"Y
API String ID: 3375549084-4290172922
Opcode ID: 44b9caf6caef79627000c4dbf6a91b1358725d129a376d51520ff679fc1611d9
Instruction ID: 74a1e5712e4ba7e3d2811e03c27fc60b48c7f496728338e8fb9bbf40c6a835d6
Opcode Fuzzy Hash: 44b9caf6caef79627000c4dbf6a91b1358725d129a376d51520ff679fc1611d9
Instruction Fuzzy Hash: 6B61A0B1D002499BDF20EFA4D859B9EBFB4BF55314F14406AE805A7341D738E909CBA6

Function 00473D10 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00473E7F

Strings

ios_base::badbit set, xrefs: 00473E17
@3G, xrefs: 00473DBE, 00473E9B
G>G, xrefs: 00473DB8
@3G, xrefs: 00473E84
ios_base::failbit set, xrefs: 00473D32
G>G, xrefs: 00473D2B, 00473D67, 00473D6A
`!G, xrefs: 00473E70
ios_base::eofbit set, xrefs: 00473E41, 00473E63

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: @3G$@3G$G>G$G>G$`!G$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-563398080
Opcode ID: bce0b297a1f7d57a012639120c9477a19674d159c273f9915af8eb9c39165454
Instruction ID: e91d1a608da2b7727c3d7d5bce3acbd783f40bdf0b967d246c1488e4d85a8287
Opcode Fuzzy Hash: bce0b297a1f7d57a012639120c9477a19674d159c273f9915af8eb9c39165454
Instruction Fuzzy Hash: F941C1B2900208AFCB14DF68D845BDEBBE8FB49310F14C52FE919D7741E774AA018BA4

Function 00552E10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00552E47
___except_validate_context_record.LIBVCRUNTIME ref: 00552E4F
_ValidateLocalCookies.LIBCMT ref: 00552ED8
__IsNonwritableInCurrentImage.LIBCMT ref: 00552F03
_ValidateLocalCookies.LIBCMT ref: 00552F58

Strings

csm, xrefs: 00552EED
iZ, xrefs: 00552F78

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: iZ$csm
API String ID: 1170836740-778996790
Opcode ID: a5c1332197daa4c36e0807b9edec7e6013b89222bd6565aff3a42ed9301fa6d1
Instruction ID: 33566db12410dc95ad1d2354497647e3c84eba4e5185683615c2afa1aed334ad
Opcode Fuzzy Hash: a5c1332197daa4c36e0807b9edec7e6013b89222bd6565aff3a42ed9301fa6d1
Instruction Fuzzy Hash: 8A41C930A002099BCF10DF68D896AAEBFB5BF46315F148456ED189B392D731DE49CB91

Function 00473DE0 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 79COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00473E7F

Strings

ios_base::badbit set, xrefs: 00473E17
@3G, xrefs: 00473DBE, 00473E9B
@3G, xrefs: 00473E84
ios_base::failbit set, xrefs: 00473D32, 00473E1E
`!G, xrefs: 00473E70
ios_base::eofbit set, xrefs: 00473E28, 00473E41, 00473E63

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: @3G$@3G$`!G$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-2384014072
Opcode ID: f9c2c221fee2b9c2c5423dd66de4cb946d6d44738dc94b5ac0f334e7a662fb80
Instruction ID: 2723b3050cea0ece6a5e53a1deebc0a498e0f2425cfda54d0ed9bda69b50234f
Opcode Fuzzy Hash: f9c2c221fee2b9c2c5423dd66de4cb946d6d44738dc94b5ac0f334e7a662fb80
Instruction Fuzzy Hash: 642105B29007056BC714DF58D806BD6BBDCBB44311F18C82BFA6C8B681E774EA149B95

Function 00474C50 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 442COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00474F72
___std_exception_destroy.LIBVCRUNTIME ref: 00474FFF
___std_exception_copy.LIBVCRUNTIME ref: 004750C8

Strings

@3G, xrefs: 004750CD
recursive_directory_iterator::operator++, xrefs: 0047504C
`!G, xrefs: 00474F6B, 00474FF8, 004750B9

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$___std_exception_copy
String ID: @3G$`!G$recursive_directory_iterator::operator++
API String ID: 1206660477-2986438110
Opcode ID: e00df74d540a41ab65799de826fe7cc2ccf64af4ef066fe7dd9266144ec27ac6
Instruction ID: c0597bfa6a472b4b5ed250750946c58b26976e0e2b054e651030a0428a48acf5
Opcode Fuzzy Hash: e00df74d540a41ab65799de826fe7cc2ccf64af4ef066fe7dd9266144ec27ac6
Instruction Fuzzy Hash: 54E138719002059FCB28DF68D945BAEFBF9FF85300F10852EE45A97781E778A904CBA5

Function 00477820 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0047799A
___std_exception_copy.LIBVCRUNTIME ref: 00477B75

Strings

out_of_range, xrefs: 00477A27
`!G, xrefs: 004779A5, 00477B80
`!G, xrefs: 00477985, 00477B60
type_error, xrefs: 0047784A

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!G$`!G$out_of_range$type_error
API String ID: 2659868963-851137949
Opcode ID: b0b7fa2ff347624bbf5de9bc186952118a5cdac52a92cb535326f92b7f614a5f
Instruction ID: 6fe9b5689b8be54bdc56cc292593b840867bf9a17ba0e2d786b68bb86398bf90
Opcode Fuzzy Hash: b0b7fa2ff347624bbf5de9bc186952118a5cdac52a92cb535326f92b7f614a5f
Instruction Fuzzy Hash: DFC158B1D002089FDB08CFA8D98479DBBF5FF49304F14866AE419EB792E774A984CB54

Function 00473190 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 170COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004732C6
___std_exception_destroy.LIBVCRUNTIME ref: 00473350

Strings

@3G, xrefs: 00473316
+4G, xrefs: 00473190
`!G, xrefs: 004732D1
`!G, xrefs: 004732AD, 00473349

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: +4G$@3G$`!G$`!G
API String ID: 2970364248-3559336284
Opcode ID: 3a7aa2bdca2219234ae42c56b794a60985d304c75aea1acfac25bd50af028015
Instruction ID: 667d16a6ab7ea3d8959fe79c5b13f4a0dfc5d5f2956904c045b1750ec808006d
Opcode Fuzzy Hash: 3a7aa2bdca2219234ae42c56b794a60985d304c75aea1acfac25bd50af028015
Instruction Fuzzy Hash: 8C51BD719002089FDB18CF98D889BDEBBF5FF49300F14812AE819A7382E7749A41CB94

Function 004739F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00473A58
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00473AA4
__Getctype.LIBCPMT ref: 00473ABA
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00473AE6
std::_Lockit::~_Lockit.LIBCPMT ref: 00473B7B

Strings

bad locale name, xrefs: 00473B96

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: efed89d3fe8b498b217300821948781b63d2b113f772384345a46754d2a26a93
Instruction ID: 70efdd35b9c9b0d9c028b1abfe49b4792fda1fb6aad441632d6e919cae533f72
Opcode Fuzzy Hash: efed89d3fe8b498b217300821948781b63d2b113f772384345a46754d2a26a93
Instruction Fuzzy Hash: 915155B1D002099BDF10DF94D845BDEBFB8BF54315F14806AE809AB342E779EA08CB65

Function 004DDE70 Relevance: 9.1, APIs: 6, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004DDE93
std::_Lockit::_Lockit.LIBCPMT ref: 004DDEB6
std::_Lockit::~_Lockit.LIBCPMT ref: 004DDED6
std::_Facet_Register.LIBCPMT ref: 004DDF4B
std::_Lockit::~_Lockit.LIBCPMT ref: 004DDF63
Concurrency::cancel_current_task.LIBCPMT ref: 004DDF7B

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 668e7b1d4786d6d702c5465ded3c327bda0971fcc79fadb70a045dcdb5acfe43
Instruction ID: 2068c38516469a1e4d40cc816413e4b3b901670ab9840ff521b245c0e3745c58
Opcode Fuzzy Hash: 668e7b1d4786d6d702c5465ded3c327bda0971fcc79fadb70a045dcdb5acfe43
Instruction Fuzzy Hash: D6412071D0020ADFCB10DF54D885AAABBB4FB56324F14462FE8169B382D734AD05CBE5

Function 00476F40 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 349COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00477340

Strings

`!G, xrefs: 0047734B
parse error, xrefs: 00476FFF, 00477018
parse_error, xrefs: 00476F8B
`!G, xrefs: 00477328

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!G$`!G$parse error$parse_error
API String ID: 2659868963-2190908755
Opcode ID: 6f3f3042948ca537abbee36cb7f2eca19dd65496e58836aab1686f2038104c84
Instruction ID: 5878e24ccd26e0ea6043a797032d0321f771fa604de04d2348ba9a0efe53c201
Opcode Fuzzy Hash: 6f3f3042948ca537abbee36cb7f2eca19dd65496e58836aab1686f2038104c84
Instruction Fuzzy Hash: FCE17F709042488FDB18CF68C984B9DBBB1FF49304F6482AAE418EB792D7749A81CF55

Function 004773B0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 004775BE
___std_exception_destroy.LIBVCRUNTIME ref: 004775CD

Strings

, column , xrefs: 00477434, 0047744A
at line , xrefs: 004773F7
`!G, xrefs: 004775B6, 004775C6

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column $`!G
API String ID: 4194217158-538675771
Opcode ID: e314b7aef53c17d9a565b88a96f8e913db8f718a8fc5c7f8bc590d3aede9c481
Instruction ID: 3563161adefc5bda7352f905d98c89c665a5038a81d7deb37f29c3e09d35d8c7
Opcode Fuzzy Hash: e314b7aef53c17d9a565b88a96f8e913db8f718a8fc5c7f8bc590d3aede9c481
Instruction Fuzzy Hash: D6613A70A04205AFDB08DF68DD84BEDBBB1FF45300F20862DE419A7B81D778A944CB95

Function 00473370 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

APIs

Part of subcall function 00473190: ___std_exception_copy.LIBVCRUNTIME ref: 004732C6

___std_exception_copy.LIBVCRUNTIME ref: 0047345F

Strings

@3G, xrefs: 00473464
+4G, xrefs: 004733B3, 00473410
@3G, xrefs: 004733F3, 0047347B
`!G, xrefs: 00473450

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: +4G$@3G$@3G$`!G
API String ID: 2659868963-1434760016
Opcode ID: f967517a841866efc0edea5b0f4eb6935eebd1e57f1e3aef7b5cb30a329de6a5
Instruction ID: 18c07e934f2c49bc0a53e750f943995a901f31c744afcf50c1d6c1f15f12cb21
Opcode Fuzzy Hash: f967517a841866efc0edea5b0f4eb6935eebd1e57f1e3aef7b5cb30a329de6a5
Instruction Fuzzy Hash: 1031A3729002099FCB18DFA8D845ADEFFF8FB08310F10852BE918D7641E774AA50DB95

Function 00473410 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 47COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0047345F

Strings

@3G, xrefs: 00473464
+4G, xrefs: 004733B3, 00473410
@3G, xrefs: 004733F3, 0047347B
`!G, xrefs: 00473450

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: +4G$@3G$@3G$`!G
API String ID: 2659868963-1434760016
Opcode ID: 4ab2cdb75484263c2dd6a34df84a48335cbc32d2b11be930e4406d753440490d
Instruction ID: 441aacaf2fbf4067bd02fdc7a15be91b8a7639fafb8118caa63ba8a8f9e9952f
Opcode Fuzzy Hash: 4ab2cdb75484263c2dd6a34df84a48335cbc32d2b11be930e4406d753440490d
Instruction Fuzzy Hash: 34014F7650420AAF8704DFA9D84589AFBFCFF48300700C42AE91987611EBB0E514CB94

Function 00476C60 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 247COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00476F11
___std_exception_destroy.LIBVCRUNTIME ref: 00476F20

Strings

[json.exception., xrefs: 00476CB8
`!G, xrefs: 00476F09, 00476F19

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.$`!G
API String ID: 4194217158-617180572
Opcode ID: 85fe0bb9c0c1ac58b45817ab3e954ad9fb2413a4f6c5af9ce08e642efc208dc7
Instruction ID: 13dbcce3d8a8315c86f950cf5e129a5cc2a78c8e07e7f8b7915b2713019f9d47
Opcode Fuzzy Hash: 85fe0bb9c0c1ac58b45817ab3e954ad9fb2413a4f6c5af9ce08e642efc208dc7
Instruction Fuzzy Hash: 4B91F570A006049FDB18CF68D984BDEBBF6FF45300F20856DE419AB792D774AA41CB95

Function 00472270 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 218COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00472275

Part of subcall function 0054D6E9: std::invalid_argument::invalid_argument.LIBCONCRT ref: 0054D6F5

Strings

LZ, xrefs: 00472427
string too long, xrefs: 00472270
LZ, xrefs: 00472347

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: string too long$LZ$LZ
API String ID: 1997705970-3809129928
Opcode ID: b19265e232620218b2a069955f323dbd09523bed26001e58d0ac9760c6257493
Instruction ID: d84c34cf85c847d8c23c612a771a30f4f67220a8bbf8ef0e19c7a700a9a0df7f
Opcode Fuzzy Hash: b19265e232620218b2a069955f323dbd09523bed26001e58d0ac9760c6257493
Instruction Fuzzy Hash: 58812375A042859FDB01CFA8C5507EEBFF1EF5A300F18816EC898A7742C3B98545CBA5

Function 00477620 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 167COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004777B4

Strings

invalid_iterator, xrefs: 00477656
`!G, xrefs: 004777BF
`!G, xrefs: 0047779F

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!G$`!G$invalid_iterator
API String ID: 2659868963-1772924453
Opcode ID: 0e754a55f320b80e09edf9b3791d8589806ba4b2bc04ca2e1f80463f8ffac1f1
Instruction ID: 2d7402885feecea2b2b5ead667445c2483a5f34eae7b678b3c747594bb75b441
Opcode Fuzzy Hash: 0e754a55f320b80e09edf9b3791d8589806ba4b2bc04ca2e1f80463f8ffac1f1
Instruction Fuzzy Hash: 565159B09002099FDB08CF68D99479DFBF1FB49300F14866AE419EB792E774A984CB95

Function 00477BE0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 156COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00477D67

Strings

`!G, xrefs: 00477D72
other_error, xrefs: 00477C0A
`!G, xrefs: 00477D52

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!G$`!G$other_error
API String ID: 2659868963-708321997
Opcode ID: b1dad1ce256b1684a8175d856f874e6d727c14fefad776fbc74133d5c77e269f
Instruction ID: 0059f7ea0b8d7d0d65c4a78e40f0e4aafdcd3f574c447779c698194a06912c45
Opcode Fuzzy Hash: b1dad1ce256b1684a8175d856f874e6d727c14fefad776fbc74133d5c77e269f
Instruction Fuzzy Hash: 915147B09002489FDB18CFA8D9847EDBFF1BF49300F14866AE459EB792E7749984CB54

Function 004DD050 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004DD06F
___std_exception_copy.LIBVCRUNTIME ref: 004DD096

Strings

`!G, xrefs: 004DD09B
`!G, xrefs: 004DD060, 004DD085

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!G$`!G
API String ID: 2659868963-861533128
Opcode ID: ffc60683d30c1fc0373124680826eb6edad203088708ffb1e629b638cf993db1
Instruction ID: 8e18b37ce29d110f99ca7a28c8c3b9f4d49a30332fe73968d718eb274a4bb29c
Opcode Fuzzy Hash: ffc60683d30c1fc0373124680826eb6edad203088708ffb1e629b638cf993db1
Instruction Fuzzy Hash: 9001B6B6500706AF8704DF59D449882FBF8FB48710704C52BE929CBB11E7B0E528CFA0

Function 004EB3C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004EB3DF
___std_exception_copy.LIBVCRUNTIME ref: 004EB406

Strings

`!G, xrefs: 004EB40E
`!G, xrefs: 004EB3D0, 004EB3F5

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!G$`!G
API String ID: 2659868963-861533128
Opcode ID: 560c1bd13681fac5801e16c9e48f818d085bdb0ba9fbd0fc6d6104bcab60f0bb
Instruction ID: 5cf2fa362dbffaac2d6be0449ecf0d541c4a9b2f6fe90d9c37c8b6d4df1a8620
Opcode Fuzzy Hash: 560c1bd13681fac5801e16c9e48f818d085bdb0ba9fbd0fc6d6104bcab60f0bb
Instruction Fuzzy Hash: 99F0C4B6500606AF8708DF58D409886BBE8FA44710705852BE92ACBB01E7B0E528CBA0

Function 004EB450 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 190COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 004EB612

Strings

PxN, xrefs: 004EB456, 004EB5BA, 004EB5F3, 004EB54A, 004EB4F1
invalid hash bucket count, xrefs: 004EB60D

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_
String ID: PxN$invalid hash bucket count
API String ID: 909987262-1733123108
Opcode ID: 686853c08590834f98b4d53dc8c848f6fb3878168f741035d229321d22d8fdc8
Instruction ID: 89a5f42ad7e59ce31d8c25ed597cfa7b4da97e2e0051c6818ee6d7366520562e
Opcode Fuzzy Hash: 686853c08590834f98b4d53dc8c848f6fb3878168f741035d229321d22d8fdc8
Instruction Fuzzy Hash: CA7111B4A00605EFCB14CF4AC58086AFBF5FF89305724C5AAD8599B355D731EA42CF94

Function 004EE440 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004EE491

Strings

type must be string, but is , xrefs: 004EE4F8
type must be boolean, but is , xrefs: 004EE582

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: type must be boolean, but is $type must be string, but is
API String ID: 118556049-436076039
Opcode ID: 85f755cd5281175665b6242d1c0b5ceb5c41c05e4c23346af8f45d0c1d25a1d2
Instruction ID: 81dfc1ba44078b301363169bcf37febc4f1db22a60191b8dd76db3b29e99c359
Opcode Fuzzy Hash: 85f755cd5281175665b6242d1c0b5ceb5c41c05e4c23346af8f45d0c1d25a1d2
Instruction Fuzzy Hash: 04418FB5904248AFCB04EBE5D916B9E7BA8EB00304F14857BF419D77C1EB39E900C759

Function 00473050 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00473078

Strings

`!G, xrefs: 00473080
`!G, xrefs: 00473063

Memory Dump Source

Source File: 00000006.00000002.3319156368.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000006.00000002.3319086036.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319156368.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319459077.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319492640.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3319991390.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320175939.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3320203537.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!G$`!G
API String ID: 2659868963-861533128
Opcode ID: 99447c82e472c91620c5841f6879504ffad7e8dd6ed193e35288c35b8d1fa9aa
Instruction ID: 6fb6a8f85e173953e4c39241ac04ff95093df2c826d5703955637a110fd3ece0
Opcode Fuzzy Hash: 99447c82e472c91620c5841f6879504ffad7e8dd6ed193e35288c35b8d1fa9aa
Instruction Fuzzy Hash: 69E012B29053199BC710DFA8D8459CAFFF8AB59701F04C6BAE948D7300F6B0D5549BD1

Analysis Process: MPGPH131.exePID: 4612, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	650
Total number of Limit Nodes:	68

Executed Functions

Function 004D3A40 Relevance: 6.2, APIs: 4, Instructions: 157
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCursorPos.USER32(?), ref: 004D3A53
GetCursorPos.USER32(?), ref: 004D3A59
Sleep.KERNELBASE(000003E9,?,00000001,00000000,?,?,?,?,?,?,?,?,004D3DB6), ref: 004D3B08
Sleep.KERNELBASE(00000001,?,00000001,00000000,?,?,?,?,?,?,?,?,004D3DB6), ref: 004D3BBA

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: CursorSleep
String ID:
API String ID: 4211308429-0
Opcode ID: 272e416546be557eb93d1227ba28ac064895928067bbcbfb31781c068874adb5
Instruction ID: 0de6e657d77e4024e5898b878d92f7b56296577fcde8be37aa0d9ac107edadb7
Opcode Fuzzy Hash: 272e416546be557eb93d1227ba28ac064895928067bbcbfb31781c068874adb5
Instruction Fuzzy Hash: 4E51A635A042198FCB24CF48C8E0EAAB3B1EF49705B29859BD445AF312D735FE06CB81

Function 0048E0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 0048E0CB
socket.WS2_32(?,?,?), ref: 0048E17F
connect.WS2_32(00000000,?,?), ref: 0048E193
closesocket.WS2_32(00000000), ref: 0048E19E

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: 12279827b1743ee00079240155b449fcf416dcbc49fae234058b515c81fd4ef5
Instruction ID: 150e1a53596166d5c7dadf4aa246144e89e79688dc4927ffb3297b41a569938d
Opcode Fuzzy Hash: 12279827b1743ee00079240155b449fcf416dcbc49fae234058b515c81fd4ef5
Instruction Fuzzy Hash: 5631C4716043116FD720AF268C8972FB7E4EB85338F055F1EF9A8963E0D33598048B96

Function 0054F290 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0047220E

Strings

`!G, xrefs: 004721FC
`!G, xrefs: 00472216

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!G$`!G
API String ID: 2659868963-861533128
Opcode ID: a2d64584a69703c529089ed5d72c6a9d8f268314ba9ef04f55727482c384dd39
Instruction ID: ea9b829a6813ae5cb2a36d30b38be6e42d71b7d1f02cb08aa8abca3b16971e9c
Opcode Fuzzy Hash: a2d64584a69703c529089ed5d72c6a9d8f268314ba9ef04f55727482c384dd39
Instruction Fuzzy Hash: 7501F73950420EABCB14AF98EC068997FECFA00314B54843AFE1CDB591E770E9548794

Function 00554942 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

OU, xrefs: 00554A93, 00554A61, 00554AAB, 00554AC7

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID: OU
API String ID: 0-2654382709
Opcode ID: 56a5bcf26af79f9dd0356ef96a19cf4d7dfc845bd8d4193fde18e20232a3abae
Instruction ID: add63043ac34d7a46c6e2f7f28e60beb6d91446766a48b601665dc828cb9d66d
Opcode Fuzzy Hash: 56a5bcf26af79f9dd0356ef96a19cf4d7dfc845bd8d4193fde18e20232a3abae
Instruction Fuzzy Hash: 9251B670A00108AFDB54CF58C855AAEBFB6FF85369F24815AFC495B252D3319E85CF90

Function 00564623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df09affec0faeaae770c997c72fa4a3ac647c7ac5199ed70f23d5b8dc15444cd
Instruction ID: cb987b40ad037e426a4c0bcbc8f9c1f960165fee2d5183613dcaaf7bcd53e040
Opcode Fuzzy Hash: df09affec0faeaae770c997c72fa4a3ac647c7ac5199ed70f23d5b8dc15444cd
Instruction Fuzzy Hash: 15B12575A0424AAFDB11DFA8D890BBEBFB1FF8A314F144159E8549B282C7709D46CF60

Function 0047A210 Relevance: 1.7, APIs: 1, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 0047A343

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 07eed9a159fc66b2ba514cc8a44c6a2bba44b52673c12348f8450c7f256577f6
Instruction ID: f82f81f92c42d92669c2b0ec9a5c99ea3ab7bda3b872a70b15e0c44f920ec420
Opcode Fuzzy Hash: 07eed9a159fc66b2ba514cc8a44c6a2bba44b52673c12348f8450c7f256577f6
Instruction Fuzzy Hash: 6C712A71900205ABDB14DF68DD49BDFBBE8EF81304F10855EF8089B382E7B99945C796

Function 0056549C Relevance: 1.7, APIs: 1, Instructions: 198
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000000,00559087,?,00000000,00000000,00000000,?,00000000,?,0047A3EB,00559087,00000000,0047A3EB,?,?), ref: 00565622

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 7545f1637d64250e1338682d5aad4b3841452b3dcf7b9383ab18719d1900c393
Instruction ID: 3c93ae1709f9fb722470ed2f912aeb4859218ef1a149646d326cf90d37a68504
Opcode Fuzzy Hash: 7545f1637d64250e1338682d5aad4b3841452b3dcf7b9383ab18719d1900c393
Instruction Fuzzy Hash: 4D61C172D4451AAFDF11DFA8C888EEEBFBABF59304F140589E801A7215E731D915CBA0

Function 004E0560 Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004E06AE

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction ID: f618768c6266538dd77c15a6d8daef243134769be093fadf45a63ab83ffcd639
Opcode Fuzzy Hash: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction Fuzzy Hash: 5C412472A00154ABCB15DF69DD806AE7BA5EF89302F1001ABFC15DB302D7B0DDA08BE5

Function 00564B12 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,005649F9,00000000,CF830579,005A1140,0000000C,00564AB5,00558BBD,?), ref: 00564B69

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 9347b99ea81f54fd447820527e9137325d7151829f76753a88647aa202aff755
Instruction ID: a9a268f30dc744d2c27efd438f81ddf9702a35d87f64ce09db50f61aa4e8e5ed
Opcode Fuzzy Hash: 9347b99ea81f54fd447820527e9137325d7151829f76753a88647aa202aff755
Instruction Fuzzy Hash: 4E116B33B0416417CF246234E855B7FBF4AEBC3774F290609F8149B0E2EE21DC815A55

Function 0055E05C Relevance: 1.6, APIs: 1, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,005A0DF8,0047A3EB,00000002,0047A3EB,00000000,?,?,?,0055E166,00000000,?,0047A3EB,00000002,005A0DF8), ref: 0055E099

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 4db73a2f5911e53e88013511818d0e6502e55c9e3909b94fb222e3d1a57e5908
Instruction ID: 4c9ef94dac46f682939e475c204705d672533eee2113522c041bc75af487a63a
Opcode Fuzzy Hash: 4db73a2f5911e53e88013511818d0e6502e55c9e3909b94fb222e3d1a57e5908
Instruction Fuzzy Hash: 61012632614119ABCF09DF18CC2AC9E3F29EB86335F240649FC519B1E1E6B1EE419BD0

Function 005663F3 Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,005591F7,00000000,?,00565D79,00000001,00000364,00000000,00000006,000000FF,?,00000000,0055D244,005589C3,005591F7,00000000), ref: 00566435

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 41738c6dc70bae5cccd8a47a2c5e4cdc530f8dd5cf47bd7465e8e6a4fc496a5b
Instruction ID: 7fa4d5591f0b0000b30e013cbd03d3aaccf6f31e8b697396419403a96014f7fe
Opcode Fuzzy Hash: 41738c6dc70bae5cccd8a47a2c5e4cdc530f8dd5cf47bd7465e8e6a4fc496a5b
Instruction Fuzzy Hash: B1F0E93150412566DF316B629C86B6B7F4CFF917A2F158511EC0897080EE30E81046F1

Function 00566E2D Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,0056D635,4D88C033,?,0056D635,00000220,?,005657EF,4D88C033), ref: 00566E60

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0f65574856b26072984b08638ed4b5b9211d6ef0b25129d0f36bbd5850a6900d
Instruction ID: 975f91dd20dea68610f05eff3444def97b3b877b771e5caeb075400635749a1b
Opcode Fuzzy Hash: 0f65574856b26072984b08638ed4b5b9211d6ef0b25129d0f36bbd5850a6900d
Instruction Fuzzy Hash: EBE0223A9006266ADB302266CD08B6B7F8CFF923B0F050521FC04D30D0DB22CC4082F8

Non-executed Functions

Function 00478D70 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 327libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,?), ref: 00478E0E
GetProcAddress.KERNEL32(00000000,?), ref: 00478E1B
GetModuleHandleA.KERNEL32(?), ref: 00478E85
GetProcAddress.KERNEL32(00000000,?), ref: 00478E8C
CloseHandle.KERNEL32(?), ref: 00479092
CloseHandle.KERNEL32(?), ref: 004790F4
CloseHandle.KERNEL32(00000000), ref: 00479121

Strings

File, xrefs: 00478F73
t, xrefs: 00478E37
p, xrefs: 00478DBE
eHlW, xrefs: 00478FA2
bkg`, xrefs: 00478DB7
lwcf, xrefs: 00478FA9
l, xrefs: 00478FB0

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Handle$Close$AddressModuleProc
String ID: File$bkg`$eHlW$l$lwcf$p$t
API String ID: 4110381430-3184506882
Opcode ID: b74ec0f29035aa3a3a308ab28fcd2dad0d3a044eb3670960dc467d2a00721248
Instruction ID: 364cf3e49dce4f86d66f46625d63d85431607bb2214cecbc0495c45ece8b2751
Opcode Fuzzy Hash: b74ec0f29035aa3a3a308ab28fcd2dad0d3a044eb3670960dc467d2a00721248
Instruction Fuzzy Hash: 43C1C170D102599AEF20DFA4CC85BEEBBB9FF05300F10846EE508BB291DB759945CB69

Function 004F55B0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 187libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,92829BBD), ref: 004F55FC
GetProcAddress.KERNEL32(00000000,92829BBD), ref: 004F563E
GetProcAddress.KERNEL32(00000000,878281BC), ref: 004F5686
GetProcAddress.KERNEL32(00000000,92829BBD), ref: 004F56C7
GetProcAddress.KERNEL32(00000000,92829BBD), ref: 004F5708
GetProcAddress.KERNEL32(00000000,878281BC), ref: 004F5746
GetProcAddress.KERNEL32(00000000,92829BBD), ref: 004F578E
GetProcAddress.KERNEL32(00000000,878281BC), ref: 004F57D6
GetProcAddress.KERNEL32(00000000,92829BBD), ref: 004F5817
GetProcAddress.KERNEL32(00000000,92829BBD), ref: 004F585D

Strings

eIcm, xrefs: 004F5835
Fhnf, xrefs: 004F57F4
yNrw, xrefs: 004F5764

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID: Fhnf$eIcm$yNrw
API String ID: 190572456-2794250838
Opcode ID: cdb6aa0b2b11038018ea66bd777482d024b75d1533eaaa1fb2f9dbc52c3f22a9
Instruction ID: d8ab32376093c22d7b34103e1964970333fc6507b1881b6f39c6a0090ad12990
Opcode Fuzzy Hash: cdb6aa0b2b11038018ea66bd777482d024b75d1533eaaa1fb2f9dbc52c3f22a9
Instruction Fuzzy Hash: DC816CB0C1834CAEDF04CFA4C9456EEBFB9EF56300F50809ED851AB251D379420ADBA5

Function 005584A0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction ID: fdeaaa3ebf0b10747bb9f0a00c45aa8294b30e96e2f7feb6652133174872ed00
Opcode Fuzzy Hash: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction Fuzzy Hash: D3025B71E002199BDF14CFA8C8906AEFBF1FF48315F24826AD919F7381DB31A9458B90

Function 004DF810 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004DF833
std::_Lockit::_Lockit.LIBCPMT ref: 004DF855
std::_Lockit::~_Lockit.LIBCPMT ref: 004DF875
std::_Lockit::~_Lockit.LIBCPMT ref: 004DF89F
std::_Lockit::_Lockit.LIBCPMT ref: 004DF90D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 004DF959
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 004DF973
std::_Lockit::~_Lockit.LIBCPMT ref: 004DFA08
std::_Facet_Register.LIBCPMT ref: 004DFA15

Strings

bad locale name, xrefs: 004DFA2F
"Y, xrefs: 004DF96B, 004DF972

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$"Y
API String ID: 3375549084-4290172922
Opcode ID: 44b9caf6caef79627000c4dbf6a91b1358725d129a376d51520ff679fc1611d9
Instruction ID: 74a1e5712e4ba7e3d2811e03c27fc60b48c7f496728338e8fb9bbf40c6a835d6
Opcode Fuzzy Hash: 44b9caf6caef79627000c4dbf6a91b1358725d129a376d51520ff679fc1611d9
Instruction Fuzzy Hash: 6B61A0B1D002499BDF20EFA4D859B9EBFB4BF55314F14406AE805A7341D738E909CBA6

Function 00473D10 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00473E7F

Strings

G>G, xrefs: 00473DB8
`!G, xrefs: 00473E70
G>G, xrefs: 00473D2B, 00473D67, 00473D6A
ios_base::failbit set, xrefs: 00473D32
ios_base::badbit set, xrefs: 00473E17
ios_base::eofbit set, xrefs: 00473E41, 00473E63
@3G, xrefs: 00473E84
@3G, xrefs: 00473DBE, 00473E9B

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: @3G$@3G$G>G$G>G$`!G$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-563398080
Opcode ID: bce0b297a1f7d57a012639120c9477a19674d159c273f9915af8eb9c39165454
Instruction ID: e91d1a608da2b7727c3d7d5bce3acbd783f40bdf0b967d246c1488e4d85a8287
Opcode Fuzzy Hash: bce0b297a1f7d57a012639120c9477a19674d159c273f9915af8eb9c39165454
Instruction Fuzzy Hash: F941C1B2900208AFCB14DF68D845BDEBBE8FB49310F14C52FE919D7741E774AA018BA4

Function 00552E10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00552E47
___except_validate_context_record.LIBVCRUNTIME ref: 00552E4F
_ValidateLocalCookies.LIBCMT ref: 00552ED8
__IsNonwritableInCurrentImage.LIBCMT ref: 00552F03
_ValidateLocalCookies.LIBCMT ref: 00552F58

Strings

iZ, xrefs: 00552F78
csm, xrefs: 00552EED

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: iZ$csm
API String ID: 1170836740-778996790
Opcode ID: a5c1332197daa4c36e0807b9edec7e6013b89222bd6565aff3a42ed9301fa6d1
Instruction ID: 33566db12410dc95ad1d2354497647e3c84eba4e5185683615c2afa1aed334ad
Opcode Fuzzy Hash: a5c1332197daa4c36e0807b9edec7e6013b89222bd6565aff3a42ed9301fa6d1
Instruction Fuzzy Hash: 8A41C930A002099BCF10DF68D896AAEBFB5BF46315F148456ED189B392D731DE49CB91

Function 00473DE0 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 79COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00473E7F

Strings

`!G, xrefs: 00473E70
ios_base::failbit set, xrefs: 00473D32, 00473E1E
ios_base::badbit set, xrefs: 00473E17
ios_base::eofbit set, xrefs: 00473E28, 00473E41, 00473E63
@3G, xrefs: 00473E84
@3G, xrefs: 00473DBE, 00473E9B

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: @3G$@3G$`!G$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-2384014072
Opcode ID: f9c2c221fee2b9c2c5423dd66de4cb946d6d44738dc94b5ac0f334e7a662fb80
Instruction ID: 2723b3050cea0ece6a5e53a1deebc0a498e0f2425cfda54d0ed9bda69b50234f
Opcode Fuzzy Hash: f9c2c221fee2b9c2c5423dd66de4cb946d6d44738dc94b5ac0f334e7a662fb80
Instruction Fuzzy Hash: 642105B29007056BC714DF58D806BD6BBDCBB44311F18C82BFA6C8B681E774EA149B95

Function 00474C50 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 442COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00474F72
___std_exception_destroy.LIBVCRUNTIME ref: 00474FFF
___std_exception_copy.LIBVCRUNTIME ref: 004750C8

Strings

`!G, xrefs: 00474F6B, 00474FF8, 004750B9
recursive_directory_iterator::operator++, xrefs: 0047504C
@3G, xrefs: 004750CD

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$___std_exception_copy
String ID: @3G$`!G$recursive_directory_iterator::operator++
API String ID: 1206660477-2986438110
Opcode ID: e00df74d540a41ab65799de826fe7cc2ccf64af4ef066fe7dd9266144ec27ac6
Instruction ID: c0597bfa6a472b4b5ed250750946c58b26976e0e2b054e651030a0428a48acf5
Opcode Fuzzy Hash: e00df74d540a41ab65799de826fe7cc2ccf64af4ef066fe7dd9266144ec27ac6
Instruction Fuzzy Hash: 54E138719002059FCB28DF68D945BAEFBF9FF85300F10852EE45A97781E778A904CBA5

Function 00477820 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0047799A
___std_exception_copy.LIBVCRUNTIME ref: 00477B75

Strings

out_of_range, xrefs: 00477A27
`!G, xrefs: 00477985, 00477B60
`!G, xrefs: 004779A5, 00477B80
type_error, xrefs: 0047784A

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!G$`!G$out_of_range$type_error
API String ID: 2659868963-851137949
Opcode ID: b0b7fa2ff347624bbf5de9bc186952118a5cdac52a92cb535326f92b7f614a5f
Instruction ID: 6fe9b5689b8be54bdc56cc292593b840867bf9a17ba0e2d786b68bb86398bf90
Opcode Fuzzy Hash: b0b7fa2ff347624bbf5de9bc186952118a5cdac52a92cb535326f92b7f614a5f
Instruction Fuzzy Hash: DFC158B1D002089FDB08CFA8D98479DBBF5FF49304F14866AE419EB792E774A984CB54

Function 00473190 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 170COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004732C6
___std_exception_destroy.LIBVCRUNTIME ref: 00473350

Strings

`!G, xrefs: 004732AD, 00473349
`!G, xrefs: 004732D1
@3G, xrefs: 00473316
+4G, xrefs: 00473190

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: +4G$@3G$`!G$`!G
API String ID: 2970364248-3559336284
Opcode ID: 3a7aa2bdca2219234ae42c56b794a60985d304c75aea1acfac25bd50af028015
Instruction ID: 667d16a6ab7ea3d8959fe79c5b13f4a0dfc5d5f2956904c045b1750ec808006d
Opcode Fuzzy Hash: 3a7aa2bdca2219234ae42c56b794a60985d304c75aea1acfac25bd50af028015
Instruction Fuzzy Hash: 8C51BD719002089FDB18CF98D889BDEBBF5FF49300F14812AE819A7382E7749A41CB94

Function 004739F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00473A58
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00473AA4
__Getctype.LIBCPMT ref: 00473ABA
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00473AE6
std::_Lockit::~_Lockit.LIBCPMT ref: 00473B7B

Strings

bad locale name, xrefs: 00473B96

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: efed89d3fe8b498b217300821948781b63d2b113f772384345a46754d2a26a93
Instruction ID: 70efdd35b9c9b0d9c028b1abfe49b4792fda1fb6aad441632d6e919cae533f72
Opcode Fuzzy Hash: efed89d3fe8b498b217300821948781b63d2b113f772384345a46754d2a26a93
Instruction Fuzzy Hash: 915155B1D002099BDF10DF94D845BDEBFB8BF54315F14806AE809AB342E779EA08CB65

Function 004DDE70 Relevance: 9.1, APIs: 6, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004DDE93
std::_Lockit::_Lockit.LIBCPMT ref: 004DDEB6
std::_Lockit::~_Lockit.LIBCPMT ref: 004DDED6
std::_Facet_Register.LIBCPMT ref: 004DDF4B
std::_Lockit::~_Lockit.LIBCPMT ref: 004DDF63
Concurrency::cancel_current_task.LIBCPMT ref: 004DDF7B

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 668e7b1d4786d6d702c5465ded3c327bda0971fcc79fadb70a045dcdb5acfe43
Instruction ID: 2068c38516469a1e4d40cc816413e4b3b901670ab9840ff521b245c0e3745c58
Opcode Fuzzy Hash: 668e7b1d4786d6d702c5465ded3c327bda0971fcc79fadb70a045dcdb5acfe43
Instruction Fuzzy Hash: D6412071D0020ADFCB10DF54D885AAABBB4FB56324F14462FE8169B382D734AD05CBE5

Function 00476F40 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 349COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00477340

Strings

parse_error, xrefs: 00476F8B
`!G, xrefs: 00477328
`!G, xrefs: 0047734B
parse error, xrefs: 00476FFF, 00477018

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!G$`!G$parse error$parse_error
API String ID: 2659868963-2190908755
Opcode ID: 6f3f3042948ca537abbee36cb7f2eca19dd65496e58836aab1686f2038104c84
Instruction ID: 5878e24ccd26e0ea6043a797032d0321f771fa604de04d2348ba9a0efe53c201
Opcode Fuzzy Hash: 6f3f3042948ca537abbee36cb7f2eca19dd65496e58836aab1686f2038104c84
Instruction Fuzzy Hash: FCE17F709042488FDB18CF68C984B9DBBB1FF49304F6482AAE418EB792D7749A81CF55

Function 004773B0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 004775BE
___std_exception_destroy.LIBVCRUNTIME ref: 004775CD

Strings

`!G, xrefs: 004775B6, 004775C6
, column , xrefs: 00477434, 0047744A
at line , xrefs: 004773F7

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column $`!G
API String ID: 4194217158-538675771
Opcode ID: e314b7aef53c17d9a565b88a96f8e913db8f718a8fc5c7f8bc590d3aede9c481
Instruction ID: 3563161adefc5bda7352f905d98c89c665a5038a81d7deb37f29c3e09d35d8c7
Opcode Fuzzy Hash: e314b7aef53c17d9a565b88a96f8e913db8f718a8fc5c7f8bc590d3aede9c481
Instruction Fuzzy Hash: D6613A70A04205AFDB08DF68DD84BEDBBB1FF45300F20862DE419A7B81D778A944CB95

Function 00473370 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

APIs

Part of subcall function 00473190: ___std_exception_copy.LIBVCRUNTIME ref: 004732C6

___std_exception_copy.LIBVCRUNTIME ref: 0047345F

Strings

`!G, xrefs: 00473450
@3G, xrefs: 004733F3, 0047347B
@3G, xrefs: 00473464
+4G, xrefs: 004733B3, 00473410

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: +4G$@3G$@3G$`!G
API String ID: 2659868963-1434760016
Opcode ID: f967517a841866efc0edea5b0f4eb6935eebd1e57f1e3aef7b5cb30a329de6a5
Instruction ID: 18c07e934f2c49bc0a53e750f943995a901f31c744afcf50c1d6c1f15f12cb21
Opcode Fuzzy Hash: f967517a841866efc0edea5b0f4eb6935eebd1e57f1e3aef7b5cb30a329de6a5
Instruction Fuzzy Hash: 1031A3729002099FCB18DFA8D845ADEFFF8FB08310F10852BE918D7641E774AA50DB95

Function 00473410 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 47COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0047345F

Strings

`!G, xrefs: 00473450
@3G, xrefs: 004733F3, 0047347B
@3G, xrefs: 00473464
+4G, xrefs: 004733B3, 00473410

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: +4G$@3G$@3G$`!G
API String ID: 2659868963-1434760016
Opcode ID: 4ab2cdb75484263c2dd6a34df84a48335cbc32d2b11be930e4406d753440490d
Instruction ID: 441aacaf2fbf4067bd02fdc7a15be91b8a7639fafb8118caa63ba8a8f9e9952f
Opcode Fuzzy Hash: 4ab2cdb75484263c2dd6a34df84a48335cbc32d2b11be930e4406d753440490d
Instruction Fuzzy Hash: 34014F7650420AAF8704DFA9D84589AFBFCFF48300700C42AE91987611EBB0E514CB94

Function 00476C60 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 247COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00476F11
___std_exception_destroy.LIBVCRUNTIME ref: 00476F20

Strings

`!G, xrefs: 00476F09, 00476F19
[json.exception., xrefs: 00476CB8

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.$`!G
API String ID: 4194217158-617180572
Opcode ID: 85fe0bb9c0c1ac58b45817ab3e954ad9fb2413a4f6c5af9ce08e642efc208dc7
Instruction ID: 13dbcce3d8a8315c86f950cf5e129a5cc2a78c8e07e7f8b7915b2713019f9d47
Opcode Fuzzy Hash: 85fe0bb9c0c1ac58b45817ab3e954ad9fb2413a4f6c5af9ce08e642efc208dc7
Instruction Fuzzy Hash: 4B91F570A006049FDB18CF68D984BDEBBF6FF45300F20856DE419AB792D774AA41CB95

Function 00472270 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 218COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00472275

Part of subcall function 0054D6E9: std::invalid_argument::invalid_argument.LIBCONCRT ref: 0054D6F5

Strings

LZ, xrefs: 00472347
LZ, xrefs: 00472427
string too long, xrefs: 00472270

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: string too long$LZ$LZ
API String ID: 1997705970-3809129928
Opcode ID: e17a5dd1155751cc145263871ee355878a880674fc5c5285c7e32af1dc7dd40d
Instruction ID: d84c34cf85c847d8c23c612a771a30f4f67220a8bbf8ef0e19c7a700a9a0df7f
Opcode Fuzzy Hash: e17a5dd1155751cc145263871ee355878a880674fc5c5285c7e32af1dc7dd40d
Instruction Fuzzy Hash: 58812375A042859FDB01CFA8C5507EEBFF1EF5A300F18816EC898A7742C3B98545CBA5

Function 00477620 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 167COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004777B4

Strings

`!G, xrefs: 0047779F
`!G, xrefs: 004777BF
invalid_iterator, xrefs: 00477656

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!G$`!G$invalid_iterator
API String ID: 2659868963-1772924453
Opcode ID: 0e754a55f320b80e09edf9b3791d8589806ba4b2bc04ca2e1f80463f8ffac1f1
Instruction ID: 2d7402885feecea2b2b5ead667445c2483a5f34eae7b678b3c747594bb75b441
Opcode Fuzzy Hash: 0e754a55f320b80e09edf9b3791d8589806ba4b2bc04ca2e1f80463f8ffac1f1
Instruction Fuzzy Hash: 565159B09002099FDB08CF68D99479DFBF1FB49300F14866AE419EB792E774A984CB95

Function 00477BE0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 156COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00477D67

Strings

`!G, xrefs: 00477D52
other_error, xrefs: 00477C0A
`!G, xrefs: 00477D72

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!G$`!G$other_error
API String ID: 2659868963-708321997
Opcode ID: b1dad1ce256b1684a8175d856f874e6d727c14fefad776fbc74133d5c77e269f
Instruction ID: 0059f7ea0b8d7d0d65c4a78e40f0e4aafdcd3f574c447779c698194a06912c45
Opcode Fuzzy Hash: b1dad1ce256b1684a8175d856f874e6d727c14fefad776fbc74133d5c77e269f
Instruction Fuzzy Hash: 915147B09002489FDB18CFA8D9847EDBFF1BF49300F14866AE459EB792E7749984CB54

Function 004DD050 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004DD06F
___std_exception_copy.LIBVCRUNTIME ref: 004DD096

Strings

`!G, xrefs: 004DD060, 004DD085
`!G, xrefs: 004DD09B

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!G$`!G
API String ID: 2659868963-861533128
Opcode ID: ffc60683d30c1fc0373124680826eb6edad203088708ffb1e629b638cf993db1
Instruction ID: 8e18b37ce29d110f99ca7a28c8c3b9f4d49a30332fe73968d718eb274a4bb29c
Opcode Fuzzy Hash: ffc60683d30c1fc0373124680826eb6edad203088708ffb1e629b638cf993db1
Instruction Fuzzy Hash: 9001B6B6500706AF8704DF59D449882FBF8FB48710704C52BE929CBB11E7B0E528CFA0

Function 004EB3C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004EB3DF
___std_exception_copy.LIBVCRUNTIME ref: 004EB406

Strings

`!G, xrefs: 004EB3D0, 004EB3F5
`!G, xrefs: 004EB40E

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!G$`!G
API String ID: 2659868963-861533128
Opcode ID: 560c1bd13681fac5801e16c9e48f818d085bdb0ba9fbd0fc6d6104bcab60f0bb
Instruction ID: 5cf2fa362dbffaac2d6be0449ecf0d541c4a9b2f6fe90d9c37c8b6d4df1a8620
Opcode Fuzzy Hash: 560c1bd13681fac5801e16c9e48f818d085bdb0ba9fbd0fc6d6104bcab60f0bb
Instruction Fuzzy Hash: 99F0C4B6500606AF8708DF58D409886BBE8FA44710705852BE92ACBB01E7B0E528CBA0

Function 004EB450 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 190COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 004EB612

Strings

PxN, xrefs: 004EB456, 004EB5BA, 004EB5F3, 004EB54A, 004EB4F1
invalid hash bucket count, xrefs: 004EB60D

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_
String ID: PxN$invalid hash bucket count
API String ID: 909987262-1733123108
Opcode ID: 686853c08590834f98b4d53dc8c848f6fb3878168f741035d229321d22d8fdc8
Instruction ID: 89a5f42ad7e59ce31d8c25ed597cfa7b4da97e2e0051c6818ee6d7366520562e
Opcode Fuzzy Hash: 686853c08590834f98b4d53dc8c848f6fb3878168f741035d229321d22d8fdc8
Instruction Fuzzy Hash: CA7111B4A00605EFCB14CF4AC58086AFBF5FF89305724C5AAD8599B355D731EA42CF94

Function 004EE440 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004EE491

Strings

type must be string, but is , xrefs: 004EE4F8
type must be boolean, but is , xrefs: 004EE582

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: type must be boolean, but is $type must be string, but is
API String ID: 118556049-436076039
Opcode ID: 85f755cd5281175665b6242d1c0b5ceb5c41c05e4c23346af8f45d0c1d25a1d2
Instruction ID: 81dfc1ba44078b301363169bcf37febc4f1db22a60191b8dd76db3b29e99c359
Opcode Fuzzy Hash: 85f755cd5281175665b6242d1c0b5ceb5c41c05e4c23346af8f45d0c1d25a1d2
Instruction Fuzzy Hash: 04418FB5904248AFCB04EBE5D916B9E7BA8EB00304F14857BF419D77C1EB39E900C759

Function 00473050 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00473078

Strings

`!G, xrefs: 00473063
`!G, xrefs: 00473080

Memory Dump Source

Source File: 00000007.00000002.3319154863.0000000000471000.00000040.00000001.01000000.00000004.sdmp, Offset: 00470000, based on PE: true

Associated: 00000007.00000002.3319088494.0000000000470000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319154863.00000000005A3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319454932.00000000005A8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000005AC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.000000000072F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007C1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.00000000007F7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3319492334.0000000000806000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320050095.0000000000807000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320247369.0000000000961000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3320274736.0000000000962000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_470000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!G$`!G
API String ID: 2659868963-861533128
Opcode ID: 99447c82e472c91620c5841f6879504ffad7e8dd6ed193e35288c35b8d1fa9aa
Instruction ID: 6fb6a8f85e173953e4c39241ac04ff95093df2c826d5703955637a110fd3ece0
Opcode Fuzzy Hash: 99447c82e472c91620c5841f6879504ffad7e8dd6ed193e35288c35b8d1fa9aa
Instruction Fuzzy Hash: 69E012B29053199BC710DFA8D8459CAFFF8AB59701F04C6BAE948D7300F6B0D5549BD1

Analysis Process: RageMP131.exePID: 4676, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	3.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	650
Total number of Limit Nodes:	68

Executed Functions

Function 00E83A40 Relevance: 6.2, APIs: 4, Instructions: 157
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCursorPos.USER32(?), ref: 00E83A53
GetCursorPos.USER32(?), ref: 00E83A59
Sleep.KERNELBASE(000003E9,?,00000001,00000000,?,?,?,?,?,?,?,?,00E83DB6), ref: 00E83B08
Sleep.KERNELBASE(00000001,?,00000001,00000000,?,?,?,?,?,?,?,?,00E83DB6), ref: 00E83BBA

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: CursorSleep
String ID:
API String ID: 4211308429-0
Opcode ID: 95db7cfec9a3487ce25382a4d25d1ed3d675f644640085c6378ecf76888fa269
Instruction ID: b02dbafd8d822de8045ff959e7a6dfcf32d10143d32389b03428d1a9794a9b34
Opcode Fuzzy Hash: 95db7cfec9a3487ce25382a4d25d1ed3d675f644640085c6378ecf76888fa269
Instruction Fuzzy Hash: 9851CE75A041198FCB28DF68C8D0EA9B3B1FF45B08F29559AD449AF351D731EE05CB80

Function 00E3E0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00E3E0CB
socket.WS2_32(?,?,?), ref: 00E3E17F
connect.WS2_32(00000000,?,?), ref: 00E3E193
closesocket.WS2_32(00000000), ref: 00E3E19E

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: d4415bb2678a5e9c11eb5e88b1a18c136dca9f9d066c4e6b5375664871c93330
Instruction ID: 79b7c39fce77d68e32868530486a266989b43519767541d5a49d8599183a32e9
Opcode Fuzzy Hash: d4415bb2678a5e9c11eb5e88b1a18c136dca9f9d066c4e6b5375664871c93330
Instruction Fuzzy Hash: 2F3192726053116BD7209F259C8976BBBE4EB85738F016F1DF9A8A73E0D3719804CB92

Function 00EFF290 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E2220E

Strings

`!, xrefs: 00E221FC
`!, xrefs: 00E22216

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!$`!
API String ID: 2659868963-1501952390
Opcode ID: eab32b943f562d70d5863ea0e895703991a18446330479bed5feb8665a34cc35
Instruction ID: ae8cc15cf3f3d62894ca46a069ee0f44517381d210be0b1bca848ac53258cec5
Opcode Fuzzy Hash: eab32b943f562d70d5863ea0e895703991a18446330479bed5feb8665a34cc35
Instruction Fuzzy Hash: 27012B3550030DABCB14AF98EC029A977EC9E00314F008439FB18EB591EB70E964A791

Function 00E2A210 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 00E2A343

Strings

/>, xrefs: 00E2A2C1, 00E2A359, 00E2A2CA, 00E2A2D1, 00E2A378

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID: />
API String ID: 2638373210-3782486657
Opcode ID: 613f405078d69c61e7afa1c37658272bacd72fc0c55d0e3bfd55429607f926db
Instruction ID: 5207932235581cc8bad34de8421368986b5c50a8a6b747b12d9adaf104e066a1
Opcode Fuzzy Hash: 613f405078d69c61e7afa1c37658272bacd72fc0c55d0e3bfd55429607f926db
Instruction Fuzzy Hash: 99715870900214AFDB14DF68EC45BAFB7E9EF41704F14856DF809AB282D7B9E9418792

Function 00F14623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19cf0eefd71166cb62f510b92777136c8afa4b57cee8dc053ce5749408e04845
Instruction ID: 1586b34f15cb8f03c044df063045f8fd5a3a9577a610e9a2166ded10919de28c
Opcode Fuzzy Hash: 19cf0eefd71166cb62f510b92777136c8afa4b57cee8dc053ce5749408e04845
Instruction Fuzzy Hash: 1BB10671E04249AFDB11DFA8D840BFEBBB1AF86324F544158E5549B282C774BD81FB60

Function 00F1549C Relevance: 1.7, APIs: 1, Instructions: 198
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000000,00F09087,?,00000000,00000000,00000000,?,00000000,?,00E2A3EB,00F09087,00000000,00E2A3EB,?,?), ref: 00F15622

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: fbd21c2d98e7224b2bfe3df50a123d83b9cd553216ca1c47d175f167c32d04df
Instruction ID: c790f5d81f0ff709c99c89fad30e406dfeb3fead40c12cd59cceb9b0e84d857a
Opcode Fuzzy Hash: fbd21c2d98e7224b2bfe3df50a123d83b9cd553216ca1c47d175f167c32d04df
Instruction Fuzzy Hash: 1761C372D04519EFDF11CFA8CC44EEEBBBAAF89718F540149E904A7205D335D981ABA0

Function 00F04942 Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aecc307ec2b021fa93ff545d67021f98fc702a582b53f0f61bf0f37a024f6f59
Instruction ID: 5441e602c5e7303d5e46355f10d3cc31ed826ae4dbb4abe37245bc8874a73806
Opcode Fuzzy Hash: aecc307ec2b021fa93ff545d67021f98fc702a582b53f0f61bf0f37a024f6f59
Instruction Fuzzy Hash: 5151D7B1B00208AFDF14CF58CC45AAABBB1EF45364F248158F9499B292D375BE41FB90

Function 00E90560 Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00E906AE

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction ID: 58e506cfc00d3c3ab2b10e81f9d74b94323ab56c43e16216cc7c744f5a420204
Opcode Fuzzy Hash: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction Fuzzy Hash: 0F41B172A001189FCF15DF68DC806AE7BE5EF89350F550569F805AB342DB30DE60ABE1

Function 00F14B12 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,00F149F9,00000000,CF830579,00F51140,0000000C,00F14AB5,00F08BBD,?), ref: 00F14B69

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 9b1cf9dd1e5ae230e640009c12dcba2bed402a95dbed2428f3dbb4deba414159
Instruction ID: dc6d73cd8d5cc340d6d833f3a0cab5af6babc1881deeb17112a0890a007776a0
Opcode Fuzzy Hash: 9b1cf9dd1e5ae230e640009c12dcba2bed402a95dbed2428f3dbb4deba414159
Instruction Fuzzy Hash: DD116633B0D22816C724E274AC45BFE774A8BD27B4F29061DF9288B0C2EE25F8C17195

Function 00F0E05C Relevance: 1.6, APIs: 1, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00F50DF8,00E2A3EB,00000002,00E2A3EB,00000000,?,?,?,00F0E166,00000000,?,00E2A3EB,00000002,00F50DF8), ref: 00F0E099

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: b5b4e972b5ce813e3436bae8cef153d4afed02cc1c653ffd8270a2ab4029433b
Instruction ID: 5ce4e9126ccf6e7ba1657cb4e341831f8b9b31728f6301df91eaa04229d70216
Opcode Fuzzy Hash: b5b4e972b5ce813e3436bae8cef153d4afed02cc1c653ffd8270a2ab4029433b
Instruction Fuzzy Hash: 5601D632614119ABCF05CF59CC45D9E3B29DB85334B240648F8519B1D1E6B1E951BBD0

Function 00F163F3 Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,00F091F7,00000000,?,00F15D79,00000001,00000364,00000000,00000006,000000FF,?,00000000,00F0D244,00F089C3,00F091F7,00000000), ref: 00F16435

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 57b917eea78ff5fd76c29319be16ae228437c5b3d40001d72034a02aa1604c5a
Instruction ID: 3bdd311eb0078a429a2fc75de3e8095fa5b2402a76ae5f20e7d55d6864e16007
Opcode Fuzzy Hash: 57b917eea78ff5fd76c29319be16ae228437c5b3d40001d72034a02aa1604c5a
Instruction Fuzzy Hash: 65F0E93290022466DB21EB629D02BEB3B48AF51774F158015FC08D61C4CB30E891B2F1

Function 00F16E2D Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00F1D635,4D88C033,?,00F1D635,00000220,?,00F157EF,4D88C033), ref: 00F16E60

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0e90ce7ef563a7dedaca3b838c8ff6c26b719bab6defff7395129a5792e341c8
Instruction ID: e9a63d774361e04c5e61189beefc558a617c10e9bb143e0bdff9b71b68269a36
Opcode Fuzzy Hash: 0e90ce7ef563a7dedaca3b838c8ff6c26b719bab6defff7395129a5792e341c8
Instruction Fuzzy Hash: 40E0ED3A9006266ADE3022A5EE10BEB768CDF823B0F050320FD04D20D0CB20C880B7EC

Non-executed Functions

Function 00E28D70 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 327libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,?), ref: 00E28E0E
GetProcAddress.KERNEL32(00000000,?), ref: 00E28E1B
GetModuleHandleA.KERNEL32(?), ref: 00E28E85
GetProcAddress.KERNEL32(00000000,?), ref: 00E28E8C
CloseHandle.KERNEL32(?), ref: 00E29092
CloseHandle.KERNEL32(?), ref: 00E290F4
CloseHandle.KERNEL32(00000000), ref: 00E29121

Strings

p, xrefs: 00E28DBE
l, xrefs: 00E28FB0
t, xrefs: 00E28E37
bkg`, xrefs: 00E28DB7
eHlW, xrefs: 00E28FA2
File, xrefs: 00E28F73
lwcf, xrefs: 00E28FA9

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: Handle$Close$AddressModuleProc
String ID: File$bkg`$eHlW$l$lwcf$p$t
API String ID: 4110381430-3184506882
Opcode ID: 9091102b83599149e82ce9bd28b61c6fbea91f02a7affbcc63be7b8aae466bfd
Instruction ID: 0d454d004931ca7e96a82758d8ebe79540815df0cb89ef609f4344b1a822753b
Opcode Fuzzy Hash: 9091102b83599149e82ce9bd28b61c6fbea91f02a7affbcc63be7b8aae466bfd
Instruction Fuzzy Hash: 19C1DF70D0026D9AEF24CFA4DC85BEEBBB9FF05304F105469E504BB282DB71AA45CB65

Function 00EA55B0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 187libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,92829BBD), ref: 00EA55FC
GetProcAddress.KERNEL32(00000000,92829BBD), ref: 00EA563E
GetProcAddress.KERNEL32(00000000,878281BC), ref: 00EA5686
GetProcAddress.KERNEL32(00000000,92829BBD), ref: 00EA56C7
GetProcAddress.KERNEL32(00000000,92829BBD), ref: 00EA5708
GetProcAddress.KERNEL32(00000000,878281BC), ref: 00EA5746
GetProcAddress.KERNEL32(00000000,92829BBD), ref: 00EA578E
GetProcAddress.KERNEL32(00000000,878281BC), ref: 00EA57D6
GetProcAddress.KERNEL32(00000000,92829BBD), ref: 00EA5817
GetProcAddress.KERNEL32(00000000,92829BBD), ref: 00EA585D

Strings

eIcm, xrefs: 00EA5835
yNrw, xrefs: 00EA5764
`ic, xrefs: 00EA583C

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID: `ic$eIcm$yNrw
API String ID: 190572456-2666854388
Opcode ID: 86a20adcc6b54d1d01c12debeb9f873ac98b0b3d25a45bf5c1f0a1b29b0c0570
Instruction ID: 26c21558885654b5768b888d4b593a509d3127d4bcc205002389c1166a2171d2
Opcode Fuzzy Hash: 86a20adcc6b54d1d01c12debeb9f873ac98b0b3d25a45bf5c1f0a1b29b0c0570
Instruction Fuzzy Hash: 0E816CB0C1834CAEDF08DFA4D8456EEBFB9EF46300F50809ED841AB651D779520ADBA5

Function 00F084A0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction ID: 8599618bf8421a068af755f4fd3c5bd1ec1b8610abd7510a5cb7e0b2cf50733d
Opcode Fuzzy Hash: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction Fuzzy Hash: A4024C71E012199BDF14CFA8C8806AEFBF1FF48364F258269D955A7381DB31AD42DB90

Function 00E8F810 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00E8F833
std::_Lockit::_Lockit.LIBCPMT ref: 00E8F855
std::_Lockit::~_Lockit.LIBCPMT ref: 00E8F875
std::_Lockit::~_Lockit.LIBCPMT ref: 00E8F89F
std::_Lockit::_Lockit.LIBCPMT ref: 00E8F90D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00E8F959
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00E8F973
std::_Lockit::~_Lockit.LIBCPMT ref: 00E8FA08
std::_Facet_Register.LIBCPMT ref: 00E8FA15

Strings

Ps, xrefs: 00E8F96B, 00E8F972
bad locale name, xrefs: 00E8FA2F

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$Ps
API String ID: 3375549084-1174896957
Opcode ID: fe7294090611237b26b0d0edb4fd5a97461b95abb5bf5fe5ccbe8aec534d7691
Instruction ID: edddf34285541e57feae91260793dbe96afe4e68444be5238c1c7a52445bb7b4
Opcode Fuzzy Hash: fe7294090611237b26b0d0edb4fd5a97461b95abb5bf5fe5ccbe8aec534d7691
Instruction Fuzzy Hash: 72619E71D003089BEB10EFA4D845BAEBBF4AF54314F145168E90DBB391E774E905CBA2

Function 00E23D10 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E23E7F

Strings

ios_base::badbit set, xrefs: 00E23E17
G>, xrefs: 00E23DB8
G>, xrefs: 00E23D2B, 00E23D67, 00E23D6A
`!, xrefs: 00E23E70
ios_base::eofbit set, xrefs: 00E23E41, 00E23E63
@3, xrefs: 00E23E84
@3, xrefs: 00E23DBE, 00E23E9B
ios_base::failbit set, xrefs: 00E23D32

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: @3$@3$G>$G>$`!$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-2705522371
Opcode ID: 941b569fd9b372534b43720e848cea379f200e4c3e487be86c76d6942423ac1f
Instruction ID: 9c193e03661e311e661bf4aab044759bd87bff4d00b77d912e8bb799c81abe40
Opcode Fuzzy Hash: 941b569fd9b372534b43720e848cea379f200e4c3e487be86c76d6942423ac1f
Instruction Fuzzy Hash: 0941D7B2900214AFCB14DF68DC45BAEB7F9EF48710F14852AF915E7741E774AA048FA0

Function 00E23DE0 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 79COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E23E7F

Strings

ios_base::badbit set, xrefs: 00E23E17
`!, xrefs: 00E23E70
ios_base::eofbit set, xrefs: 00E23E28, 00E23E41, 00E23E63
@3, xrefs: 00E23E84
@3, xrefs: 00E23DBE, 00E23E9B
ios_base::failbit set, xrefs: 00E23D32, 00E23E1E

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: @3$@3$`!$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-3684864891
Opcode ID: 64c1155f8a9888826ef219a3a4217401c42159e752cab8134caaa9bdaa011c5d
Instruction ID: ef27cd10cbcd0b5cfde570eb25b9332899fd82c4c889184476310ac7fef79f0a
Opcode Fuzzy Hash: 64c1155f8a9888826ef219a3a4217401c42159e752cab8134caaa9bdaa011c5d
Instruction Fuzzy Hash: CD21EEB25007156BC714DF64E805B96B7E8AF04310F58883AFA58A7642E774EA18DF91

Function 00E24C50 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 442COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00E24F72
___std_exception_destroy.LIBVCRUNTIME ref: 00E24FFF
___std_exception_copy.LIBVCRUNTIME ref: 00E250C8

Strings

`!, xrefs: 00E24F6B, 00E24FF8, 00E250B9
@3, xrefs: 00E250CD
recursive_directory_iterator::operator++, xrefs: 00E2504C

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$___std_exception_copy
String ID: @3$`!$recursive_directory_iterator::operator++
API String ID: 1206660477-3572337925
Opcode ID: 2b9a69c3b1bfa0d381865fbdf330cb6c31409aa6b632432770519b7dcf0bd211
Instruction ID: cd89ac12825f66d830b6811a158454a4cda269e082b78cad544c5c8aa9b13da6
Opcode Fuzzy Hash: 2b9a69c3b1bfa0d381865fbdf330cb6c31409aa6b632432770519b7dcf0bd211
Instruction Fuzzy Hash: F8E104B19002149FDB28DF68EC45BAEBBF9FF44700F144A2DE456A7781D774A904CBA1

Function 00E27820 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E2799A
___std_exception_copy.LIBVCRUNTIME ref: 00E27B75

Strings

`!, xrefs: 00E279A5, 00E27B80
type_error, xrefs: 00E2784A
`!, xrefs: 00E27985, 00E27B60
out_of_range, xrefs: 00E27A27

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!$`!$out_of_range$type_error
API String ID: 2659868963-4040272994
Opcode ID: 07a31e1575d485ce63107cf4b94ab372cab17ecfe74e090b3c70833e42db892c
Instruction ID: ddb3e1b346a2632c455f5834395cf01db8d958608bb5068d2a0ebf62d3cccee0
Opcode Fuzzy Hash: 07a31e1575d485ce63107cf4b94ab372cab17ecfe74e090b3c70833e42db892c
Instruction Fuzzy Hash: 2FC169B19002188FDB18DFA8E88479DFBF2FF49310F148669E459EB792E7749980CB51

Function 00E23190 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 170COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E232C6
___std_exception_destroy.LIBVCRUNTIME ref: 00E23350

Strings

`!, xrefs: 00E232D1
`!, xrefs: 00E232AD, 00E23349
@3, xrefs: 00E23316
+4, xrefs: 00E23190

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: +4$@3$`!$`!
API String ID: 2970364248-797261742
Opcode ID: cb8d67bdaf3631c3bf867aff67256b17223afeea57db475b3a2ba143d3444560
Instruction ID: 65759c6bf99bcd676b492d2a9cacf7f33d60f1635fdf3eb8b77cc7c8f9e46b12
Opcode Fuzzy Hash: cb8d67bdaf3631c3bf867aff67256b17223afeea57db475b3a2ba143d3444560
Instruction Fuzzy Hash: FD518E719102189FDB08CFA8D885BEEBBF5FF48310F14812AE815A7392D7789A45CF91

Function 00E239F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00E23A58
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00E23AA4
__Getctype.LIBCPMT ref: 00E23ABA
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00E23AE6
std::_Lockit::~_Lockit.LIBCPMT ref: 00E23B7B

Strings

bad locale name, xrefs: 00E23B96

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: 3c76d7475267286d309b316430108f47342dd7520ab42b16f7d314c3cb66b883
Instruction ID: 8b277ce00ec62846becfbaeb22aa02aaf31843b854dfcd7d9ccd491de4bb66cd
Opcode Fuzzy Hash: 3c76d7475267286d309b316430108f47342dd7520ab42b16f7d314c3cb66b883
Instruction Fuzzy Hash: E35150B1D002589BEB10DFA4DC45B9EBBF8AF14314F145169E909BB381E778EA04DB51

Function 00F02E10 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00F02E47
___except_validate_context_record.LIBVCRUNTIME ref: 00F02E4F
_ValidateLocalCookies.LIBCMT ref: 00F02ED8
__IsNonwritableInCurrentImage.LIBCMT ref: 00F02F03
_ValidateLocalCookies.LIBCMT ref: 00F02F58

Strings

csm, xrefs: 00F02EED

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 6b068ed09a4c9b9bc7e4eece4a127dd5df4daee327261ef60b394e6bbe1985ca
Instruction ID: 4446ba945c82f459669d658930f36dc23b73c64d22b0a7afb040ee226c32c5d2
Opcode Fuzzy Hash: 6b068ed09a4c9b9bc7e4eece4a127dd5df4daee327261ef60b394e6bbe1985ca
Instruction Fuzzy Hash: 5941E630E00209ABCF50DF68CC89A9EBBB5AF44325F148055E9149B3D2DB75EE45FBA1

Function 00E8DE70 Relevance: 9.1, APIs: 6, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00E8DE93
std::_Lockit::_Lockit.LIBCPMT ref: 00E8DEB6
std::_Lockit::~_Lockit.LIBCPMT ref: 00E8DED6
std::_Facet_Register.LIBCPMT ref: 00E8DF4B
std::_Lockit::~_Lockit.LIBCPMT ref: 00E8DF63
Concurrency::cancel_current_task.LIBCPMT ref: 00E8DF7B

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: b0b15a1e2affc74a74216257518afbbd0ff9eb3deb73b49f747dade3abb57075
Instruction ID: f684e413ea51eb0b897539e284efc3f9e7a857329b545cd4d167d7426794e556
Opcode Fuzzy Hash: b0b15a1e2affc74a74216257518afbbd0ff9eb3deb73b49f747dade3abb57075
Instruction Fuzzy Hash: C141C171E042199FCB14EF54DC41AAEBBB4FB04724F144269EA1ABB392D730AD00DBD1

Function 00E26F40 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 349COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E27340

Strings

`!, xrefs: 00E2734B
parse error, xrefs: 00E26FFF, 00E27018
`!, xrefs: 00E27328
parse_error, xrefs: 00E26F8B

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!$`!$parse error$parse_error
API String ID: 2659868963-1090282668
Opcode ID: 7a810dc789a2c2214f73fb8e95d8e7b696bddb87427a19360a71baf05bdd1a89
Instruction ID: 73eccc8488515a1544c7b2f7430b507cd7de2adc626cf15972268ac38c9a3437
Opcode Fuzzy Hash: 7a810dc789a2c2214f73fb8e95d8e7b696bddb87427a19360a71baf05bdd1a89
Instruction Fuzzy Hash: 38E18E709042188FDB18CF68D885B9DBBF2FF49300F248269E458EB792D7749A81DF91

Function 00E273B0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00E275BE
___std_exception_destroy.LIBVCRUNTIME ref: 00E275CD

Strings

at line , xrefs: 00E273F7
`!, xrefs: 00E275B6, 00E275C6
, column , xrefs: 00E27434, 00E2744A

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column $`!
API String ID: 4194217158-1910556284
Opcode ID: 9cee3126e46bba7d0f3090d5d149f81e6b41256bb25eadb4b0a93c6b46638939
Instruction ID: f1a4cefb22b72449f43d944da465206b8a130bd8e38ee2cf895b601f8247dbc5
Opcode Fuzzy Hash: 9cee3126e46bba7d0f3090d5d149f81e6b41256bb25eadb4b0a93c6b46638939
Instruction Fuzzy Hash: 88610471A042189FDB08DF68EC85BADFBB6FF44300F24462CE455A7B82D774AA40DB91

Function 00E23370 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

APIs

Part of subcall function 00E23190: ___std_exception_copy.LIBVCRUNTIME ref: 00E232C6

___std_exception_copy.LIBVCRUNTIME ref: 00E2345F

Strings

@3, xrefs: 00E233F3, 00E2347B
`!, xrefs: 00E23450
@3, xrefs: 00E23464
+4, xrefs: 00E233B3, 00E23410

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: +4$@3$@3$`!
API String ID: 2659868963-2319638956
Opcode ID: 83d5bc14befcc14809a7fff9923f64899a864920fd5d4623842cd20969aaa280
Instruction ID: a9c11b4f5675c3ef13326b7a82451c6435dd35c5991051ad663e5e61f9de190b
Opcode Fuzzy Hash: 83d5bc14befcc14809a7fff9923f64899a864920fd5d4623842cd20969aaa280
Instruction Fuzzy Hash: BC3194719002199FCB18DFA8D841AAEFBF9FF08710F10852AF514E7A41E774AA54DF91

Function 00E23410 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 47COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E2345F

Strings

@3, xrefs: 00E233F3, 00E2347B
`!, xrefs: 00E23450
@3, xrefs: 00E23464
+4, xrefs: 00E233B3, 00E23410

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: +4$@3$@3$`!
API String ID: 2659868963-2319638956
Opcode ID: 4424335e6ac9a0082b184d32fdf35380147a62c479cae05fd148ec0bc7334109
Instruction ID: c1e088df5a8e6465786e9178781bf7859c2039cd5a94477c73765e20e320c139
Opcode Fuzzy Hash: 4424335e6ac9a0082b184d32fdf35380147a62c479cae05fd148ec0bc7334109
Instruction Fuzzy Hash: 97014F76500209AFC704DFA8E801896FBFCBF05310B00843AE52997611EBB4E628DF90

Function 00E26C60 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 247COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00E26F11
___std_exception_destroy.LIBVCRUNTIME ref: 00E26F20

Strings

`!, xrefs: 00E26F09, 00E26F19
[json.exception., xrefs: 00E26CB8

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.$`!
API String ID: 4194217158-2932383579
Opcode ID: 6c622cbdc460e3b970bd150d5240e01207666aebc943c58e14544e86142340c4
Instruction ID: 48adba08bea6bd3e1cd2fdbf4ca052bf784b273308ac14e9665348c1ab4dc37a
Opcode Fuzzy Hash: 6c622cbdc460e3b970bd150d5240e01207666aebc943c58e14544e86142340c4
Instruction Fuzzy Hash: CF91E370A002189FDB18CF68D985B9EBBF2FF44300F20866DE415AB792D775AA41CB90

Function 00E27620 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 167COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E277B4

Strings

`!, xrefs: 00E277BF
`!, xrefs: 00E2779F
invalid_iterator, xrefs: 00E27656

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!$`!$invalid_iterator
API String ID: 2659868963-1518100916
Opcode ID: a593c55b5f056541eb49bb2f1b6ffd6cde8b698a186152b76a5c812f55306841
Instruction ID: 00e65235b09eae74e274c918c41551fe088134bb5fdde04ab83015e9221f09a8
Opcode Fuzzy Hash: a593c55b5f056541eb49bb2f1b6ffd6cde8b698a186152b76a5c812f55306841
Instruction Fuzzy Hash: 7F514AB09002188FDB18CF68E88479DFBF1FF49310F14866AE459EB792E7749980CB94

Function 00E27BE0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 156COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E27D67

Strings

`!, xrefs: 00E27D72
`!, xrefs: 00E27D52
other_error, xrefs: 00E27C0A

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!$`!$other_error
API String ID: 2659868963-2644867674
Opcode ID: 5d1636e28fa67f2107719020437dc496fde5f13289f1dde8bcc844f75bbc0622
Instruction ID: 1376918ab173513a550c89a191be5d7b981cf396c629d345932b35cf89d6cc9a
Opcode Fuzzy Hash: 5d1636e28fa67f2107719020437dc496fde5f13289f1dde8bcc844f75bbc0622
Instruction Fuzzy Hash: D9516BB09002588FDB18CFA8E88479DFBF1FF49300F148669E459EB792D774A984CB51

Function 00E8D050 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E8D06F
___std_exception_copy.LIBVCRUNTIME ref: 00E8D096

Strings

`!, xrefs: 00E8D09B
`!, xrefs: 00E8D060, 00E8D085

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!$`!
API String ID: 2659868963-1501952390
Opcode ID: 73999430599f08e79885edc71edc38918d40805b10b7029058dc1838a2fdef63
Instruction ID: 803e7154287e4386bdd47d106ad582b7d269e830daa559e4878833b2715db83a
Opcode Fuzzy Hash: 73999430599f08e79885edc71edc38918d40805b10b7029058dc1838a2fdef63
Instruction Fuzzy Hash: 5301A4B6500616AFC704DF59D505982FBF8FB49710704853BA929CBB11E7B0E528DFA0

Function 00E9B3C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E9B3DF
___std_exception_copy.LIBVCRUNTIME ref: 00E9B406

Strings

`!, xrefs: 00E9B40E
`!, xrefs: 00E9B3D0, 00E9B3F5

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!$`!
API String ID: 2659868963-1501952390
Opcode ID: 85198b0f4d25c001fee0b32d0b5a39a20c76fc956bd22bbb2b2e849715ce8908
Instruction ID: b6eb54f067dd5123c54f6e130b01c5dad0c46cba8f61e5494eb96c41ac7d66df
Opcode Fuzzy Hash: 85198b0f4d25c001fee0b32d0b5a39a20c76fc956bd22bbb2b2e849715ce8908
Instruction Fuzzy Hash: B9F0C4B6500616AF8708DF58D505986BBF8FB45710705853BE52ACBB01E7B0E528DBA0

Function 00E22270 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 218COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00E22275

Part of subcall function 00EFD6E9: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00EFD6F5

Strings

string too long, xrefs: 00E22270
), xrefs: 00E22382

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: string too long$)
API String ID: 1997705970-906081222
Opcode ID: bcd7d4183c767adb930f9acbba96b35754209002afc9e4f0d376d8301899b119
Instruction ID: 2d7a99db14ea08e8806ebd7182c340b27fcc3c6c3fab88be1272cad1caa83779
Opcode Fuzzy Hash: bcd7d4183c767adb930f9acbba96b35754209002afc9e4f0d376d8301899b119
Instruction Fuzzy Hash: 3C813275A0429AAFCB02CF68C4507EDBFF1EF5A300F1841AECA94A7742C3359545CBA0

Function 00E9B450 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 190COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00E9B612

Strings

Px, xrefs: 00E9B456, 00E9B5BA, 00E9B5F3, 00E9B54A, 00E9B4F1
invalid hash bucket count, xrefs: 00E9B60D

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_
String ID: Px$invalid hash bucket count
API String ID: 909987262-1779506432
Opcode ID: 37a2cd6eecc92ff53301f3383126d605a5c14ff7059684deb759e1f968a0e16a
Instruction ID: 8f2ce83f6dfd477ea7d6ec6f6a224365b40125daf9ee55e6aaa316681e618c9e
Opcode Fuzzy Hash: 37a2cd6eecc92ff53301f3383126d605a5c14ff7059684deb759e1f968a0e16a
Instruction Fuzzy Hash: 9D7102B4A00619DFCB14CF49D280869FBF6FF88314725C5AAD859AB356D731EA41CF90

Function 00E9E440 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00E9E491

Strings

type must be boolean, but is , xrefs: 00E9E582
type must be string, but is , xrefs: 00E9E4F8

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: type must be boolean, but is $type must be string, but is
API String ID: 118556049-436076039
Opcode ID: 354e5571da3c5cefc0e48bbb9622d531af7749b882e3575be750a5a63d52cb40
Instruction ID: aaea65f4c193baca37a67387fc6f9003876c1c31060a09e5ae6ba120b5db35ea
Opcode Fuzzy Hash: 354e5571da3c5cefc0e48bbb9622d531af7749b882e3575be750a5a63d52cb40
Instruction Fuzzy Hash: E6413CB1900248AFDB14EBA4E802B9E77E8DB00314F144679F619F7792EB35E944C792

Function 00E23050 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E23078

Strings

`!, xrefs: 00E23080
`!, xrefs: 00E23063

Memory Dump Source

Source File: 00000008.00000002.3319260844.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000008.00000002.3319083155.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319260844.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319515508.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3319559246.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320094232.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320293029.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3320334801.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!$`!
API String ID: 2659868963-1501952390
Opcode ID: 00599af393aa1bf7e6d0f0448e1ad4590a0aae8e106d7a35474f25a8210d0728
Instruction ID: 6532ee06e612f181bbec3c8f70d4044cdb6382071e6c8136134e768e3bc8d89a
Opcode Fuzzy Hash: 00599af393aa1bf7e6d0f0448e1ad4590a0aae8e106d7a35474f25a8210d0728
Instruction Fuzzy Hash: 88E012B29113189BC710DFA8D9059CAFFF8AB19701F0486BAE948D7301FAB1D5549BD1

Analysis Process: RageMP131.exePID: 7424, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	3.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	650
Total number of Limit Nodes:	68

Executed Functions

Function 00E83A40 Relevance: 6.2, APIs: 4, Instructions: 157
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCursorPos.USER32(?), ref: 00E83A53
GetCursorPos.USER32(?), ref: 00E83A59
Sleep.KERNELBASE(000003E9,?,00000001,00000000,?,?,?,?,?,?,?,?,00E83DB6), ref: 00E83B08
Sleep.KERNELBASE(00000001,?,00000001,00000000,?,?,?,?,?,?,?,?,00E83DB6), ref: 00E83BBA

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: CursorSleep
String ID:
API String ID: 4211308429-0
Opcode ID: 95db7cfec9a3487ce25382a4d25d1ed3d675f644640085c6378ecf76888fa269
Instruction ID: b02dbafd8d822de8045ff959e7a6dfcf32d10143d32389b03428d1a9794a9b34
Opcode Fuzzy Hash: 95db7cfec9a3487ce25382a4d25d1ed3d675f644640085c6378ecf76888fa269
Instruction Fuzzy Hash: 9851CE75A041198FCB28DF68C8D0EA9B3B1FF45B08F29559AD449AF351D731EE05CB80

Function 00E3E0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00E3E0CB
socket.WS2_32(?,?,?), ref: 00E3E17F
connect.WS2_32(00000000,?,?), ref: 00E3E193
closesocket.WS2_32(00000000), ref: 00E3E19E

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: d4415bb2678a5e9c11eb5e88b1a18c136dca9f9d066c4e6b5375664871c93330
Instruction ID: 79b7c39fce77d68e32868530486a266989b43519767541d5a49d8599183a32e9
Opcode Fuzzy Hash: d4415bb2678a5e9c11eb5e88b1a18c136dca9f9d066c4e6b5375664871c93330
Instruction Fuzzy Hash: 2F3192726053116BD7209F259C8976BBBE4EB85738F016F1DF9A8A73E0D3719804CB92

Function 00EFF290 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E2220E

Strings

`!, xrefs: 00E22216
`!, xrefs: 00E221FC

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!$`!
API String ID: 2659868963-1501952390
Opcode ID: eab32b943f562d70d5863ea0e895703991a18446330479bed5feb8665a34cc35
Instruction ID: ae8cc15cf3f3d62894ca46a069ee0f44517381d210be0b1bca848ac53258cec5
Opcode Fuzzy Hash: eab32b943f562d70d5863ea0e895703991a18446330479bed5feb8665a34cc35
Instruction Fuzzy Hash: 27012B3550030DABCB14AF98EC029A977EC9E00314F008439FB18EB591EB70E964A791

Function 00E2A210 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 00E2A343

Strings

/>, xrefs: 00E2A2C1, 00E2A359, 00E2A2CA, 00E2A2D1, 00E2A378

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID: />
API String ID: 2638373210-3782486657
Opcode ID: 613f405078d69c61e7afa1c37658272bacd72fc0c55d0e3bfd55429607f926db
Instruction ID: 5207932235581cc8bad34de8421368986b5c50a8a6b747b12d9adaf104e066a1
Opcode Fuzzy Hash: 613f405078d69c61e7afa1c37658272bacd72fc0c55d0e3bfd55429607f926db
Instruction Fuzzy Hash: 99715870900214AFDB14DF68EC45BAFB7E9EF41704F14856DF809AB282D7B9E9418792

Function 00F14623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19cf0eefd71166cb62f510b92777136c8afa4b57cee8dc053ce5749408e04845
Instruction ID: 1586b34f15cb8f03c044df063045f8fd5a3a9577a610e9a2166ded10919de28c
Opcode Fuzzy Hash: 19cf0eefd71166cb62f510b92777136c8afa4b57cee8dc053ce5749408e04845
Instruction Fuzzy Hash: 1BB10671E04249AFDB11DFA8D840BFEBBB1AF86324F544158E5549B282C774BD81FB60

Function 00F1549C Relevance: 1.7, APIs: 1, Instructions: 198
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000000,00F09087,?,00000000,00000000,00000000,?,00000000,?,00E2A3EB,00F09087,00000000,00E2A3EB,?,?), ref: 00F15622

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: fbd21c2d98e7224b2bfe3df50a123d83b9cd553216ca1c47d175f167c32d04df
Instruction ID: c790f5d81f0ff709c99c89fad30e406dfeb3fead40c12cd59cceb9b0e84d857a
Opcode Fuzzy Hash: fbd21c2d98e7224b2bfe3df50a123d83b9cd553216ca1c47d175f167c32d04df
Instruction Fuzzy Hash: 1761C372D04519EFDF11CFA8CC44EEEBBBAAF89718F540149E904A7205D335D981ABA0

Function 00F04942 Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aecc307ec2b021fa93ff545d67021f98fc702a582b53f0f61bf0f37a024f6f59
Instruction ID: 5441e602c5e7303d5e46355f10d3cc31ed826ae4dbb4abe37245bc8874a73806
Opcode Fuzzy Hash: aecc307ec2b021fa93ff545d67021f98fc702a582b53f0f61bf0f37a024f6f59
Instruction Fuzzy Hash: 5151D7B1B00208AFDF14CF58CC45AAABBB1EF45364F248158F9499B292D375BE41FB90

Function 00E90560 Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00E906AE

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction ID: 58e506cfc00d3c3ab2b10e81f9d74b94323ab56c43e16216cc7c744f5a420204
Opcode Fuzzy Hash: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction Fuzzy Hash: 0F41B172A001189FCF15DF68DC806AE7BE5EF89350F550569F805AB342DB30DE60ABE1

Function 00F14B12 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,00F149F9,00000000,CF830579,00F51140,0000000C,00F14AB5,00F08BBD,?), ref: 00F14B69

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 9b1cf9dd1e5ae230e640009c12dcba2bed402a95dbed2428f3dbb4deba414159
Instruction ID: dc6d73cd8d5cc340d6d833f3a0cab5af6babc1881deeb17112a0890a007776a0
Opcode Fuzzy Hash: 9b1cf9dd1e5ae230e640009c12dcba2bed402a95dbed2428f3dbb4deba414159
Instruction Fuzzy Hash: DD116633B0D22816C724E274AC45BFE774A8BD27B4F29061DF9288B0C2EE25F8C17195

Function 00F0E05C Relevance: 1.6, APIs: 1, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00F50DF8,00E2A3EB,00000002,00E2A3EB,00000000,?,?,?,00F0E166,00000000,?,00E2A3EB,00000002,00F50DF8), ref: 00F0E099

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: b5b4e972b5ce813e3436bae8cef153d4afed02cc1c653ffd8270a2ab4029433b
Instruction ID: 5ce4e9126ccf6e7ba1657cb4e341831f8b9b31728f6301df91eaa04229d70216
Opcode Fuzzy Hash: b5b4e972b5ce813e3436bae8cef153d4afed02cc1c653ffd8270a2ab4029433b
Instruction Fuzzy Hash: 5601D632614119ABCF05CF59CC45D9E3B29DB85334B240648F8519B1D1E6B1E951BBD0

Function 00F163F3 Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,00F091F7,00000000,?,00F15D79,00000001,00000364,00000000,00000006,000000FF,?,00000000,00F0D244,00F089C3,00F091F7,00000000), ref: 00F16435

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 57b917eea78ff5fd76c29319be16ae228437c5b3d40001d72034a02aa1604c5a
Instruction ID: 3bdd311eb0078a429a2fc75de3e8095fa5b2402a76ae5f20e7d55d6864e16007
Opcode Fuzzy Hash: 57b917eea78ff5fd76c29319be16ae228437c5b3d40001d72034a02aa1604c5a
Instruction Fuzzy Hash: 65F0E93290022466DB21EB629D02BEB3B48AF51774F158015FC08D61C4CB30E891B2F1

Function 00F16E2D Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00F1D635,4D88C033,?,00F1D635,00000220,?,00F157EF,4D88C033), ref: 00F16E60

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0e90ce7ef563a7dedaca3b838c8ff6c26b719bab6defff7395129a5792e341c8
Instruction ID: e9a63d774361e04c5e61189beefc558a617c10e9bb143e0bdff9b71b68269a36
Opcode Fuzzy Hash: 0e90ce7ef563a7dedaca3b838c8ff6c26b719bab6defff7395129a5792e341c8
Instruction Fuzzy Hash: 40E0ED3A9006266ADE3022A5EE10BEB768CDF823B0F050320FD04D20D0CB20C880B7EC

Non-executed Functions

Function 00E28D70 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 327libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,?), ref: 00E28E0E
GetProcAddress.KERNEL32(00000000,?), ref: 00E28E1B
GetModuleHandleA.KERNEL32(?), ref: 00E28E85
GetProcAddress.KERNEL32(00000000,?), ref: 00E28E8C
CloseHandle.KERNEL32(?), ref: 00E29092
CloseHandle.KERNEL32(?), ref: 00E290F4
CloseHandle.KERNEL32(00000000), ref: 00E29121

Strings

lwcf, xrefs: 00E28FA9
p, xrefs: 00E28DBE
eHlW, xrefs: 00E28FA2
t, xrefs: 00E28E37
File, xrefs: 00E28F73
bkg`, xrefs: 00E28DB7
l, xrefs: 00E28FB0

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: Handle$Close$AddressModuleProc
String ID: File$bkg`$eHlW$l$lwcf$p$t
API String ID: 4110381430-3184506882
Opcode ID: 9091102b83599149e82ce9bd28b61c6fbea91f02a7affbcc63be7b8aae466bfd
Instruction ID: 0d454d004931ca7e96a82758d8ebe79540815df0cb89ef609f4344b1a822753b
Opcode Fuzzy Hash: 9091102b83599149e82ce9bd28b61c6fbea91f02a7affbcc63be7b8aae466bfd
Instruction Fuzzy Hash: 19C1DF70D0026D9AEF24CFA4DC85BEEBBB9FF05304F105469E504BB282DB71AA45CB65

Function 00EA55B0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 187libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,92829BBD), ref: 00EA55FC
GetProcAddress.KERNEL32(00000000,92829BBD), ref: 00EA563E
GetProcAddress.KERNEL32(00000000,878281BC), ref: 00EA5686
GetProcAddress.KERNEL32(00000000,92829BBD), ref: 00EA56C7
GetProcAddress.KERNEL32(00000000,92829BBD), ref: 00EA5708
GetProcAddress.KERNEL32(00000000,878281BC), ref: 00EA5746
GetProcAddress.KERNEL32(00000000,92829BBD), ref: 00EA578E
GetProcAddress.KERNEL32(00000000,878281BC), ref: 00EA57D6
GetProcAddress.KERNEL32(00000000,92829BBD), ref: 00EA5817
GetProcAddress.KERNEL32(00000000,92829BBD), ref: 00EA585D

Strings

eIcm, xrefs: 00EA5835
`ic, xrefs: 00EA583C
yNrw, xrefs: 00EA5764

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID: `ic$eIcm$yNrw
API String ID: 190572456-2666854388
Opcode ID: 86a20adcc6b54d1d01c12debeb9f873ac98b0b3d25a45bf5c1f0a1b29b0c0570
Instruction ID: 26c21558885654b5768b888d4b593a509d3127d4bcc205002389c1166a2171d2
Opcode Fuzzy Hash: 86a20adcc6b54d1d01c12debeb9f873ac98b0b3d25a45bf5c1f0a1b29b0c0570
Instruction Fuzzy Hash: 0E816CB0C1834CAEDF08DFA4D8456EEBFB9EF46300F50809ED841AB651D779520ADBA5

Function 00F084A0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction ID: 8599618bf8421a068af755f4fd3c5bd1ec1b8610abd7510a5cb7e0b2cf50733d
Opcode Fuzzy Hash: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction Fuzzy Hash: A4024C71E012199BDF14CFA8C8806AEFBF1FF48364F258269D955A7381DB31AD42DB90

Function 00E8F810 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00E8F833
std::_Lockit::_Lockit.LIBCPMT ref: 00E8F855
std::_Lockit::~_Lockit.LIBCPMT ref: 00E8F875
std::_Lockit::~_Lockit.LIBCPMT ref: 00E8F89F
std::_Lockit::_Lockit.LIBCPMT ref: 00E8F90D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00E8F959
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00E8F973
std::_Lockit::~_Lockit.LIBCPMT ref: 00E8FA08
std::_Facet_Register.LIBCPMT ref: 00E8FA15

Strings

Ps, xrefs: 00E8F96B, 00E8F972
bad locale name, xrefs: 00E8FA2F

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$Ps
API String ID: 3375549084-1174896957
Opcode ID: fe7294090611237b26b0d0edb4fd5a97461b95abb5bf5fe5ccbe8aec534d7691
Instruction ID: edddf34285541e57feae91260793dbe96afe4e68444be5238c1c7a52445bb7b4
Opcode Fuzzy Hash: fe7294090611237b26b0d0edb4fd5a97461b95abb5bf5fe5ccbe8aec534d7691
Instruction Fuzzy Hash: 72619E71D003089BEB10EFA4D845BAEBBF4AF54314F145168E90DBB391E774E905CBA2

Function 00E23D10 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E23E7F

Strings

@3, xrefs: 00E23E84
G>, xrefs: 00E23DB8
ios_base::eofbit set, xrefs: 00E23E41, 00E23E63
ios_base::failbit set, xrefs: 00E23D32
@3, xrefs: 00E23DBE, 00E23E9B
ios_base::badbit set, xrefs: 00E23E17
G>, xrefs: 00E23D2B, 00E23D67, 00E23D6A
`!, xrefs: 00E23E70

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: @3$@3$G>$G>$`!$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-2705522371
Opcode ID: 941b569fd9b372534b43720e848cea379f200e4c3e487be86c76d6942423ac1f
Instruction ID: 9c193e03661e311e661bf4aab044759bd87bff4d00b77d912e8bb799c81abe40
Opcode Fuzzy Hash: 941b569fd9b372534b43720e848cea379f200e4c3e487be86c76d6942423ac1f
Instruction Fuzzy Hash: 0941D7B2900214AFCB14DF68DC45BAEB7F9EF48710F14852AF915E7741E774AA048FA0

Function 00E23DE0 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 79COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E23E7F

Strings

@3, xrefs: 00E23E84
ios_base::eofbit set, xrefs: 00E23E28, 00E23E41, 00E23E63
ios_base::failbit set, xrefs: 00E23D32, 00E23E1E
@3, xrefs: 00E23DBE, 00E23E9B
ios_base::badbit set, xrefs: 00E23E17
`!, xrefs: 00E23E70

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: @3$@3$`!$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-3684864891
Opcode ID: 64c1155f8a9888826ef219a3a4217401c42159e752cab8134caaa9bdaa011c5d
Instruction ID: ef27cd10cbcd0b5cfde570eb25b9332899fd82c4c889184476310ac7fef79f0a
Opcode Fuzzy Hash: 64c1155f8a9888826ef219a3a4217401c42159e752cab8134caaa9bdaa011c5d
Instruction Fuzzy Hash: CD21EEB25007156BC714DF64E805B96B7E8AF04310F58883AFA58A7642E774EA18DF91

Function 00E24C50 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 442COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00E24F72
___std_exception_destroy.LIBVCRUNTIME ref: 00E24FFF
___std_exception_copy.LIBVCRUNTIME ref: 00E250C8

Strings

@3, xrefs: 00E250CD
recursive_directory_iterator::operator++, xrefs: 00E2504C
`!, xrefs: 00E24F6B, 00E24FF8, 00E250B9

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$___std_exception_copy
String ID: @3$`!$recursive_directory_iterator::operator++
API String ID: 1206660477-3572337925
Opcode ID: 2b9a69c3b1bfa0d381865fbdf330cb6c31409aa6b632432770519b7dcf0bd211
Instruction ID: cd89ac12825f66d830b6811a158454a4cda269e082b78cad544c5c8aa9b13da6
Opcode Fuzzy Hash: 2b9a69c3b1bfa0d381865fbdf330cb6c31409aa6b632432770519b7dcf0bd211
Instruction Fuzzy Hash: F8E104B19002149FDB28DF68EC45BAEBBF9FF44700F144A2DE456A7781D774A904CBA1

Function 00E27820 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E2799A
___std_exception_copy.LIBVCRUNTIME ref: 00E27B75

Strings

`!, xrefs: 00E27985, 00E27B60
`!, xrefs: 00E279A5, 00E27B80
out_of_range, xrefs: 00E27A27
type_error, xrefs: 00E2784A

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!$`!$out_of_range$type_error
API String ID: 2659868963-4040272994
Opcode ID: 07a31e1575d485ce63107cf4b94ab372cab17ecfe74e090b3c70833e42db892c
Instruction ID: ddb3e1b346a2632c455f5834395cf01db8d958608bb5068d2a0ebf62d3cccee0
Opcode Fuzzy Hash: 07a31e1575d485ce63107cf4b94ab372cab17ecfe74e090b3c70833e42db892c
Instruction Fuzzy Hash: 2FC169B19002188FDB18DFA8E88479DFBF2FF49310F148669E459EB792E7749980CB51

Function 00E23190 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 170COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E232C6
___std_exception_destroy.LIBVCRUNTIME ref: 00E23350

Strings

@3, xrefs: 00E23316
+4, xrefs: 00E23190
`!, xrefs: 00E232AD, 00E23349
`!, xrefs: 00E232D1

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: +4$@3$`!$`!
API String ID: 2970364248-797261742
Opcode ID: cb8d67bdaf3631c3bf867aff67256b17223afeea57db475b3a2ba143d3444560
Instruction ID: 65759c6bf99bcd676b492d2a9cacf7f33d60f1635fdf3eb8b77cc7c8f9e46b12
Opcode Fuzzy Hash: cb8d67bdaf3631c3bf867aff67256b17223afeea57db475b3a2ba143d3444560
Instruction Fuzzy Hash: FD518E719102189FDB08CFA8D885BEEBBF5FF48310F14812AE815A7392D7789A45CF91

Function 00E239F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00E23A58
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00E23AA4
__Getctype.LIBCPMT ref: 00E23ABA
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00E23AE6
std::_Lockit::~_Lockit.LIBCPMT ref: 00E23B7B

Strings

bad locale name, xrefs: 00E23B96

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: 3c76d7475267286d309b316430108f47342dd7520ab42b16f7d314c3cb66b883
Instruction ID: 8b277ce00ec62846becfbaeb22aa02aaf31843b854dfcd7d9ccd491de4bb66cd
Opcode Fuzzy Hash: 3c76d7475267286d309b316430108f47342dd7520ab42b16f7d314c3cb66b883
Instruction Fuzzy Hash: E35150B1D002589BEB10DFA4DC45B9EBBF8AF14314F145169E909BB381E778EA04DB51

Function 00F02E10 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00F02E47
___except_validate_context_record.LIBVCRUNTIME ref: 00F02E4F
_ValidateLocalCookies.LIBCMT ref: 00F02ED8
__IsNonwritableInCurrentImage.LIBCMT ref: 00F02F03
_ValidateLocalCookies.LIBCMT ref: 00F02F58

Strings

csm, xrefs: 00F02EED

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 6b068ed09a4c9b9bc7e4eece4a127dd5df4daee327261ef60b394e6bbe1985ca
Instruction ID: 4446ba945c82f459669d658930f36dc23b73c64d22b0a7afb040ee226c32c5d2
Opcode Fuzzy Hash: 6b068ed09a4c9b9bc7e4eece4a127dd5df4daee327261ef60b394e6bbe1985ca
Instruction Fuzzy Hash: 5941E630E00209ABCF50DF68CC89A9EBBB5AF44325F148055E9149B3D2DB75EE45FBA1

Function 00E8DE70 Relevance: 9.1, APIs: 6, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00E8DE93
std::_Lockit::_Lockit.LIBCPMT ref: 00E8DEB6
std::_Lockit::~_Lockit.LIBCPMT ref: 00E8DED6
std::_Facet_Register.LIBCPMT ref: 00E8DF4B
std::_Lockit::~_Lockit.LIBCPMT ref: 00E8DF63
Concurrency::cancel_current_task.LIBCPMT ref: 00E8DF7B

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: b0b15a1e2affc74a74216257518afbbd0ff9eb3deb73b49f747dade3abb57075
Instruction ID: f684e413ea51eb0b897539e284efc3f9e7a857329b545cd4d167d7426794e556
Opcode Fuzzy Hash: b0b15a1e2affc74a74216257518afbbd0ff9eb3deb73b49f747dade3abb57075
Instruction Fuzzy Hash: C141C171E042199FCB14EF54DC41AAEBBB4FB04724F144269EA1ABB392D730AD00DBD1

Function 00E26F40 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 349COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E27340

Strings

parse error, xrefs: 00E26FFF, 00E27018
parse_error, xrefs: 00E26F8B
`!, xrefs: 00E27328
`!, xrefs: 00E2734B

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!$`!$parse error$parse_error
API String ID: 2659868963-1090282668
Opcode ID: 7a810dc789a2c2214f73fb8e95d8e7b696bddb87427a19360a71baf05bdd1a89
Instruction ID: 73eccc8488515a1544c7b2f7430b507cd7de2adc626cf15972268ac38c9a3437
Opcode Fuzzy Hash: 7a810dc789a2c2214f73fb8e95d8e7b696bddb87427a19360a71baf05bdd1a89
Instruction Fuzzy Hash: 38E18E709042188FDB18CF68D885B9DBBF2FF49300F248269E458EB792D7749A81DF91

Function 00E273B0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00E275BE
___std_exception_destroy.LIBVCRUNTIME ref: 00E275CD

Strings

at line , xrefs: 00E273F7
, column , xrefs: 00E27434, 00E2744A
`!, xrefs: 00E275B6, 00E275C6

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column $`!
API String ID: 4194217158-1910556284
Opcode ID: 9cee3126e46bba7d0f3090d5d149f81e6b41256bb25eadb4b0a93c6b46638939
Instruction ID: f1a4cefb22b72449f43d944da465206b8a130bd8e38ee2cf895b601f8247dbc5
Opcode Fuzzy Hash: 9cee3126e46bba7d0f3090d5d149f81e6b41256bb25eadb4b0a93c6b46638939
Instruction Fuzzy Hash: 88610471A042189FDB08DF68EC85BADFBB6FF44300F24462CE455A7B82D774AA40DB91

Function 00E23370 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

APIs

Part of subcall function 00E23190: ___std_exception_copy.LIBVCRUNTIME ref: 00E232C6

___std_exception_copy.LIBVCRUNTIME ref: 00E2345F

Strings

@3, xrefs: 00E23464
+4, xrefs: 00E233B3, 00E23410
@3, xrefs: 00E233F3, 00E2347B
`!, xrefs: 00E23450

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: +4$@3$@3$`!
API String ID: 2659868963-2319638956
Opcode ID: 83d5bc14befcc14809a7fff9923f64899a864920fd5d4623842cd20969aaa280
Instruction ID: a9c11b4f5675c3ef13326b7a82451c6435dd35c5991051ad663e5e61f9de190b
Opcode Fuzzy Hash: 83d5bc14befcc14809a7fff9923f64899a864920fd5d4623842cd20969aaa280
Instruction Fuzzy Hash: BC3194719002199FCB18DFA8D841AAEFBF9FF08710F10852AF514E7A41E774AA54DF91

Function 00E23410 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 47COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E2345F

Strings

@3, xrefs: 00E23464
+4, xrefs: 00E233B3, 00E23410
@3, xrefs: 00E233F3, 00E2347B
`!, xrefs: 00E23450

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: +4$@3$@3$`!
API String ID: 2659868963-2319638956
Opcode ID: 4424335e6ac9a0082b184d32fdf35380147a62c479cae05fd148ec0bc7334109
Instruction ID: c1e088df5a8e6465786e9178781bf7859c2039cd5a94477c73765e20e320c139
Opcode Fuzzy Hash: 4424335e6ac9a0082b184d32fdf35380147a62c479cae05fd148ec0bc7334109
Instruction Fuzzy Hash: 97014F76500209AFC704DFA8E801896FBFCBF05310B00843AE52997611EBB4E628DF90

Function 00E26C60 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 247COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00E26F11
___std_exception_destroy.LIBVCRUNTIME ref: 00E26F20

Strings

[json.exception., xrefs: 00E26CB8
`!, xrefs: 00E26F09, 00E26F19

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.$`!
API String ID: 4194217158-2932383579
Opcode ID: 6c622cbdc460e3b970bd150d5240e01207666aebc943c58e14544e86142340c4
Instruction ID: 48adba08bea6bd3e1cd2fdbf4ca052bf784b273308ac14e9665348c1ab4dc37a
Opcode Fuzzy Hash: 6c622cbdc460e3b970bd150d5240e01207666aebc943c58e14544e86142340c4
Instruction Fuzzy Hash: CF91E370A002189FDB18CF68D985B9EBBF2FF44300F20866DE415AB792D775AA41CB90

Function 00E27620 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 167COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E277B4

Strings

invalid_iterator, xrefs: 00E27656
`!, xrefs: 00E277BF
`!, xrefs: 00E2779F

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!$`!$invalid_iterator
API String ID: 2659868963-1518100916
Opcode ID: a593c55b5f056541eb49bb2f1b6ffd6cde8b698a186152b76a5c812f55306841
Instruction ID: 00e65235b09eae74e274c918c41551fe088134bb5fdde04ab83015e9221f09a8
Opcode Fuzzy Hash: a593c55b5f056541eb49bb2f1b6ffd6cde8b698a186152b76a5c812f55306841
Instruction Fuzzy Hash: 7F514AB09002188FDB18CF68E88479DFBF1FF49310F14866AE459EB792E7749980CB94

Function 00E27BE0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 156COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E27D67

Strings

other_error, xrefs: 00E27C0A
`!, xrefs: 00E27D72
`!, xrefs: 00E27D52

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!$`!$other_error
API String ID: 2659868963-2644867674
Opcode ID: 5d1636e28fa67f2107719020437dc496fde5f13289f1dde8bcc844f75bbc0622
Instruction ID: 1376918ab173513a550c89a191be5d7b981cf396c629d345932b35cf89d6cc9a
Opcode Fuzzy Hash: 5d1636e28fa67f2107719020437dc496fde5f13289f1dde8bcc844f75bbc0622
Instruction Fuzzy Hash: D9516BB09002588FDB18CFA8E88479DFBF1FF49300F148669E459EB792D774A984CB51

Function 00E8D050 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E8D06F
___std_exception_copy.LIBVCRUNTIME ref: 00E8D096

Strings

`!, xrefs: 00E8D060, 00E8D085
`!, xrefs: 00E8D09B

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!$`!
API String ID: 2659868963-1501952390
Opcode ID: 73999430599f08e79885edc71edc38918d40805b10b7029058dc1838a2fdef63
Instruction ID: 803e7154287e4386bdd47d106ad582b7d269e830daa559e4878833b2715db83a
Opcode Fuzzy Hash: 73999430599f08e79885edc71edc38918d40805b10b7029058dc1838a2fdef63
Instruction Fuzzy Hash: 5301A4B6500616AFC704DF59D505982FBF8FB49710704853BA929CBB11E7B0E528DFA0

Function 00E9B3C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E9B3DF
___std_exception_copy.LIBVCRUNTIME ref: 00E9B406

Strings

`!, xrefs: 00E9B3D0, 00E9B3F5
`!, xrefs: 00E9B40E

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!$`!
API String ID: 2659868963-1501952390
Opcode ID: 85198b0f4d25c001fee0b32d0b5a39a20c76fc956bd22bbb2b2e849715ce8908
Instruction ID: b6eb54f067dd5123c54f6e130b01c5dad0c46cba8f61e5494eb96c41ac7d66df
Opcode Fuzzy Hash: 85198b0f4d25c001fee0b32d0b5a39a20c76fc956bd22bbb2b2e849715ce8908
Instruction Fuzzy Hash: B9F0C4B6500616AF8708DF58D505986BBF8FB45710705853BE52ACBB01E7B0E528DBA0

Function 00E22270 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 218COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00E22275

Part of subcall function 00EFD6E9: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00EFD6F5

Strings

), xrefs: 00E22382
string too long, xrefs: 00E22270

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: string too long$)
API String ID: 1997705970-906081222
Opcode ID: bcd7d4183c767adb930f9acbba96b35754209002afc9e4f0d376d8301899b119
Instruction ID: 2d7a99db14ea08e8806ebd7182c340b27fcc3c6c3fab88be1272cad1caa83779
Opcode Fuzzy Hash: bcd7d4183c767adb930f9acbba96b35754209002afc9e4f0d376d8301899b119
Instruction Fuzzy Hash: 3C813275A0429AAFCB02CF68C4507EDBFF1EF5A300F1841AECA94A7742C3359545CBA0

Function 00E9B450 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 190COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00E9B612

Strings

Px, xrefs: 00E9B456, 00E9B5BA, 00E9B5F3, 00E9B54A, 00E9B4F1
invalid hash bucket count, xrefs: 00E9B60D

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_
String ID: Px$invalid hash bucket count
API String ID: 909987262-1779506432
Opcode ID: 37a2cd6eecc92ff53301f3383126d605a5c14ff7059684deb759e1f968a0e16a
Instruction ID: 8f2ce83f6dfd477ea7d6ec6f6a224365b40125daf9ee55e6aaa316681e618c9e
Opcode Fuzzy Hash: 37a2cd6eecc92ff53301f3383126d605a5c14ff7059684deb759e1f968a0e16a
Instruction Fuzzy Hash: 9D7102B4A00619DFCB14CF49D280869FBF6FF88314725C5AAD859AB356D731EA41CF90

Function 00E9E440 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00E9E491

Strings

type must be string, but is , xrefs: 00E9E4F8
type must be boolean, but is , xrefs: 00E9E582

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: type must be boolean, but is $type must be string, but is
API String ID: 118556049-436076039
Opcode ID: 354e5571da3c5cefc0e48bbb9622d531af7749b882e3575be750a5a63d52cb40
Instruction ID: aaea65f4c193baca37a67387fc6f9003876c1c31060a09e5ae6ba120b5db35ea
Opcode Fuzzy Hash: 354e5571da3c5cefc0e48bbb9622d531af7749b882e3575be750a5a63d52cb40
Instruction Fuzzy Hash: E6413CB1900248AFDB14EBA4E802B9E77E8DB00314F144679F619F7792EB35E944C792

Function 00E23050 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E23078

Strings

`!, xrefs: 00E23063
`!, xrefs: 00E23080

Memory Dump Source

Source File: 0000000A.00000002.3319651891.0000000000E21000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000A.00000002.3319624486.0000000000E20000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319651891.0000000000F53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319884627.0000000000F58000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000000F5C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000010DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.0000000001171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3319930362.00000000011B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320409253.00000000011B7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320607317.0000000001311000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.3320641568.0000000001312000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e20000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!$`!
API String ID: 2659868963-1501952390
Opcode ID: 00599af393aa1bf7e6d0f0448e1ad4590a0aae8e106d7a35474f25a8210d0728
Instruction ID: 6532ee06e612f181bbec3c8f70d4044cdb6382071e6c8136134e768e3bc8d89a
Opcode Fuzzy Hash: 00599af393aa1bf7e6d0f0448e1ad4590a0aae8e106d7a35474f25a8210d0728
Instruction Fuzzy Hash: 88E012B29113189BC710DFA8D9059CAFFF8AB19701F0486BAE948D7301FAB1D5549BD1

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LisectAVT_2403002A_376.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\MPGPH131\MPGPH131.exe

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
LisectAVT_2403002A_376.exe

Function 00673A40 Relevance: 6.2, APIs: 4, Instructions: 157
sleepCOMMON

Function 0062E0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Function 006EF290 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51
COMMONLIBRARYCODE

Function 006F4942 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 157
COMMON

Function 00704623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Function 0061A210 Relevance: 1.7, APIs: 1, Instructions: 231
COMMON

Function 0070549C Relevance: 1.7, APIs: 1, Instructions: 198
fileCOMMON

Function 00680560 Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Function 00704B12 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 006FE05C Relevance: 1.6, APIs: 1, Instructions: 54
COMMONLIBRARYCODE

Function 007063F3 Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Function 00706E2D Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE