Edit tour

Windows Analysis Report
LisectAVT_2403002A_218.exe

Overview

General Information

Sample name:	LisectAVT_2403002A_218.exe
Analysis ID:	1482410
MD5:	6b79ebbf323bc3f77fb55112e9110f12
SHA1:	764f8ef62fcbae36f7aa89e7766c171a2cb0d658
SHA256:	b0f736a2ff992a8adc9fe5186368ef213b16cdf26acde6de7a6ec7dd9efa14fd
Tags:	exe
Infos:

Detection

RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Yara detected RisePro Stealer

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Uses schtasks.exe or at.exe to add and modify task schedules

Abnormal high CPU Usage

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to read the PEB

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

LisectAVT_2403002A_218.exe (PID: 3596 cmdline: "C:\Users\user\Desktop\LisectAVT_2403002A_218.exe" MD5: 6B79EBBF323BC3F77FB55112E9110F12)

schtasks.exe (PID: 3944 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 1632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 320 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 1848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MPGPH131.exe (PID: 4580 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 6B79EBBF323BC3F77FB55112E9110F12)

MPGPH131.exe (PID: 2656 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 6B79EBBF323BC3F77FB55112E9110F12)

RageMP131.exe (PID: 7324 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 6B79EBBF323BC3F77FB55112E9110F12)

RageMP131.exe (PID: 7652 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 6B79EBBF323BC3F77FB55112E9110F12)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000007.00000003.2109410350.00000000052E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000003.2038565636.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000A.00000003.2262402855.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000006.00000003.2108165970.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000008.00000003.2182379846.00000000049C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: LisectAVT_2403002A_218.exe PID: 3596	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 4580	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 2656	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 7324	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 7652	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe, ProcessId: 3596, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.68.123.157 - Destination IP: 192.168.2.5

Timestamp:	2024-07-25T22:35:48.985004+0200
SID:	2022930
Source Port:	443
Destination Port:	49707
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE RisePro TCP Heartbeat Packet - Source IP: 192.168.2.5 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T22:35:33.898254+0200
SID:	2049060
Source Port:	49704
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T22:35:58.153768+0200
SID:	2046269
Source Port:	49716
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE RisePro TCP Heartbeat Packet - Source IP: 192.168.2.5 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T22:35:39.900957+0200
SID:	2049060
Source Port:	49706
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T22:35:36.888332+0200
SID:	2046269
Source Port:	49704
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.68.123.157 - Destination IP: 192.168.2.5

Timestamp:	2024-07-25T22:36:27.419925+0200
SID:	2022930
Source Port:	443
Destination Port:	49717
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T22:35:42.875935+0200
SID:	2046269
Source Port:	49706
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T22:35:50.981833+0200
SID:	2046269
Source Port:	49709
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T22:35:42.873236+0200
SID:	2046269
Source Port:	49705
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: LisectAVT_2403002A_218.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Avira: detection malicious, Label: TR/Redcap.iodtu
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Avira: detection malicious, Label: TR/Redcap.iodtu

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: LisectAVT_2403002A_218.exe

Joe Sandbox ML: detected

Source: LisectAVT_2403002A_218.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 193.233.132.74 ports 0,5,7,8,58709,9

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 193.233.132.74:58709

Source: Joe Sandbox View

IP Address: 193.233.132.74 193.233.132.74

Source: Joe Sandbox View

ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU

Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74

Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe

Code function: 0_2_009FE0A0 recv,setsockopt,WSAStartup,closesocket,socket,connect,closesocket,

0_2_009FE0A0

Source: LisectAVT_2403002A_218.exe, 00000000.00000003.2038565636.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002A_218.exe, 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000006.00000003.2108165970.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000003.2109410350.00000000052E0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000008.00000003.2182379846.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000003.2262402855.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: LisectAVT_2403002A_218.exe, 00000000.00000003.2038565636.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002A_218.exe, 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000006.00000003.2108165970.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000003.2109410350.00000000052E0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000008.00000003.2182379846.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000003.2262402855.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: LisectAVT_2403002A_218.exe, 00000000.00000002.3306620800.00000000008BE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3306495921.00000000007CD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3308650896.000000000159B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3307041255.000000000080E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.3306406019.000000000070B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: LisectAVT_2403002A_218.exe, 00000000.00000002.3306620800.00000000008BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTd

System Summary

PE file contains section with special chars

Source: LisectAVT_2403002A_218.exe	Static PE information: section name:
Source: LisectAVT_2403002A_218.exe	Static PE information: section name: .idata
Source: LisectAVT_2403002A_218.exe	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name: .idata
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name: .idata
Source: MPGPH131.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00A550B0	0_2_00A550B0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00A69880	0_2_00A69880
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00AD9824	0_2_00AD9824
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_009E91A0	0_2_009E91A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00A573F0	0_2_00A573F0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00AC84A0	0_2_00AC84A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00AC2CE0	0_2_00AC2CE0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_009E24F0	0_2_009E24F0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00AC646A	0_2_00AC646A
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00A655B0	0_2_00A655B0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_009E8D70	0_2_009E8D70
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00A66550	0_2_00A66550
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00ACBEAF	0_2_00ACBEAF
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_009F9F50	0_2_009F9F50
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00ADF771	0_2_00ADF771
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00B350B0	6_2_00B350B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00B49880	6_2_00B49880
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00BB9824	6_2_00BB9824
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00AC91A0	6_2_00AC91A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00B373F0	6_2_00B373F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00BA84A0	6_2_00BA84A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00BA2CE0	6_2_00BA2CE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00AC24F0	6_2_00AC24F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00BA646A	6_2_00BA646A
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00B455B0	6_2_00B455B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00AC8D70	6_2_00AC8D70
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00B46550	6_2_00B46550
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00BABEAF	6_2_00BABEAF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00BBF771	6_2_00BBF771
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00AD9F50	6_2_00AD9F50
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00B350B0	7_2_00B350B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00B49880	7_2_00B49880
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00BB9824	7_2_00BB9824
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00AC91A0	7_2_00AC91A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00B373F0	7_2_00B373F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00BA84A0	7_2_00BA84A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00BA2CE0	7_2_00BA2CE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00AC24F0	7_2_00AC24F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00BA646A	7_2_00BA646A
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00B455B0	7_2_00B455B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00AC8D70	7_2_00AC8D70
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00B46550	7_2_00B46550
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00BABEAF	7_2_00BABEAF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00BBF771	7_2_00BBF771
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00AD9F50	7_2_00AD9F50
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_009F9880	8_2_009F9880
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_009E50B0	8_2_009E50B0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00A69824	8_2_00A69824
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_009791A0	8_2_009791A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_009E73F0	8_2_009E73F0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00A584A0	8_2_00A584A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00A52CE0	8_2_00A52CE0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_009724F0	8_2_009724F0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00A5646A	8_2_00A5646A
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_009F55B0	8_2_009F55B0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_009F6550	8_2_009F6550
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00978D70	8_2_00978D70
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00A5BEAF	8_2_00A5BEAF
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00989F50	8_2_00989F50
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00A6F771	8_2_00A6F771
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_009F9880	10_2_009F9880
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_009E50B0	10_2_009E50B0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00A69824	10_2_00A69824
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_009791A0	10_2_009791A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_009E73F0	10_2_009E73F0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00A584A0	10_2_00A584A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00A52CE0	10_2_00A52CE0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_009724F0	10_2_009724F0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00A5646A	10_2_00A5646A
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_009F55B0	10_2_009F55B0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_009F6550	10_2_009F6550
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00978D70	10_2_00978D70
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00A5BEAF	10_2_00A5BEAF
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00989F50	10_2_00989F50
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00A6F771	10_2_00A6F771

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 00B9FED0 appears 52 times
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: String function: 00A4FED0 appears 52 times

Source: LisectAVT_2403002A_218.exe, 00000000.00000002.3307103873.00000000009D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefilezilla.exe4 vs LisectAVT_2403002A_218.exe
Source: LisectAVT_2403002A_218.exe, 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamefilezilla.exe4 vs LisectAVT_2403002A_218.exe
Source: LisectAVT_2403002A_218.exe	Binary or memory string: OriginalFilenamefilezilla.exe4 vs LisectAVT_2403002A_218.exe

Source: LisectAVT_2403002A_218.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: LisectAVT_2403002A_218.exe	Static PE information: Section: ZLIB complexity 0.9990462662337662
Source: LisectAVT_2403002A_218.exe	Static PE information: Section: ixqntyfn ZLIB complexity 0.990290031029671
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9990462662337662
Source: RageMP131.exe.0.dr	Static PE information: Section: ixqntyfn ZLIB complexity 0.990290031029671
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9990462662337662
Source: MPGPH131.exe.0.dr	Static PE information: Section: ixqntyfn ZLIB complexity 0.990290031029671

Source: classification engine

Classification label: mal100.troj.evad.winEXE@11/5@0/1

Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe

File created: C:\Users\user\AppData\Local\RageMP131

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1848:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1632:120:WilError_03

Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe

File created: C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: LisectAVT_2403002A_218.exe, 00000000.00000003.2038565636.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002A_218.exe, 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000006.00000003.2108165970.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000003.2109410350.00000000052E0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000008.00000003.2182379846.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000003.2262402855.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: LisectAVT_2403002A_218.exe, 00000000.00000003.2038565636.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002A_218.exe, 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000006.00000003.2108165970.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000003.2109410350.00000000052E0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000008.00000003.2182379846.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000003.2262402855.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

Source: LisectAVT_2403002A_218.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: MPGPH131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: MPGPH131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: RageMP131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: RageMP131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe

File read: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe "C:\Users\user\Desktop\LisectAVT_2403002A_218.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll	Jump to behavior

Source: LisectAVT_2403002A_218.exe

Static file information: File size 2343431 > 1048576

Source: LisectAVT_2403002A_218.exe

Static PE information: Raw size of ixqntyfn is bigger than: 0x100000 < 0x1a9800

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Unpacked PE file: 0.2.LisectAVT_2403002A_218.exe.9e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ixqntyfn:EW;fwmicjtz:EW; vs :ER;.rsrc:W;.idata :W; :EW;ixqntyfn:EW;fwmicjtz:EW;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 6.2.MPGPH131.exe.ac0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ixqntyfn:EW;fwmicjtz:EW; vs :ER;.rsrc:W;.idata :W; :EW;ixqntyfn:EW;fwmicjtz:EW;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 7.2.MPGPH131.exe.ac0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ixqntyfn:EW;fwmicjtz:EW; vs :ER;.rsrc:W;.idata :W; :EW;ixqntyfn:EW;fwmicjtz:EW;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 8.2.RageMP131.exe.970000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ixqntyfn:EW;fwmicjtz:EW; vs :ER;.rsrc:W;.idata :W; :EW;ixqntyfn:EW;fwmicjtz:EW;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 10.2.RageMP131.exe.970000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ixqntyfn:EW;fwmicjtz:EW; vs :ER;.rsrc:W;.idata :W; :EW;ixqntyfn:EW;fwmicjtz:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: fwmicjtz

Source: LisectAVT_2403002A_218.exe	Static PE information: real checksum: 0x2416ea should be: 0x2416f1
Source: RageMP131.exe.0.dr	Static PE information: real checksum: 0x2416ea should be: 0x2416f1
Source: MPGPH131.exe.0.dr	Static PE information: real checksum: 0x2416ea should be: 0x2416f1

Source: LisectAVT_2403002A_218.exe	Static PE information: section name:
Source: LisectAVT_2403002A_218.exe	Static PE information: section name: .idata
Source: LisectAVT_2403002A_218.exe	Static PE information: section name:
Source: LisectAVT_2403002A_218.exe	Static PE information: section name: ixqntyfn
Source: LisectAVT_2403002A_218.exe	Static PE information: section name: fwmicjtz
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name: .idata
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name: ixqntyfn
Source: RageMP131.exe.0.dr	Static PE information: section name: fwmicjtz
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name: .idata
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name: ixqntyfn
Source: MPGPH131.exe.0.dr	Static PE information: section name: fwmicjtz

Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00F8A048 push 7E7D5AE6h; mov dword ptr [esp], edx	0_2_00F8A071
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00F8A048 push ebp; mov dword ptr [esp], 6B952718h	0_2_00F8A07D
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00F8A048 push 3196D53Ah; mov dword ptr [esp], esi	0_2_00F8A0EC
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00F8A048 push eax; mov dword ptr [esp], 68BEA1A4h	0_2_00F8A0FA
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00F8A048 push esi; mov dword ptr [esp], eax	0_2_00F8A10C
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00F8A048 push edx; mov dword ptr [esp], ebx	0_2_00F8A155
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00F8A000 push edx; mov dword ptr [esp], 3FBEF12Ch	0_2_00F8A001
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00F8A000 push ecx; mov dword ptr [esp], edx	0_2_00F8A02A
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00F8A000 push 7E7D5AE6h; mov dword ptr [esp], edx	0_2_00F8A071
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00F8A000 push ebp; mov dword ptr [esp], 6B952718h	0_2_00F8A07D
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00F8A000 push 3196D53Ah; mov dword ptr [esp], esi	0_2_00F8A0EC
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00F8A000 push eax; mov dword ptr [esp], 68BEA1A4h	0_2_00F8A0FA
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00F8A000 push esi; mov dword ptr [esp], eax	0_2_00F8A10C
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00F8A000 push edx; mov dword ptr [esp], ebx	0_2_00F8A155
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00F8A185 push ebp; mov dword ptr [esp], ecx	0_2_00F8A186
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00F8A185 push 347B5DCCh; mov dword ptr [esp], esp	0_2_00F8A1A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00F8A185 push 074210AEh; mov dword ptr [esp], ecx	0_2_00F8A1B8
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00F8A185 push 6A865140h; mov dword ptr [esp], ebx	0_2_00F8A1C3
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00F8A185 push eax; mov dword ptr [esp], edx	0_2_00F8A1D1
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00F8A185 push 650C164Dh; mov dword ptr [esp], esi	0_2_00F8A1DC
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00F8A185 push 140C8393h; mov dword ptr [esp], ebx	0_2_00F8A29D
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00ABFA97 push ecx; ret	0_2_00ABFAAA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0106A185 push ebp; mov dword ptr [esp], ecx	6_2_0106A186
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0106A185 push 347B5DCCh; mov dword ptr [esp], esp	6_2_0106A1A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0106A185 push 074210AEh; mov dword ptr [esp], ecx	6_2_0106A1B8
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0106A185 push 6A865140h; mov dword ptr [esp], ebx	6_2_0106A1C3
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0106A185 push eax; mov dword ptr [esp], edx	6_2_0106A1D1
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0106A185 push 650C164Dh; mov dword ptr [esp], esi	6_2_0106A1DC
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0106A185 push 140C8393h; mov dword ptr [esp], ebx	6_2_0106A29D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0106A000 push edx; mov dword ptr [esp], 3FBEF12Ch	6_2_0106A001
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0106A000 push ecx; mov dword ptr [esp], edx	6_2_0106A02A

Source: LisectAVT_2403002A_218.exe	Static PE information: section name: entropy: 7.98579152603459
Source: LisectAVT_2403002A_218.exe	Static PE information: section name: ixqntyfn entropy: 7.951072598064479
Source: RageMP131.exe.0.dr	Static PE information: section name: entropy: 7.98579152603459
Source: RageMP131.exe.0.dr	Static PE information: section name: ixqntyfn entropy: 7.951072598064479
Source: MPGPH131.exe.0.dr	Static PE information: section name: entropy: 7.98579152603459
Source: MPGPH131.exe.0.dr	Static PE information: section name: ixqntyfn entropy: 7.951072598064479

Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe			Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe			Jump to dropped file

Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe

File created: C:\ProgramData\MPGPH131\MPGPH131.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: Regmonclass	Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep	graph_0-19857
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep	graph_6-18886
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep	graph_8-19534

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: B205C5 second address: B205CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: B205CA second address: B205D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: B205D0 second address: B1FE52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov dword ptr [ebp+122D1D04h], ecx 0x0000000f push dword ptr [ebp+122D03FDh] 0x00000015 sub dword ptr [ebp+122D1D20h], esi 0x0000001b call dword ptr [ebp+122D180Eh] 0x00000021 pushad 0x00000022 jg 00007F6F2C52564Ch 0x00000028 mov dword ptr [ebp+122D1D2Bh], ebx 0x0000002e xor eax, eax 0x00000030 mov dword ptr [ebp+122D1D2Bh], eax 0x00000036 mov edx, dword ptr [esp+28h] 0x0000003a cmc 0x0000003b mov dword ptr [ebp+122D2C46h], eax 0x00000041 pushad 0x00000042 push esi 0x00000043 mov dl, cl 0x00000045 pop edi 0x00000046 movsx ecx, dx 0x00000049 popad 0x0000004a pushad 0x0000004b mov dword ptr [ebp+122D1D2Bh], eax 0x00000051 mov edx, dword ptr [ebp+122D2EE6h] 0x00000057 popad 0x00000058 mov esi, 0000003Ch 0x0000005d pushad 0x0000005e mov esi, dword ptr [ebp+122D2EBAh] 0x00000064 jmp 00007F6F2C52564Bh 0x00000069 popad 0x0000006a add esi, dword ptr [esp+24h] 0x0000006e xor dword ptr [ebp+122D1D2Bh], edx 0x00000074 lodsw 0x00000076 jns 00007F6F2C525658h 0x0000007c jmp 00007F6F2C525652h 0x00000081 add eax, dword ptr [esp+24h] 0x00000085 jnp 00007F6F2C52564Dh 0x0000008b mov ebx, dword ptr [esp+24h] 0x0000008f jnc 00007F6F2C52565Fh 0x00000095 nop 0x00000096 pushad 0x00000097 push ecx 0x00000098 push eax 0x00000099 push edx 0x0000009a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: B1FE52 second address: B1FE78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jne 00007F6F2CC2BEF6h 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F6F2CC2BF02h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C90B02 second address: C90B06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C90B06 second address: C90B16 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F6F2CC2BEF6h 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C90B16 second address: C90B1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C90B1A second address: C90B20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C9993F second address: C99943 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C99943 second address: C9994E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C9994E second address: C9996C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F6F2C525646h 0x0000000a jmp 00007F6F2C525653h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C9C0DA second address: B1FE52 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2CC2BEFFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F6F2CC2BF00h 0x0000000e popad 0x0000000f add dword ptr [esp], 7C5B7718h 0x00000016 jno 00007F6F2CC2BEFCh 0x0000001c xor ecx, dword ptr [ebp+122D2E5Eh] 0x00000022 jmp 00007F6F2CC2BF02h 0x00000027 push dword ptr [ebp+122D03FDh] 0x0000002d mov esi, dword ptr [ebp+122D1ED8h] 0x00000033 call dword ptr [ebp+122D180Eh] 0x00000039 pushad 0x0000003a jg 00007F6F2CC2BEFCh 0x00000040 xor eax, eax 0x00000042 mov dword ptr [ebp+122D1D2Bh], eax 0x00000048 mov edx, dword ptr [esp+28h] 0x0000004c cmc 0x0000004d mov dword ptr [ebp+122D2C46h], eax 0x00000053 pushad 0x00000054 push esi 0x00000055 mov dl, cl 0x00000057 pop edi 0x00000058 movsx ecx, dx 0x0000005b popad 0x0000005c pushad 0x0000005d mov dword ptr [ebp+122D1D2Bh], eax 0x00000063 mov edx, dword ptr [ebp+122D2EE6h] 0x00000069 popad 0x0000006a mov esi, 0000003Ch 0x0000006f pushad 0x00000070 mov esi, dword ptr [ebp+122D2EBAh] 0x00000076 jmp 00007F6F2CC2BEFBh 0x0000007b popad 0x0000007c add esi, dword ptr [esp+24h] 0x00000080 xor dword ptr [ebp+122D1D2Bh], edx 0x00000086 lodsw 0x00000088 jns 00007F6F2CC2BF08h 0x0000008e jmp 00007F6F2CC2BF02h 0x00000093 add eax, dword ptr [esp+24h] 0x00000097 jnp 00007F6F2CC2BEFDh 0x0000009d mov ebx, dword ptr [esp+24h] 0x000000a1 jnc 00007F6F2CC2BF0Fh 0x000000a7 nop 0x000000a8 pushad 0x000000a9 push ecx 0x000000aa push eax 0x000000ab push edx 0x000000ac rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C9C165 second address: C9C1AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2C52564Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c jnc 00007F6F2C525646h 0x00000012 call 00007F6F2C525659h 0x00000017 pop esi 0x00000018 push 00000000h 0x0000001a or dword ptr [ebp+122D1D88h], edi 0x00000020 push FF247626h 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 pushad 0x00000029 popad 0x0000002a pushad 0x0000002b popad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C9C1AE second address: C9C226 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 00DB8A5Ah 0x0000000f xor dword ptr [ebp+122D1D1Bh], edi 0x00000015 push 00000003h 0x00000017 push 00000000h 0x00000019 push edx 0x0000001a call 00007F6F2CC2BEF8h 0x0000001f pop edx 0x00000020 mov dword ptr [esp+04h], edx 0x00000024 add dword ptr [esp+04h], 00000017h 0x0000002c inc edx 0x0000002d push edx 0x0000002e ret 0x0000002f pop edx 0x00000030 ret 0x00000031 jmp 00007F6F2CC2BEFDh 0x00000036 jmp 00007F6F2CC2BF04h 0x0000003b push 00000000h 0x0000003d push edx 0x0000003e mov dh, EBh 0x00000040 pop edx 0x00000041 push 00000003h 0x00000043 mov edi, dword ptr [ebp+122D2BE6h] 0x00000049 push CE4C2E81h 0x0000004e jp 00007F6F2CC2BF04h 0x00000054 push eax 0x00000055 push edx 0x00000056 jnp 00007F6F2CC2BEF6h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C9C226 second address: C9C28A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xor dword ptr [esp], 0E4C2E81h 0x0000000d call 00007F6F2C525656h 0x00000012 jmp 00007F6F2C525659h 0x00000017 pop ecx 0x00000018 lea ebx, dword ptr [ebp+1245004Fh] 0x0000001e mov dx, cx 0x00000021 xchg eax, ebx 0x00000022 jmp 00007F6F2C52564Ch 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b jnl 00007F6F2C525646h 0x00000031 jnc 00007F6F2C525646h 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C9C373 second address: C9C379 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C9C379 second address: C9C383 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6F2C52564Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C9C383 second address: C9C390 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C9C390 second address: C9C394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C9C394 second address: C9C3FC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jmp 00007F6F2CC2BF00h 0x00000010 pop eax 0x00000011 call 00007F6F2CC2BEFFh 0x00000016 cmc 0x00000017 pop esi 0x00000018 push 00000003h 0x0000001a adc dh, 00000010h 0x0000001d push 00000000h 0x0000001f push 00000003h 0x00000021 sub cx, 9000h 0x00000026 call 00007F6F2CC2BEF9h 0x0000002b jp 00007F6F2CC2BF0Eh 0x00000031 jp 00007F6F2CC2BF08h 0x00000037 jmp 00007F6F2CC2BF02h 0x0000003c push eax 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 push edx 0x00000041 pop edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C9C3FC second address: C9C49C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2C525658h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f popad 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jmp 00007F6F2C52564Bh 0x00000019 mov eax, dword ptr [eax] 0x0000001b ja 00007F6F2C525654h 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 jno 00007F6F2C525666h 0x0000002b pop eax 0x0000002c adc di, 01C1h 0x00000031 lea ebx, dword ptr [ebp+12450058h] 0x00000037 pushad 0x00000038 mov esi, dword ptr [ebp+122D1D10h] 0x0000003e push edi 0x0000003f mov cx, 7E28h 0x00000043 pop esi 0x00000044 popad 0x00000045 xchg eax, ebx 0x00000046 pushad 0x00000047 push ebx 0x00000048 jmp 00007F6F2C52564Ch 0x0000004d pop ebx 0x0000004e push eax 0x0000004f push edx 0x00000050 push edi 0x00000051 pop edi 0x00000052 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C9C49C second address: C9C4A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C9C4A0 second address: C9C4AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C9C4E2 second address: C9C4E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C9C4E6 second address: C9C505 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jng 00007F6F2C525646h 0x0000000d pop ecx 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F6F2C52564Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C9C505 second address: C9C50B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C9C50B second address: C9C50F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C9C50F second address: C9C545 instructions: 0x00000000 rdtsc 0x00000002 js 00007F6F2CC2BEF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d pushad 0x0000000e mov edx, 0CC0A9DDh 0x00000013 mov ecx, esi 0x00000015 popad 0x00000016 push 00000000h 0x00000018 sub esi, dword ptr [ebp+122D17FAh] 0x0000001e call 00007F6F2CC2BEF9h 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F6F2CC2BEFDh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C9C545 second address: C9C579 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2C52564Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b push eax 0x0000000c ja 00007F6F2C525646h 0x00000012 pop eax 0x00000013 pop esi 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 push edx 0x00000019 je 00007F6F2C525648h 0x0000001f push esi 0x00000020 pop esi 0x00000021 pop edx 0x00000022 mov eax, dword ptr [eax] 0x00000024 pushad 0x00000025 pushad 0x00000026 push ecx 0x00000027 pop ecx 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C9C579 second address: C9C61E instructions: 0x00000000 rdtsc 0x00000002 js 00007F6F2CC2BEF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push ebx 0x00000010 jc 00007F6F2CC2BF07h 0x00000016 pop ebx 0x00000017 pop eax 0x00000018 jns 00007F6F2CC2BEFCh 0x0000001e push 00000003h 0x00000020 jmp 00007F6F2CC2BF01h 0x00000025 push 00000000h 0x00000027 add dword ptr [ebp+122D1856h], ecx 0x0000002d push 00000003h 0x0000002f call 00007F6F2CC2BEF9h 0x00000034 jmp 00007F6F2CC2BF01h 0x00000039 push eax 0x0000003a pushad 0x0000003b push edx 0x0000003c ja 00007F6F2CC2BEF6h 0x00000042 pop edx 0x00000043 jmp 00007F6F2CC2BEFCh 0x00000048 popad 0x00000049 mov eax, dword ptr [esp+04h] 0x0000004d jmp 00007F6F2CC2BF02h 0x00000052 mov eax, dword ptr [eax] 0x00000054 push eax 0x00000055 push edx 0x00000056 jo 00007F6F2CC2BEF8h 0x0000005c push edx 0x0000005d pop edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C9C61E second address: C9C663 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push edi 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F6F2C52564Dh 0x00000017 popad 0x00000018 pop edi 0x00000019 pop eax 0x0000001a jmp 00007F6F2C525656h 0x0000001f lea ebx, dword ptr [ebp+12450063h] 0x00000025 xchg eax, ebx 0x00000026 push eax 0x00000027 push edx 0x00000028 push esi 0x00000029 pushad 0x0000002a popad 0x0000002b pop esi 0x0000002c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CAF156 second address: CAF15A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C81B29 second address: C81B2E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CBCB31 second address: CBCB37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CBCB37 second address: CBCB4F instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6F2C525646h 0x00000008 jno 00007F6F2C525646h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 ja 00007F6F2C52564Eh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CBCC9D second address: CBCCA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CBCE23 second address: CBCE27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CBD0AB second address: CBD0BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F6F2CC2BF10h 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CBD0BA second address: CBD0C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CBD1F0 second address: CBD1F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CBD1F5 second address: CBD1FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CBD4FD second address: CBD51C instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6F2CC2BEF6h 0x00000008 jnc 00007F6F2CC2BEF6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 ja 00007F6F2CC2BEF6h 0x00000017 jo 00007F6F2CC2BEF6h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CBD810 second address: CBD81F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2C52564Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CBDAFF second address: CBDB0D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CBDB0D second address: CBDB18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C92694 second address: C9269A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C9269A second address: C9269E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C9269E second address: C926C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F6F2CC2BF07h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c push edi 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C926C0 second address: C926CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CBDC78 second address: CBDC7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CBDC7E second address: CBDC82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CBDC82 second address: CBDC86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CBDC86 second address: CBDC8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CBE52B second address: CBE533 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CBE92F second address: CBE935 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CBE935 second address: CBE93B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CBE93B second address: CBE942 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C88642 second address: C88663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6F2CC2BF09h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C88663 second address: C88669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C88669 second address: C88685 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6F2CC2BF02h 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CC25B0 second address: CC25B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CC25B5 second address: CC25E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6F2CC2BF04h 0x00000008 jmp 00007F6F2CC2BF06h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C86B72 second address: C86B78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C86B78 second address: C86B80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C86B80 second address: C86B8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CC4804 second address: CC4808 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CC33D3 second address: CC33EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2C525653h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CC33EA second address: CC33F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CC33F0 second address: CC33F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CC4C01 second address: CC4C05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CC4C05 second address: CC4C1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6F2C52564Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CC4C1A second address: CC4C20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CCCA93 second address: CCCAA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6F2C52564Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007F6F2C525646h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CCCAA9 second address: CCCAE7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F6F2CC2BF00h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F6F2CC2BF07h 0x00000014 jne 00007F6F2CC2BEF6h 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CCCAE7 second address: CCCAF3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007F6F2C525646h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CCCE05 second address: CCCE1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2CC2BF03h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CCD231 second address: CCD23B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CCD23B second address: CCD247 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CCDCF5 second address: CCDCF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CCDD94 second address: CCDDF7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2CC2BF08h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 43E227B0h 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007F6F2CC2BEF8h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 00000017h 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a add dword ptr [ebp+122D3B65h], edx 0x00000030 mov dword ptr [ebp+122D17F5h], eax 0x00000036 call 00007F6F2CC2BEF9h 0x0000003b pushad 0x0000003c jbe 00007F6F2CC2BEF8h 0x00000042 pushad 0x00000043 popad 0x00000044 pushad 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CCDDF7 second address: CCDE0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jnl 00007F6F2C525646h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CCDE0A second address: CCDE1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jbe 00007F6F2CC2BF00h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CCE252 second address: CCE256 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CCE4A7 second address: CCE4E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2CC2BEFFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007F6F2CC2BEFCh 0x0000000f jne 00007F6F2CC2BEF6h 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jo 00007F6F2CC2BF0Ah 0x0000001f jmp 00007F6F2CC2BF04h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CCE4E4 second address: CCE4EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CCEB45 second address: CCEB4F instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6F2CC2BEF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CCEB4F second address: CCEB76 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F6F2C525655h 0x0000000e xchg eax, ebx 0x0000000f mov esi, ebx 0x00000011 push eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CCEFB4 second address: CCEFB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CCF0DB second address: CCF0DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CCF0DF second address: CCF0E5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CCF0E5 second address: CCF0EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CCF0EB second address: CCF117 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6F2CC2BEF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f cmc 0x00000010 xchg eax, ebx 0x00000011 push esi 0x00000012 pushad 0x00000013 jmp 00007F6F2CC2BEFFh 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b pop esi 0x0000001c push eax 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CCF117 second address: CCF11B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CCF5C6 second address: CCF5D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F6F2CC2BEF6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD234B second address: CD2357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD09E4 second address: CD09E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD09E9 second address: CD09EE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C836C2 second address: C836C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C836C6 second address: C836CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C836CC second address: C836F0 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6F2CC2BEFCh 0x00000008 jnl 00007F6F2CC2BEF6h 0x0000000e pushad 0x0000000f jmp 00007F6F2CC2BF03h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD3E09 second address: CD3E12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD3E12 second address: CD3E16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD4BAB second address: CD4C15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 nop 0x00000007 add dword ptr [ebp+12473268h], ecx 0x0000000d mov dword ptr [ebp+122D3B41h], edx 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push esi 0x00000018 call 00007F6F2C525648h 0x0000001d pop esi 0x0000001e mov dword ptr [esp+04h], esi 0x00000022 add dword ptr [esp+04h], 0000001Ch 0x0000002a inc esi 0x0000002b push esi 0x0000002c ret 0x0000002d pop esi 0x0000002e ret 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ebp 0x00000034 call 00007F6F2C525648h 0x00000039 pop ebp 0x0000003a mov dword ptr [esp+04h], ebp 0x0000003e add dword ptr [esp+04h], 0000001Ch 0x00000046 inc ebp 0x00000047 push ebp 0x00000048 ret 0x00000049 pop ebp 0x0000004a ret 0x0000004b mov edi, dword ptr [ebp+122D2BD2h] 0x00000051 push eax 0x00000052 pushad 0x00000053 pushad 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD5715 second address: CD5744 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6F2CC2BEFCh 0x00000008 jno 00007F6F2CC2BEF6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 jnc 00007F6F2CC2BEF6h 0x0000001b popad 0x0000001c pushad 0x0000001d jmp 00007F6F2CC2BF00h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD5744 second address: CD578A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 mov dword ptr [ebp+1247BF3Ch], edi 0x0000000d sub dword ptr [ebp+1245578Ch], ecx 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ebx 0x00000018 call 00007F6F2C525648h 0x0000001d pop ebx 0x0000001e mov dword ptr [esp+04h], ebx 0x00000022 add dword ptr [esp+04h], 00000015h 0x0000002a inc ebx 0x0000002b push ebx 0x0000002c ret 0x0000002d pop ebx 0x0000002e ret 0x0000002f cmc 0x00000030 push 00000000h 0x00000032 jmp 00007F6F2C52564Ah 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a push esi 0x0000003b push edi 0x0000003c pop edi 0x0000003d pop esi 0x0000003e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD541C second address: CD5422 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD5422 second address: CD5426 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD939C second address: CD93CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F6F2CC2BF07h 0x0000000d pushad 0x0000000e jmp 00007F6F2CC2BF01h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD5426 second address: CD5441 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6F2C525646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007F6F2C52564Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD5441 second address: CD5447 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD6039 second address: CD603D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD603D second address: CD604A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CDA664 second address: CDA68A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F6F2C52564Fh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jnl 00007F6F2C525658h 0x00000014 push eax 0x00000015 push edx 0x00000016 jne 00007F6F2C525646h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CDA68A second address: CDA68E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CDA68E second address: CDA72D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 xor edi, 05760A2Ch 0x0000000d push dword ptr fs:[00000000h] 0x00000014 jmp 00007F6F2C52564Dh 0x00000019 mov dword ptr fs:[00000000h], esp 0x00000020 push 00000000h 0x00000022 push edi 0x00000023 call 00007F6F2C525648h 0x00000028 pop edi 0x00000029 mov dword ptr [esp+04h], edi 0x0000002d add dword ptr [esp+04h], 00000014h 0x00000035 inc edi 0x00000036 push edi 0x00000037 ret 0x00000038 pop edi 0x00000039 ret 0x0000003a pushad 0x0000003b push edx 0x0000003c mov dword ptr [ebp+122D35E1h], ecx 0x00000042 pop eax 0x00000043 mov cl, 77h 0x00000045 popad 0x00000046 mov eax, dword ptr [ebp+122D16DDh] 0x0000004c add dword ptr [ebp+1246165Dh], eax 0x00000052 push FFFFFFFFh 0x00000054 push 00000000h 0x00000056 push edx 0x00000057 call 00007F6F2C525648h 0x0000005c pop edx 0x0000005d mov dword ptr [esp+04h], edx 0x00000061 add dword ptr [esp+04h], 00000018h 0x00000069 inc edx 0x0000006a push edx 0x0000006b ret 0x0000006c pop edx 0x0000006d ret 0x0000006e mov dword ptr [ebp+12458555h], edi 0x00000074 nop 0x00000075 jnl 00007F6F2C525650h 0x0000007b push eax 0x0000007c pushad 0x0000007d jl 00007F6F2C52564Ch 0x00000083 push eax 0x00000084 push edx 0x00000085 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CDB722 second address: CDB741 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2CC2BF05h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CDB7E1 second address: CDB7E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CDB7E5 second address: CDB7EF instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6F2CC2BEF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CDD715 second address: CDD72D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2C525651h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CDD8A9 second address: CDD8AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CDF72F second address: CDF735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CDF735 second address: CDF75C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F6F2CC2BEFBh 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F6F2CC2BF02h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CDD8AF second address: CDD8B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CDD8B5 second address: CDD8D5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6F2CC2BF05h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CE4A4A second address: CE4A4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CE4A4E second address: CE4AD3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007F6F2CC2BEF8h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 jno 00007F6F2CC2BEFCh 0x00000028 mov dword ptr [ebp+122D31A0h], eax 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push ebp 0x00000033 call 00007F6F2CC2BEF8h 0x00000038 pop ebp 0x00000039 mov dword ptr [esp+04h], ebp 0x0000003d add dword ptr [esp+04h], 00000017h 0x00000045 inc ebp 0x00000046 push ebp 0x00000047 ret 0x00000048 pop ebp 0x00000049 ret 0x0000004a movsx ebx, si 0x0000004d push 00000000h 0x0000004f call 00007F6F2CC2BF03h 0x00000054 mov bx, cx 0x00000057 pop edi 0x00000058 xchg eax, esi 0x00000059 pushad 0x0000005a jp 00007F6F2CC2BEFCh 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CE4AD3 second address: CE4ADA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CE5AEB second address: CE5AF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F6F2CC2BEF6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CE5AF6 second address: CE5B02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CE6B41 second address: CE6BCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007F6F2CC2BEFDh 0x0000000b jmp 00007F6F2CC2BF06h 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 jg 00007F6F2CC2BEFEh 0x00000019 nop 0x0000001a mov dword ptr [ebp+122D324Fh], edx 0x00000020 push 00000000h 0x00000022 sub dword ptr [ebp+122D31E5h], ebx 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push ebp 0x0000002d call 00007F6F2CC2BEF8h 0x00000032 pop ebp 0x00000033 mov dword ptr [esp+04h], ebp 0x00000037 add dword ptr [esp+04h], 0000001Ch 0x0000003f inc ebp 0x00000040 push ebp 0x00000041 ret 0x00000042 pop ebp 0x00000043 ret 0x00000044 sub ebx, dword ptr [ebp+122D1D09h] 0x0000004a push eax 0x0000004b jnl 00007F6F2CC2BF0Eh 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007F6F2CC2BF00h 0x00000058 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CE3A8B second address: CE3A8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CE4C4A second address: CE4C4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CE7B81 second address: CE7B87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CE1A34 second address: CE1A4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6F2CC2BEFFh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CE5C93 second address: CE5C97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CE6D14 second address: CE6D1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CE6D1A second address: CE6D1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CE6E35 second address: CE6E3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CE6E3B second address: CE6E40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CE8C26 second address: CE8C2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CE8C2A second address: CE8C30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CE7D36 second address: CE7D3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CE7D3B second address: CE7DAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b jmp 00007F6F2C525658h 0x00000010 pop ecx 0x00000011 nop 0x00000012 pushad 0x00000013 mov dx, ax 0x00000016 mov eax, dword ptr [ebp+122D2CC6h] 0x0000001c popad 0x0000001d push dword ptr fs:[00000000h] 0x00000024 add dword ptr [ebp+122D1CF3h], ebx 0x0000002a mov dword ptr fs:[00000000h], esp 0x00000031 push edx 0x00000032 push ecx 0x00000033 movsx ebx, di 0x00000036 pop edi 0x00000037 pop edi 0x00000038 mov eax, dword ptr [ebp+122D13D9h] 0x0000003e push FFFFFFFFh 0x00000040 mov ebx, dword ptr [ebp+122D2C9Eh] 0x00000046 nop 0x00000047 push edx 0x00000048 pushad 0x00000049 jmp 00007F6F2C525655h 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CE7DAE second address: CE7DCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 pushad 0x00000008 jne 00007F6F2CC2BEFCh 0x0000000e push eax 0x0000000f push edx 0x00000010 js 00007F6F2CC2BEF6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CE8D87 second address: CE8D8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CE8D8C second address: CE8DA2 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6F2CC2BEFCh 0x00000008 jns 00007F6F2CC2BEF6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CE8DA2 second address: CE8DA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CE8E97 second address: CE8E9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CE8E9B second address: CE8E9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CE8E9F second address: CE8EA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CEC1D4 second address: CEC1DE instructions: 0x00000000 rdtsc 0x00000002 je 00007F6F2C525646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CF2015 second address: CF201B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CF201B second address: CF2030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F6F2C52564Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CF2030 second address: CF203C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6F2CC2BEFEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CF51F0 second address: CF51F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CFC8CD second address: CFC8D3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CFC8D3 second address: CFC90A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F6F2C52564Fh 0x0000000a pop edi 0x0000000b push edi 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop edi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 push esi 0x00000018 pop esi 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F6F2C52564Fh 0x00000021 push eax 0x00000022 pop eax 0x00000023 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CFD002 second address: CFD006 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CFD530 second address: CFD536 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CFD694 second address: CFD69A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CFD69A second address: CFD69F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CFD69F second address: CFD6A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F6F2CC2BEF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CFD6A9 second address: CFD6AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CFD7B5 second address: CFD7D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6F2CC2BF07h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CFD934 second address: CFD939 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D01DE3 second address: D01DE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C8D5DB second address: C8D5DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD543D second address: CD5441 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D0660B second address: D0664D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2C525654h 0x00000007 jmp 00007F6F2C52564Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007F6F2C525658h 0x00000014 push ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D068E4 second address: D068F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F6F2CC2BEF6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D06A89 second address: D06A8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D06A8F second address: D06AA3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2CC2BEFCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D06C08 second address: D06C16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F6F2C525646h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D06DCA second address: D06DF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6F2CC2BEFDh 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6F2CC2BF06h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D06F6B second address: D06F78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F6F2C52564Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D06F78 second address: D06F80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D06F80 second address: D06F84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D06F84 second address: D06F8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D07108 second address: D0711E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6F2C525651h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D0711E second address: D0712F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F6F2CC2BEF6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D0712F second address: D07133 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D07133 second address: D07139 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D0742F second address: D07434 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D076D5 second address: D076DA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CB32DC second address: CB32E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C85121 second address: C85125 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C85125 second address: C85129 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D0AFCB second address: D0B023 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 jbe 00007F6F2CC2BEF6h 0x0000000b pop ecx 0x0000000c pushad 0x0000000d jmp 00007F6F2CC2BF06h 0x00000012 push edx 0x00000013 pop edx 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F6F2CC2BF09h 0x00000020 jmp 00007F6F2CC2BF03h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D11884 second address: D118A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jp 00007F6F2C525658h 0x0000000b jmp 00007F6F2C525652h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D10652 second address: D10657 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D10D0B second address: D10D15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F6F2C525646h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D10D15 second address: D10D1F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F6F2CC2BEF6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D10D1F second address: D10D53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6F2C525653h 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e jmp 00007F6F2C525653h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D10D53 second address: D10D57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D103AB second address: D103B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D10FF9 second address: D1102D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F6F2CC2BF11h 0x0000000e jmp 00007F6F2CC2BEFBh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D1102D second address: D11033 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D11033 second address: D11039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D11039 second address: D1103D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D11183 second address: D11190 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jp 00007F6F2CC2BEF8h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD741D second address: CD7495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 ja 00007F6F2C52564Eh 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F6F2C525648h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 js 00007F6F2C52564Ch 0x0000002d mov edx, dword ptr [ebp+122D350Eh] 0x00000033 lea eax, dword ptr [ebp+1248B16Ah] 0x00000039 push 00000000h 0x0000003b push edx 0x0000003c call 00007F6F2C525648h 0x00000041 pop edx 0x00000042 mov dword ptr [esp+04h], edx 0x00000046 add dword ptr [esp+04h], 00000016h 0x0000004e inc edx 0x0000004f push edx 0x00000050 ret 0x00000051 pop edx 0x00000052 ret 0x00000053 and cl, FFFFFFACh 0x00000056 xor edi, dword ptr [ebp+122D3BE2h] 0x0000005c nop 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 push esi 0x00000062 pop esi 0x00000063 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD7495 second address: CD7499 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD7499 second address: CD749F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD749F second address: CD74A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F6F2CC2BEF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD74A9 second address: CB27C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push esi 0x0000000b jmp 00007F6F2C52564Dh 0x00000010 pop esi 0x00000011 jnc 00007F6F2C52564Ch 0x00000017 popad 0x00000018 nop 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007F6F2C525648h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 00000014h 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 jmp 00007F6F2C525655h 0x00000038 call dword ptr [ebp+122D326Dh] 0x0000003e pushad 0x0000003f je 00007F6F2C525648h 0x00000045 pushad 0x00000046 popad 0x00000047 jmp 00007F6F2C525651h 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD76BF second address: CD76C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD7935 second address: CD793B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD7A19 second address: CD7A1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD7A1D second address: CD7A30 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2C52564Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD7A30 second address: CD7A44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6F2CC2BF00h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD7B5D second address: CD7B61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD7B61 second address: CD7B65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD7B65 second address: CD7B6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD7C91 second address: CD7CA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6F2CC2BEFDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD7CA2 second address: CD7CA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD7DDA second address: CD7DDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD7FF2 second address: CD8039 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F6F2C525653h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007F6F2C525648h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 00000014h 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 mov edi, 7F8DA274h 0x0000002d push 00000004h 0x0000002f movsx ecx, di 0x00000032 push eax 0x00000033 push eax 0x00000034 pushad 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD87A0 second address: CD87F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a popad 0x0000000b popad 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F6F2CC2BEF8h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 mov dword ptr [ebp+122D2A76h], ebx 0x0000002d jno 00007F6F2CC2BEFCh 0x00000033 lea eax, dword ptr [ebp+1248B1AEh] 0x00000039 xor cl, 00000006h 0x0000003c push eax 0x0000003d js 00007F6F2CC2BEFEh 0x00000043 push esi 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: CD87F7 second address: CB32E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov dword ptr [esp], eax 0x00000008 mov ecx, dword ptr [ebp+122D2D16h] 0x0000000e lea eax, dword ptr [ebp+1248B16Ah] 0x00000014 jmp 00007F6F2C525653h 0x00000019 push eax 0x0000001a push edi 0x0000001b push edi 0x0000001c jmp 00007F6F2C525650h 0x00000021 pop edi 0x00000022 pop edi 0x00000023 mov dword ptr [esp], eax 0x00000026 push 00000000h 0x00000028 push ebx 0x00000029 call 00007F6F2C525648h 0x0000002e pop ebx 0x0000002f mov dword ptr [esp+04h], ebx 0x00000033 add dword ptr [esp+04h], 00000019h 0x0000003b inc ebx 0x0000003c push ebx 0x0000003d ret 0x0000003e pop ebx 0x0000003f ret 0x00000040 jmp 00007F6F2C525655h 0x00000045 mov dword ptr [ebp+122D2A51h], ecx 0x0000004b call dword ptr [ebp+122D1AC0h] 0x00000051 pushad 0x00000052 ja 00007F6F2C52564Eh 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D1535E second address: D15370 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F6F2CC2BEF6h 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D154A8 second address: D154AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D15BB8 second address: D15BBE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D15BBE second address: D15BC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D15BC4 second address: D15BC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D15BC9 second address: D15BED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6F2C525657h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C88627 second address: C88642 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F6F2CC2BF00h 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D18F57 second address: D18F7A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2C525655h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007F6F2C525646h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D1B441 second address: D1B457 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F6F2CC2BEF8h 0x0000000c pushad 0x0000000d popad 0x0000000e jp 00007F6F2CC2BF02h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D1B457 second address: D1B45D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D1B45D second address: D1B46A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 je 00007F6F2CC2BEF6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D1B46A second address: D1B472 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D22389 second address: D22399 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6F2CC2BEFCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D22399 second address: D2239F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D2239F second address: D223A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D20EE7 second address: D20EED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D20EED second address: D20EFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jnl 00007F6F2CC2BEF6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D211FD second address: D21208 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D21208 second address: D2120C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D2120C second address: D21216 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D2139F second address: D213A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D259CA second address: D25A01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6F2C525659h 0x00000009 je 00007F6F2C525646h 0x0000000f jmp 00007F6F2C52564Fh 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D25A01 second address: D25A07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D25A07 second address: D25A2C instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6F2C525646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F6F2C525657h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D25BD6 second address: D25BDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D25BDC second address: D25BE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push edx 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D25FEB second address: D26007 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6F2CC2BF07h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D26007 second address: D26010 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D26010 second address: D2601B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ebx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D2977A second address: D29788 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6F2C525646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D29788 second address: D29793 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D29793 second address: D29797 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D2D90E second address: D2D914 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D2D914 second address: D2D95A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6F2C525652h 0x00000008 jg 00007F6F2C525646h 0x0000000e jmp 00007F6F2C525659h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F6F2C52564Fh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D354A9 second address: D354B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D354B7 second address: D35501 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 jmp 00007F6F2C52564Ch 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F6F2C525658h 0x00000017 ja 00007F6F2C525646h 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 jmp 00007F6F2C525650h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D3348A second address: D33494 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F6F2CC2BEF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D33494 second address: D33498 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D33498 second address: D3349E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D3349E second address: D334AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F6F2C52564Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D334AC second address: D334B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D334B2 second address: D334C6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e jnl 00007F6F2C525646h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D334C6 second address: D334D0 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6F2CC2BEF6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D334D0 second address: D334E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6F2C52564Dh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D33674 second address: D3367A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D3367A second address: D33680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D33680 second address: D3368B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D3368B second address: D33691 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D33D1B second address: D33D25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F6F2CC2BEF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D33D25 second address: D33D29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D33D29 second address: D33D2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D33FE5 second address: D33FFB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F6F2C525650h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D33FFB second address: D34005 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F6F2CC2BEF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D342FB second address: D3430F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007F6F2C52564Ch 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D3430F second address: D34317 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D34606 second address: D3460A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D3460A second address: D3461E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F6F2CC2BEF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jl 00007F6F2CC2BEFCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D3461E second address: D3464E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F6F2C525652h 0x0000000d jno 00007F6F2C525657h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D3464E second address: D34653 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D34653 second address: D34662 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F6F2C525646h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D34662 second address: D34666 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D34BA7 second address: D34BB1 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6F2C525646h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D351C7 second address: D351CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D351CD second address: D351D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D351D3 second address: D351D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D351D7 second address: D351DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D351DD second address: D35209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6F2CC2BEFEh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f jbe 00007F6F2CC2BEF6h 0x00000015 jnp 00007F6F2CC2BEF6h 0x0000001b pop eax 0x0000001c pushad 0x0000001d push ecx 0x0000001e pop ecx 0x0000001f push edx 0x00000020 pop edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D35209 second address: D35221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6F2C525651h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D3FBD3 second address: D3FBDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F6F2CC2BEF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D3FD17 second address: D3FD1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D3FD1D second address: D3FD4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F6F2CC2BF06h 0x0000000d popad 0x0000000e pushad 0x0000000f jmp 00007F6F2CC2BEFEh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D3FD4D second address: D3FD65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F6F2C52564Dh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D3FD65 second address: D3FD78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2CC2BEFFh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D3FEBC second address: D3FED2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F6F2C52564Ch 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D3FED2 second address: D3FEE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F6F2CC2BEF6h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D3FEE0 second address: D3FEF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D3FEF2 second address: D3FF27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6F2CC2BEFEh 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c jnl 00007F6F2CC2BEFAh 0x00000012 push eax 0x00000013 push edx 0x00000014 jns 00007F6F2CC2BEF6h 0x0000001a jmp 00007F6F2CC2BEFEh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D401A1 second address: D401A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D401A7 second address: D401AC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D46BA8 second address: D46BAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D46BAC second address: D46BC2 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6F2CC2BEF6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007F6F2CC2BEF6h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D46BC2 second address: D46BC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D46BC8 second address: D46BE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6F2CC2BEFFh 0x0000000d jp 00007F6F2CC2BEF6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D46BE5 second address: D46C0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2C525655h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007F6F2C52564Bh 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D46C0E second address: D46C16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D471C8 second address: D471D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D4757F second address: D47583 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D47823 second address: D4783D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2C525654h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D4783D second address: D47841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D47841 second address: D47861 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2C525656h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D47861 second address: D47867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D47867 second address: D4786F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D4786F second address: D47879 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D47A10 second address: D47A1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jbe 00007F6F2C525646h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D47A1F second address: D47A24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D47A24 second address: D47A2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F6F2C525646h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D48113 second address: D48130 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6F2CC2BF03h 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D48130 second address: D48136 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D48936 second address: D4895E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007F6F2CC2BEF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F6F2CC2BF09h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D4895E second address: D4896A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F6F2C525646h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D5015E second address: D50162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D4FBFB second address: D4FBFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D4FBFF second address: D4FC0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007F6F2CC2BEF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D4FEDA second address: D4FEDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D525CB second address: D525F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6F2CC2BF08h 0x0000000c jmp 00007F6F2CC2BEFAh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C941ED second address: C941F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D5DB8A second address: D5DB90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D5DB90 second address: D5DB94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D5DB94 second address: D5DB98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D5DB98 second address: D5DBA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F6F2C525648h 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D5F473 second address: D5F47D instructions: 0x00000000 rdtsc 0x00000002 je 00007F6F2CC2BEF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D64869 second address: D6486D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D684C8 second address: D684F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2CC2BF06h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007F6F2CC2BF08h 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 push edx 0x00000015 pop edx 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D681CE second address: D681E8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jp 00007F6F2C52564Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D681E8 second address: D681EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D681EC second address: D681F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D6D2CD second address: D6D2DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 je 00007F6F2CC2BEFCh 0x0000000b jnp 00007F6F2CC2BEF6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D6D2DE second address: D6D2F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2C525650h 0x00000007 push ebx 0x00000008 jg 00007F6F2C525646h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D7697C second address: D7699A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6F2CC2BF01h 0x00000009 pop esi 0x0000000a jo 00007F6F2CC2BF02h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D7699A second address: D769A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D79C61 second address: D79C65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D79C65 second address: D79C6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D79C6B second address: D79C8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F6F2CC2BF09h 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D802FC second address: D80306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D80420 second address: D80426 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D80426 second address: D80449 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6F2C525651h 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jbe 00007F6F2C525646h 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D80816 second address: D8081A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D8081A second address: D80833 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2C525654h 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D85566 second address: D8556C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D8556C second address: D85583 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2C525653h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D85583 second address: D85589 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D85589 second address: D8558F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D8505D second address: D85071 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007F6F2CC2BEFCh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D85071 second address: D8508E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2C52564Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e jns 00007F6F2C525646h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D8508E second address: D850AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007F6F2CC2BF01h 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop ecx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D850AC second address: D850B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D850B2 second address: D850BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007F6F2CC2BEF6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D850BF second address: D850C5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D8522E second address: D85238 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6F2CC2BEF6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D85238 second address: D85243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D889EC second address: D889F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D9A2E0 second address: D9A2F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6F2C52564Ah 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D9A2F0 second address: D9A2F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D9A2F4 second address: D9A323 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6F2C525659h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f jmp 00007F6F2C52564Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: D9A323 second address: D9A32D instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6F2CC2BEF6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C8F11B second address: C8F121 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: C8F121 second address: C8F12C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: DA844F second address: DA8476 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6F2C52564Dh 0x00000009 jno 00007F6F2C525653h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: DA7FDB second address: DA7FE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 je 00007F6F2CC2BEF6h 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: DCB8F8 second address: DCB90A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F6F2C525646h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: DCA786 second address: DCA7A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2CC2BF07h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: DCA8E3 second address: DCA91D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6F2C525654h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jmp 00007F6F2C525650h 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F6F2C52564Ah 0x0000001b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: DCAA87 second address: DCAA8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: DCAA8F second address: DCAA93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: DCAA93 second address: DCAAB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jmp 00007F6F2CC2BF06h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: DCAAB8 second address: DCAAC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007F6F2C525646h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: DCAAC5 second address: DCAADD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2CC2BF04h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: DCAF54 second address: DCAF59 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: DCB0C9 second address: DCB0E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2CC2BF05h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: DCB0E3 second address: DCB0E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: DCB0E9 second address: DCB0FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F6F2CC2BEF6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: DCB0FD second address: DCB101 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: DCB101 second address: DCB107 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: DCB3E2 second address: DCB407 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007F6F2C52564Bh 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 jng 00007F6F2C525646h 0x0000001a pop ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e pop eax 0x0000001f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: DCB407 second address: DCB424 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2CC2BEFDh 0x00000007 jmp 00007F6F2CC2BEFCh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: DCB424 second address: DCB429 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: DCD016 second address: DCD01B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: DCD01B second address: DCD027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F6F2C525646h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: DCE748 second address: DCE74E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: DCE74E second address: DCE764 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F6F2C525650h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: DD2742 second address: DD2755 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007F6F2CC2BEFCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: DD2755 second address: DD2759 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: DD2759 second address: DD2763 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6F2CC2BEFCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: DD43E7 second address: DD43ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: DD43ED second address: DD43F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: DD43F1 second address: DD4432 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6F2C525655h 0x0000000b jmp 00007F6F2C52564Eh 0x00000010 jmp 00007F6F2C52564Eh 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jc 00007F6F2C525646h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C70807 second address: 4C70835 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2CC2BEFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F6F2CC2BF06h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C70835 second address: 4C70852 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2C525659h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C70852 second address: 4C70858 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C70858 second address: 4C7085C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C7085C second address: 4C7086B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C7086B second address: 4C7086F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C7086F second address: 4C70875 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C40246 second address: 4C4024A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C4024A second address: 4C40250 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C40250 second address: 4C402B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, esi 0x00000005 pushfd 0x00000006 jmp 00007F6F2C52564Ah 0x0000000b sub cl, FFFFFFE8h 0x0000000e jmp 00007F6F2C52564Bh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 jmp 00007F6F2C525656h 0x0000001d push eax 0x0000001e pushad 0x0000001f movsx ebx, cx 0x00000022 pushfd 0x00000023 jmp 00007F6F2C52564Ah 0x00000028 sbb eax, 797CA778h 0x0000002e jmp 00007F6F2C52564Bh 0x00000033 popfd 0x00000034 popad 0x00000035 xchg eax, ebp 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 mov edi, 443C7966h 0x0000003e pushad 0x0000003f popad 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C402B8 second address: 4C402BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C402BE second address: 4C4031A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2C525654h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F6F2C52564Eh 0x00000014 jmp 00007F6F2C525655h 0x00000019 popfd 0x0000001a pushad 0x0000001b jmp 00007F6F2C52564Dh 0x00000020 popad 0x00000021 popad 0x00000022 pop ebp 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 pushad 0x00000027 popad 0x00000028 mov cx, di 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CB0833 second address: 4CB0837 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CB0837 second address: 4CB083B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CB083B second address: 4CB0841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CB0841 second address: 4CB0890 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6F2C525658h 0x00000009 xor cx, C1F8h 0x0000000e jmp 00007F6F2C52564Bh 0x00000013 popfd 0x00000014 mov dx, cx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F6F2C525657h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CB0890 second address: 4CB08AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2CC2BF09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CB08AD second address: 4CB08E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 4D82h 0x00000007 pushfd 0x00000008 jmp 00007F6F2C525653h 0x0000000d jmp 00007F6F2C525653h 0x00000012 popfd 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 xchg eax, ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CB08E6 second address: 4CB0901 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2CC2BF07h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CB0901 second address: 4CB0907 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CB0907 second address: 4CB091D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6F2CC2BEFAh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C30DB9 second address: 4C30DF1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2C52564Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F6F2C525656h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F6F2C52564Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C30DF1 second address: 4C30E06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2CC2BF01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C30E06 second address: 4C30E0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C30E0C second address: 4C30E2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F6F2CC2BEFFh 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C30E2C second address: 4C30E30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C30E30 second address: 4C30E4B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2CC2BF07h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CB0548 second address: 4CB055A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, A7h 0x00000005 mov ax, dx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CB055A second address: 4CB0560 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CB0560 second address: 4CB0566 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CB0566 second address: 4CB056A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CB056A second address: 4CB05BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e call 00007F6F2C52564Fh 0x00000013 pop ecx 0x00000014 pushfd 0x00000015 jmp 00007F6F2C525659h 0x0000001a add ax, 9F26h 0x0000001f jmp 00007F6F2C525651h 0x00000024 popfd 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C80C05 second address: 4C80C97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2CC2BF09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F6F2CC2BEFEh 0x0000000f push eax 0x00000010 jmp 00007F6F2CC2BEFBh 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 mov cl, BAh 0x00000019 mov cl, dl 0x0000001b popad 0x0000001c mov ebp, esp 0x0000001e jmp 00007F6F2CC2BF08h 0x00000023 pop ebp 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007F6F2CC2BEFDh 0x0000002d sbb ah, 00000026h 0x00000030 jmp 00007F6F2CC2BF01h 0x00000035 popfd 0x00000036 call 00007F6F2CC2BF00h 0x0000003b pop eax 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CD06D3 second address: 4CD06D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CD06D9 second address: 4CD06DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CD06DD second address: 4CD06E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CC0019 second address: 4CC001D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CC001D second address: 4CC0023 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CC0023 second address: 4CC0032 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6F2CC2BEFBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C409A8 second address: 4C409D3 instructions: 0x00000000 rdtsc 0x00000002 mov di, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebx, esi 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c mov ch, 79h 0x0000000e popad 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F6F2C525657h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C409D3 second address: 4C409D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CB0635 second address: 4CB06A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6F2C52564Fh 0x00000009 xor ecx, 04B3E27Eh 0x0000000f jmp 00007F6F2C525659h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F6F2C525650h 0x0000001b adc eax, 7C0E2578h 0x00000021 jmp 00007F6F2C52564Bh 0x00000026 popfd 0x00000027 popad 0x00000028 pop edx 0x00000029 pop eax 0x0000002a xchg eax, ebp 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F6F2C525655h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CB06A6 second address: 4CB06D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2CC2BF01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F6F2CC2BF01h 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CB06D4 second address: 4CB06D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CB06D8 second address: 4CB06DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CB06DE second address: 4CB06E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CB0E1F second address: 4CB0E23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CB0E23 second address: 4CB0E29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CB0E29 second address: 4CB0E33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 010D0C03h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CB0E33 second address: 4CB0EA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 jmp 00007F6F2C525654h 0x0000000d mov ebp, esp 0x0000000f pushad 0x00000010 mov edx, ecx 0x00000012 jmp 00007F6F2C52564Ah 0x00000017 popad 0x00000018 mov eax, dword ptr [ebp+08h] 0x0000001b jmp 00007F6F2C525650h 0x00000020 and dword ptr [eax], 00000000h 0x00000023 jmp 00007F6F2C525650h 0x00000028 and dword ptr [eax+04h], 00000000h 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f mov ecx, edx 0x00000031 jmp 00007F6F2C525659h 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CB0EA8 second address: 4CB0EAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CB0EAE second address: 4CB0EB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CB0EB2 second address: 4CB0ECF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6F2CC2BF02h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C80B1E second address: 4C80B22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C80B22 second address: 4C80B28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C80B28 second address: 4C80B2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C80B2E second address: 4C80B47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2CC2BEFDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C80B47 second address: 4C80B7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F6F2C525659h 0x0000000a sub ax, 7486h 0x0000000f jmp 00007F6F2C525651h 0x00000014 popfd 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C80B7D second address: 4C80BA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, A4C2h 0x00000007 movsx edi, ax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f pushad 0x00000010 mov edi, 0B15C5D4h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 mov bh, 93h 0x0000001a popad 0x0000001b xchg eax, ebp 0x0000001c pushad 0x0000001d mov si, 5017h 0x00000021 movzx esi, di 0x00000024 popad 0x00000025 mov ebp, esp 0x00000027 pushad 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C80BA8 second address: 4C80BC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cl, dh 0x00000006 popad 0x00000007 push eax 0x00000008 movsx edx, cx 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F6F2C52564Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CC0233 second address: 4CC0239 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CC0239 second address: 4CC023F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CC023F second address: 4CC0243 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CC0243 second address: 4CC029A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b pushad 0x0000000c call 00007F6F2C525652h 0x00000011 mov ch, C3h 0x00000013 pop edi 0x00000014 mov bx, cx 0x00000017 popad 0x00000018 mov ebp, esp 0x0000001a pushad 0x0000001b mov si, 336Bh 0x0000001f popad 0x00000020 pop ebp 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 pushfd 0x00000025 jmp 00007F6F2C525656h 0x0000002a add al, 00000028h 0x0000002d jmp 00007F6F2C52564Bh 0x00000032 popfd 0x00000033 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CD001B second address: 4CD0082 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop eax 0x00000005 pushfd 0x00000006 jmp 00007F6F2CC2BEFBh 0x0000000b sbb ecx, 061EB04Eh 0x00000011 jmp 00007F6F2CC2BF09h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b jmp 00007F6F2CC2BEFEh 0x00000020 push eax 0x00000021 jmp 00007F6F2CC2BEFBh 0x00000026 xchg eax, ebp 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F6F2CC2BF05h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CD0082 second address: 4CD011A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2C525651h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F6F2C52564Ch 0x00000012 add cl, FFFFFF88h 0x00000015 jmp 00007F6F2C52564Bh 0x0000001a popfd 0x0000001b jmp 00007F6F2C525658h 0x00000020 popad 0x00000021 xchg eax, ecx 0x00000022 jmp 00007F6F2C525650h 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b pushfd 0x0000002c jmp 00007F6F2C52564Ch 0x00000031 or ah, 00000048h 0x00000034 jmp 00007F6F2C52564Bh 0x00000039 popfd 0x0000003a call 00007F6F2C525658h 0x0000003f pop eax 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CD011A second address: 4CD0146 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, esi 0x00000005 movzx eax, di 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ecx 0x0000000c pushad 0x0000000d mov si, dx 0x00000010 mov dl, B9h 0x00000012 popad 0x00000013 mov eax, dword ptr [76FA65FCh] 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F6F2CC2BF00h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CD0146 second address: 4CD0155 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2C52564Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CD0155 second address: 4CD01D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2CC2BF09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b jmp 00007F6F2CC2BEFEh 0x00000010 je 00007F6F9EE7F6DAh 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F6F2CC2BEFEh 0x0000001d add al, FFFFFFF8h 0x00000020 jmp 00007F6F2CC2BEFBh 0x00000025 popfd 0x00000026 pushfd 0x00000027 jmp 00007F6F2CC2BF08h 0x0000002c sub ch, 00000058h 0x0000002f jmp 00007F6F2CC2BEFBh 0x00000034 popfd 0x00000035 popad 0x00000036 mov ecx, eax 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CD01D8 second address: 4CD01DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CD01DE second address: 4CD0215 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2CC2BEFAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor eax, dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d jmp 00007F6F2CC2BF07h 0x00000012 mov cx, 3EDFh 0x00000016 popad 0x00000017 and ecx, 1Fh 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CD0215 second address: 4CD021B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4CC040A second address: 4CC0411 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dh, FBh 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C8001F second address: 4C80025 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C80025 second address: 4C8009C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop edi 0x00000005 pushfd 0x00000006 jmp 00007F6F2CC2BF06h 0x0000000b sbb ecx, 70953298h 0x00000011 jmp 00007F6F2CC2BEFBh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b pushad 0x0000001c mov bx, cx 0x0000001f mov edi, eax 0x00000021 popad 0x00000022 push eax 0x00000023 jmp 00007F6F2CC2BEFDh 0x00000028 xchg eax, ebp 0x00000029 pushad 0x0000002a jmp 00007F6F2CC2BEFCh 0x0000002f push esi 0x00000030 jmp 00007F6F2CC2BF01h 0x00000035 pop eax 0x00000036 popad 0x00000037 mov ebp, esp 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F6F2CC2BEFAh 0x00000040 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C8009C second address: 4C800A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C800A2 second address: 4C800A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C800A6 second address: 4C800C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2C52564Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and esp, FFFFFFF8h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov cl, dh 0x00000013 mov ebx, esi 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C800C4 second address: 4C8010B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6F2CC2BF07h 0x00000009 xor esi, 6E1D302Eh 0x0000000f jmp 00007F6F2CC2BF09h 0x00000014 popfd 0x00000015 mov dx, cx 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, ecx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C8010B second address: 4C80132 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F6F2C525655h 0x0000000a jmp 00007F6F2C52564Bh 0x0000000f popfd 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C80132 second address: 4C80138 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C80138 second address: 4C8013C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C8013C second address: 4C80153 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2CC2BEFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C80153 second address: 4C8017B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F6F2C525650h 0x0000000a and esi, 3294F268h 0x00000010 jmp 00007F6F2C52564Bh 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C8017B second address: 4C801D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6F2CC2BEFFh 0x00000009 sbb cx, 05AEh 0x0000000e jmp 00007F6F2CC2BF09h 0x00000013 popfd 0x00000014 mov ax, F237h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, ecx 0x0000001c jmp 00007F6F2CC2BEFAh 0x00000021 xchg eax, ebx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F6F2CC2BF07h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C801D9 second address: 4C80205 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2C525659h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6F2C52564Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C80205 second address: 4C8020A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C8020A second address: 4C80268 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov di, 5932h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F6F2C525652h 0x00000015 sub cx, EE48h 0x0000001a jmp 00007F6F2C52564Bh 0x0000001f popfd 0x00000020 pushfd 0x00000021 jmp 00007F6F2C525658h 0x00000026 sbb si, 30A8h 0x0000002b jmp 00007F6F2C52564Bh 0x00000030 popfd 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C80268 second address: 4C80271 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 234Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C80271 second address: 4C80280 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebx, dword ptr [ebp+10h] 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C80280 second address: 4C80284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C80284 second address: 4C802E4 instructions: 0x00000000 rdtsc 0x00000002 movsx edi, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 movzx esi, bx 0x0000000a popad 0x0000000b push ecx 0x0000000c jmp 00007F6F2C52564Ah 0x00000011 mov dword ptr [esp], esi 0x00000014 pushad 0x00000015 mov bx, ax 0x00000018 mov esi, 34A3BE49h 0x0000001d popad 0x0000001e mov esi, dword ptr [ebp+08h] 0x00000021 jmp 00007F6F2C525654h 0x00000026 xchg eax, edi 0x00000027 jmp 00007F6F2C525650h 0x0000002c push eax 0x0000002d jmp 00007F6F2C52564Bh 0x00000032 xchg eax, edi 0x00000033 pushad 0x00000034 movzx esi, dx 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C802E4 second address: 4C802E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C802E8 second address: 4C8030F instructions: 0x00000000 rdtsc 0x00000002 mov eax, edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 test esi, esi 0x00000009 jmp 00007F6F2C52564Fh 0x0000000e je 00007F6F9E7C395Bh 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 push edx 0x00000018 pop eax 0x00000019 mov si, bx 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C8030F second address: 4C8036B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F6F2CC2BF06h 0x00000008 pop ecx 0x00000009 mov si, di 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f cmp dword ptr [esi+08h], DDEEDDEEh 0x00000016 jmp 00007F6F2CC2BEFDh 0x0000001b je 00007F6F9EECA1DEh 0x00000021 pushad 0x00000022 push esi 0x00000023 movsx edi, ax 0x00000026 pop esi 0x00000027 movsx edi, cx 0x0000002a popad 0x0000002b mov edx, dword ptr [esi+44h] 0x0000002e jmp 00007F6F2CC2BEFCh 0x00000033 or edx, dword ptr [ebp+0Ch] 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C8036B second address: 4C80371 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C80371 second address: 4C80377 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C80377 second address: 4C8037B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C8037B second address: 4C803C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test edx, 61000000h 0x0000000e jmp 00007F6F2CC2BEFAh 0x00000013 jne 00007F6F9EECA1EBh 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F6F2CC2BEFDh 0x00000022 or cx, 7516h 0x00000027 jmp 00007F6F2CC2BF01h 0x0000002c popfd 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C90069 second address: 4C90089 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2C525651h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f mov ecx, 39662519h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C90089 second address: 4C90139 instructions: 0x00000000 rdtsc 0x00000002 movzx eax, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 call 00007F6F2CC2BEFBh 0x0000000c mov ch, AEh 0x0000000e pop edi 0x0000000f popad 0x00000010 mov ebp, esp 0x00000012 pushad 0x00000013 jmp 00007F6F2CC2BEFEh 0x00000018 call 00007F6F2CC2BF02h 0x0000001d pushfd 0x0000001e jmp 00007F6F2CC2BF02h 0x00000023 sbb ch, 00000038h 0x00000026 jmp 00007F6F2CC2BEFBh 0x0000002b popfd 0x0000002c pop esi 0x0000002d popad 0x0000002e and esp, FFFFFFF8h 0x00000031 jmp 00007F6F2CC2BEFFh 0x00000036 xchg eax, ebx 0x00000037 pushad 0x00000038 mov eax, 623A187Bh 0x0000003d pushfd 0x0000003e jmp 00007F6F2CC2BF00h 0x00000043 sub si, 55C8h 0x00000048 jmp 00007F6F2CC2BEFBh 0x0000004d popfd 0x0000004e popad 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007F6F2CC2BF04h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C90139 second address: 4C9013E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C901DB second address: 4C901F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6F2CC2BF03h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C901F2 second address: 4C90258 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6F2C52564Fh 0x00000009 xor ah, 0000004Eh 0x0000000c jmp 00007F6F2C525659h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007F6F2C525650h 0x00000018 jmp 00007F6F2C525655h 0x0000001d popfd 0x0000001e popad 0x0000001f pop edx 0x00000020 pop eax 0x00000021 je 00007F6F9E7AB788h 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	RDTSC instruction interceptor: First address: 4C90258 second address: 4C9025C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Special instruction interceptor: First address: B1FEEF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Special instruction interceptor: First address: CC4897 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Special instruction interceptor: First address: CD7626 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Special instruction interceptor: First address: D578EE instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: BFFEEF instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: DA4897 instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: DB7626 instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: E378EE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: AAFEEF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: C54897 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: C67626 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: CE78EE instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe

Code function: 0_2_04D00A81 rdtsc

0_2_04D00A81

Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Window / User API: threadDelayed 1193	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Window / User API: threadDelayed 1211	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 367	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 455	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 358	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1174	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1242	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1184	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1169	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1173	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1184	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1148	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe TID: 4368	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe TID: 1412	Thread sleep count: 1193 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe TID: 1412	Thread sleep time: -2387193s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe TID: 2360	Thread sleep count: 98 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe TID: 4456	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe TID: 2360	Thread sleep count: 212 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe TID: 5804	Thread sleep count: 214 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe TID: 4752	Thread sleep count: 1211 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe TID: 4752	Thread sleep time: -2423211s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 2576	Thread sleep count: 101 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 2576	Thread sleep time: -202101s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1848	Thread sleep count: 66 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1848	Thread sleep time: -132066s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6552	Thread sleep count: 45 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6552	Thread sleep count: 330 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6552	Thread sleep time: -33330s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7312	Thread sleep count: 367 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7312	Thread sleep count: 70 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5836	Thread sleep count: 113 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5836	Thread sleep time: -226113s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 2300	Thread sleep count: 120 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 2300	Thread sleep time: -240120s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7184	Thread sleep count: 149 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7184	Thread sleep time: -298149s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7136	Thread sleep count: 42 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 2072	Thread sleep count: 116 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 2072	Thread sleep time: -232116s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7136	Thread sleep count: 455 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7136	Thread sleep time: -45955s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7308	Thread sleep count: 358 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7308	Thread sleep count: 90 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1576	Thread sleep count: 125 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1576	Thread sleep time: -250125s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3292	Thread sleep count: 72 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3292	Thread sleep time: -144072s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1272	Thread sleep count: 69 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1272	Thread sleep time: -138069s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7172	Thread sleep count: 74 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7172	Thread sleep time: -148074s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7376	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7376	Thread sleep time: -68034s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7352	Thread sleep count: 1174 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7352	Thread sleep time: -2349174s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7328	Thread sleep count: 83 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7328	Thread sleep count: 230 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7544	Thread sleep count: 227 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7364	Thread sleep count: 1242 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7364	Thread sleep time: -2485242s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7372	Thread sleep count: 1184 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7372	Thread sleep time: -2369184s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7360	Thread sleep count: 1169 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7360	Thread sleep time: -2339169s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7712	Thread sleep time: -60030s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7692	Thread sleep count: 1173 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7692	Thread sleep time: -2347173s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7656	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7656	Thread sleep count: 245 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7792	Thread sleep count: 234 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7700	Thread sleep count: 1184 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7700	Thread sleep time: -2369184s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7708	Thread sleep count: 1148 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7708	Thread sleep time: -2297148s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed

Source: RageMP131.exe, RageMP131.exe, 0000000A.00000002.3307579783.0000000000C31000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: LisectAVT_2403002A_218.exe, 00000000.00000002.3306150889.000000000053C000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&00
Source: RageMP131.exe, 00000008.00000002.3307041255.000000000080E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}G
Source: RageMP131.exe, 0000000A.00000003.2283094806.0000000000742000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 00000007.00000002.3308650896.00000000015C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_78D81E37
Source: RageMP131.exe, 0000000A.00000002.3306406019.000000000070B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&-
Source: MPGPH131.exe, 00000006.00000002.3306495921.0000000000815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 00000006.00000002.3306381357.00000000006FD000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\|
Source: MPGPH131.exe, 00000006.00000002.3306495921.0000000000815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f5
Source: RageMP131.exe, 00000008.00000002.3306473370.00000000004FD000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}0
Source: RageMP131.exe, 0000000A.00000003.2283094806.0000000000742000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 00000007.00000002.3308650896.00000000015BD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlla
Source: RageMP131.exe, 00000008.00000002.3307041255.000000000080E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}ywWJ\
Source: MPGPH131.exe, 00000006.00000002.3306495921.0000000000803000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: RageMP131.exe, 00000008.00000002.3307041255.0000000000855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_78D81E37
Source: RageMP131.exe, 0000000A.00000002.3306406019.000000000070B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll$
Source: MPGPH131.exe, 00000007.00000002.3308650896.00000000015BD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: RageMP131.exe, 0000000A.00000002.3306406019.000000000070B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}*
Source: LisectAVT_2403002A_218.exe, 00000000.00000002.3306620800.00000000008B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: LisectAVT_2403002A_218.exe, 00000000.00000002.3306620800.00000000008F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: LisectAVT_2403002A_218.exe, 00000000.00000002.3306620800.00000000008F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll-
Source: MPGPH131.exe, 00000006.00000002.3306495921.0000000000815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 00000007.00000002.3308262965.000000000116D000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}Y
Source: RageMP131.exe, 00000008.00000002.3307041255.0000000000844000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllF
Source: RageMP131.exe, 0000000A.00000002.3306406019.000000000070B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}V
Source: LisectAVT_2403002A_218.exe, 00000000.00000002.3306620800.00000000008B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}dul
Source: MPGPH131.exe, 00000006.00000002.3306495921.0000000000815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: }-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f5
Source: LisectAVT_2403002A_218.exe, 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.3307631002.0000000000D81000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000002.3306828991.0000000000D81000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.3308181266.0000000000C31000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000002.3307579783.0000000000C31000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: RageMP131.exe, 00000008.00000002.3307041255.0000000000800000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000

Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Thread information set: HideFromDebugger	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe

Code function: 0_2_04D00A81 rdtsc

0_2_04D00A81

Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00A43A40 mov eax, dword ptr fs:[00000030h]	0_2_00A43A40
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_00A43A40 mov eax, dword ptr fs:[00000030h]	0_2_00A43A40
Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Code function: 0_2_009F4100 mov eax, dword ptr fs:[00000030h]	0_2_009F4100
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00B23A40 mov eax, dword ptr fs:[00000030h]	6_2_00B23A40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00B23A40 mov eax, dword ptr fs:[00000030h]	6_2_00B23A40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00AD4100 mov eax, dword ptr fs:[00000030h]	6_2_00AD4100
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00B23A40 mov eax, dword ptr fs:[00000030h]	7_2_00B23A40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00B23A40 mov eax, dword ptr fs:[00000030h]	7_2_00B23A40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00AD4100 mov eax, dword ptr fs:[00000030h]	7_2_00AD4100
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_009D3A40 mov eax, dword ptr fs:[00000030h]	8_2_009D3A40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_009D3A40 mov eax, dword ptr fs:[00000030h]	8_2_009D3A40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00984100 mov eax, dword ptr fs:[00000030h]	8_2_00984100
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_009D3A40 mov eax, dword ptr fs:[00000030h]	10_2_009D3A40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_009D3A40 mov eax, dword ptr fs:[00000030h]	10_2_009D3A40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00984100 mov eax, dword ptr fs:[00000030h]	10_2_00984100

Source: LisectAVT_2403002A_218.exe, LisectAVT_2403002A_218.exe, 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, RageMP131.exe, RageMP131.exe, 0000000A.00000002.3307579783.0000000000C31000.00000040.00000001.01000000.00000006.sdmp

Binary or memory string: 1RProgram Manager

Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe

Code function: 0_2_00ABF26A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_00ABF26A

Source: C:\Users\user\Desktop\LisectAVT_2403002A_218.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected RisePro Stealer

Source: Yara match	File source: 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2109410350.00000000052E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2038565636.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2262402855.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2108165970.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2182379846.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_218.exe PID: 3596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 4580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 2656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7324, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7652, type: MEMORYSTR

Remote Access Functionality

Yara detected RisePro Stealer

Source: Yara match	File source: 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2109410350.00000000052E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2038565636.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2262402855.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2108165970.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2182379846.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_218.exe PID: 3596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 4580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 2656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7324, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7652, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	2 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	24 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	2 Process Injection	Security Account Manager	24 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	214 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
LisectAVT_2403002A_218.exe	100%	Avira	TR/Redcap.iodtu
LisectAVT_2403002A_218.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	100%	Avira	TR/Redcap.iodtu
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Avira	TR/Redcap.iodtu
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.winimage.com/zLibDll	0%	URL Reputation	safe
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORTd	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORT	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	LisectAVT_2403002A_218.exe, 00000000.00000003.2038565636.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002A_218.exe, 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000006.00000003.2108165970.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000003.2109410350.00000000052E0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000008.00000003.2182379846.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000003.2262402855.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDll	LisectAVT_2403002A_218.exe, 00000000.00000003.2038565636.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002A_218.exe, 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000006.00000003.2108165970.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000003.2109410350.00000000052E0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000008.00000003.2182379846.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000003.2262402855.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://t.me/RiseProSUPPORT	LisectAVT_2403002A_218.exe, 00000000.00000002.3306620800.00000000008BE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3306495921.00000000007CD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3308650896.000000000159B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3307041255.000000000080E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.3306406019.000000000070B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORTd	LisectAVT_2403002A_218.exe, 00000000.00000002.3306620800.00000000008BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.233.132.74	unknown	Russian Federation		2895	FREE-NET-ASFREEnetEU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1482410
Start date and time:	2024-07-25 22:34:39 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LisectAVT_2403002A_218.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@11/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: LisectAVT_2403002A_218.exe

Simulations

Behavior and APIs

Time	Type	Description
16:35:59	API Interceptor	1507066x Sleep call for process: LisectAVT_2403002A_218.exe modified
16:36:06	API Interceptor	3435x Sleep call for process: MPGPH131.exe modified
16:36:13	API Interceptor	1224678x Sleep call for process: RageMP131.exe modified
22:35:34	Task Scheduler	Run new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
22:35:34	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
22:35:35	Task Scheduler	Run new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
22:35:43	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
193.233.132.74	LisectAVT_2403002A_228.exe	Get hash	malicious	RisePro Stealer	Browse
	LisectAVT_2403002A_376.exe	Get hash	malicious	RisePro Stealer	Browse
	LisectAVT_2403002B_242.exe	Get hash	malicious	RisePro Stealer	Browse
	LisectAVT_2403002A_224.exe	Get hash	malicious	RisePro Stealer	Browse
	80OrFCsz0u.exe	Get hash	malicious	GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse
	SecuriteInfo.com.Win64.Evo-gen.28136.30716.exe	Get hash	malicious	GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse
	file.exe	Get hash	malicious	RisePro Stealer	Browse
	vGDqFBB1Jz.exe	Get hash	malicious	RisePro Stealer	Browse
	iKV7MCWDJF.exe	Get hash	malicious	RisePro Stealer	Browse
	8TFD6H44Pz.exe	Get hash	malicious	RisePro Stealer	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FREE-NET-ASFREEnetEU	LisectAVT_2403002A_228.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.74
	LisectAVT_2403002A_30.exe	Get hash	malicious	Amadey	Browse	193.233.132.56
	LisectAVT_2403002A_33.exe	Get hash	malicious	Amadey	Browse	193.233.132.56
	LisectAVT_2403002A_376.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.74
	LisectAVT_2403002A_389.exe	Get hash	malicious	Amadey	Browse	193.233.132.56
	LisectAVT_2403002A_419.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.67
	LisectAVT_2403002A_419.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.67
	LisectAVT_2403002A_464.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.109
	LisectAVT_2403002A_464.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.109
	LisectAVT_2403002A_79.exe	Get hash	malicious	Amadey	Browse	193.233.132.56

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_218.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2343431
Entropy (8bit):	7.968148546076954
Encrypted:	false
SSDEEP:	49152:CpzidCiuvctbVbLnkCUJeKDHkQ9bQEc9DQ33/XWfup14n9Od:ogFlbVb7Ke6H9bQ3DQ+fEOO
MD5:	6B79EBBF323BC3F77FB55112E9110F12
SHA1:	764F8EF62FCBAE36F7AA89E7766C171A2CB0D658
SHA-256:	B0F736A2FF992A8ADC9FE5186368EF213B16CDF26ACDE6DE7A6EC7DD9EFA14FD
SHA-512:	E83EF6B9352599A8C0B677F61DC061C89DCD8F45C679533D15219F06EF282E94D1D574D5BBF7798952F091380853A299BCA24B7A7CE6512CB6A71694498FF058
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$......."...f.{Tf.{Tf.{T-.xUk.{T-.~U..{T-.\|Ug.{T)..Tb.{T)..Ut.{T).xUq.{T).~U3.{T-..U..{T-.}Ug.{T-.zU}.{Tf.zT@.{T..rUz.{T..{Ug.{T...Tg.{Tf..Tg.{T..yUg.{TRichf.{T................PE..L.....e...............".....0........Z...........@...........................Z.......$...@.........................tmZ.L...U...i.......X+.......................................................................................................... . .p..........................@....rsrc...X+..........................@....idata ............."..............@... .@,..........$..............@...ixqntyfn......@......&..............@...fwmicjtz......Z.......#.............@...........................................................................................................................................................................................................................

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_218.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_218.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2343431
Entropy (8bit):	7.968148546076954
Encrypted:	false
SSDEEP:	49152:CpzidCiuvctbVbLnkCUJeKDHkQ9bQEc9DQ33/XWfup14n9Od:ogFlbVb7Ke6H9bQ3DQ+fEOO
MD5:	6B79EBBF323BC3F77FB55112E9110F12
SHA1:	764F8EF62FCBAE36F7AA89E7766C171A2CB0D658
SHA-256:	B0F736A2FF992A8ADC9FE5186368EF213B16CDF26ACDE6DE7A6EC7DD9EFA14FD
SHA-512:	E83EF6B9352599A8C0B677F61DC061C89DCD8F45C679533D15219F06EF282E94D1D574D5BBF7798952F091380853A299BCA24B7A7CE6512CB6A71694498FF058
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$......."...f.{Tf.{Tf.{T-.xUk.{T-.~U..{T-.\|Ug.{T)..Tb.{T)..Ut.{T).xUq.{T).~U3.{T-..U..{T-.}Ug.{T-.zU}.{Tf.zT@.{T..rUz.{T..{Ug.{T...Tg.{Tf..Tg.{T..yUg.{TRichf.{T................PE..L.....e...............".....0........Z...........@...........................Z.......$...@.........................tmZ.L...U...i.......X+.......................................................................................................... . .p..........................@....rsrc...X+..........................@....idata ............."..............@... .@,..........$..............@...ixqntyfn......@......&..............@...fwmicjtz......Z.......#.............@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_218.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_218.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	13
Entropy (8bit):	2.8731406795131336
Encrypted:	false
SSDEEP:	3:LE6:T
MD5:	E2362ACA25F39E284E6E9D2F9B30F59F
SHA1:	257B9A745CE7E7146DECF3BAC12D9E06E1425BCF
SHA-256:	4D8C2EB9746A578F0EB4EBA37463B575CB57BB6DC6BE5C7FCE9CF30A594E7564
SHA-512:	C8E3956EB5A816F4E8C668503999C87ADCEF8C1DEF703783201D03E7B8AA4CC3786FBE5AE546BF4ED24E028B94B78115A2AE6C3AD674DE9EA0FB5FBC66615664
Malicious:	false
Reputation:	low
Preview:	1721943720415

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.968148546076954
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	LisectAVT_2403002A_218.exe
File size:	2'343'431 bytes
MD5:	6b79ebbf323bc3f77fb55112e9110f12
SHA1:	764f8ef62fcbae36f7aa89e7766c171a2cb0d658
SHA256:	b0f736a2ff992a8adc9fe5186368ef213b16cdf26acde6de7a6ec7dd9efa14fd
SHA512:	e83ef6b9352599a8c0b677f61dc061c89dcd8f45c679533d15219f06ef282e94d1d574d5bbf7798952f091380853a299bca24b7a7ce6512cb6a71694498ff058
SSDEEP:	49152:CpzidCiuvctbVbLnkCUJeKDHkQ9bQEc9DQ33/XWfup14n9Od:ogFlbVb7Ke6H9bQ3DQ+fEOO
TLSH:	A2B533B6966772AECD0A8FB1143257032E91BF805364F28E0CD67F9F791B3598306DA1
File Content Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$......."...f.{Tf.{Tf.{T-.xUk.{T-.~U..{T-.\|Ug.{T)..Tb.{T)..Ut.{T).xUq.{T).~U3.{T-..U..{T-.}Ug.{T-.zU}.{Tf.zT@.{T..rUz.{T..{Ug.{T...Tg.{

File Icon


Icon Hash:	c769eccc64f6e2bb

Static PE Info

General

Entrypoint:	0x9aa000
Entrypoint Section:	fwmicjtz
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x65FE94C6 [Sat Mar 23 08:37:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
push edx
mov dword ptr [esp], 3FBEF12Ch
shr dword ptr [esp], 08h
xor dword ptr [esp], 6D29DE47h
mov dword ptr [esp], esi
sub esp, 00000004h
mov dword ptr [esp], esi
mov dword ptr [esp], 76801F97h
mov dword ptr [esp], eax
push ecx
mov dword ptr [esp], edx
mov edx, esp
add edx, 00000004h
sub edx, 00000004h
xchg dword ptr [esp], edx
pop esp
mov dword ptr [esp], ebx
call 00007F6F2CDE7F96h
int3
mov eax, dword ptr [esp]
push edi
mov edi, esp
add edi, 00000004h
push eax
mov eax, 00000004h
add edi, eax
pop eax
xchg dword ptr [esp], edi
pop esp
sub esp, 04h
mov dword ptr [esp], ebp
mov ebp, eax
push ebp
pop ebx
pop ebp
push 7E7D5AE6h
mov dword ptr [esp], edx
mov edx, 00000001h
add eax, edx
pop edx
push ebp
mov dword ptr [esp], 6B952718h
mov dword ptr [esp], ebx
mov ebx, 001AA000h
sub eax, ebx
pop ebx
sub eax, 0C3C0048h
add eax, 0C3C0000h
cmp byte ptr [ebx], FFFFFFCCh
jne 00007F6F2CDE8027h
push eax
mov al, 5Fh
push edx
mov edx, 00000000h
add edx, ebx
mov byte ptr [edx], 0000000Ah
pop edx
xor byte ptr [ebx], 00000068h
and byte ptr [ebx], FFFFFFFEh
neg byte ptr [ebx]
sub byte ptr [ebx], 0000007Dh
shl byte ptr [ebx], 00000003h
add byte ptr [ebx], 00000057h
xor byte ptr [ebx], al
pop eax
push ebp
mov ebp, 000000DDh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x5a6d74	0x4c	ixqntyfn
IMAGE_DIRECTORY_ENTRY_IMPORT	0x13b055	0x69	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x138000	0x2b58	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x13b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x137000	0x90600	2f3e59fe3d0b6bd6ffe66be3698eb65f	False	0.9990462662337662	data	7.98579152603459	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x138000	0x2b58	0xc00	088b2f7c99be53e7b12a0d59558146c3	False	0.83984375	data	7.038625793039814	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x13b000	0x1000	0x200	745dea56938759dccaf9e183aa01b020	False	0.146484375	data	0.998472215956371	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x13c000	0x2c4000	0x200	59b749c1cee081df0d12bfac401b8ab3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ixqntyfn	0x400000	0x1aa000	0x1a9800	5ea51b357be7882422932451ca51d3d3	False	0.990290031029671	data	7.951072598064479	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fwmicjtz	0x5aa000	0x1000	0x400	8f84baac9206d013b351c216dc22ff66	False	0.75390625	data	5.862732268027027	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x5a6dc0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Russian	Russia	0.1892116182572614
RT_GROUP_ICON	0x5a9368	0x14	data	Russian	Russia	1.15
RT_VERSION	0x5a937c	0x2e4	data	Russian	Russia	0.4689189189189189
RT_MANIFEST	0x5a9660	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Exports

Name	Ordinal	Address
Start	1	0x466e80

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-25T22:35:48.985004+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49707	40.68.123.157	192.168.2.5
2024-07-25T22:35:33.898254+0200	TCP	2049060	ET MALWARE RisePro TCP Heartbeat Packet	49704	58709	192.168.2.5	193.233.132.74
2024-07-25T22:35:58.153768+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49716	58709	192.168.2.5	193.233.132.74
2024-07-25T22:35:39.900957+0200	TCP	2049060	ET MALWARE RisePro TCP Heartbeat Packet	49706	58709	192.168.2.5	193.233.132.74
2024-07-25T22:35:36.888332+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49704	58709	192.168.2.5	193.233.132.74
2024-07-25T22:36:27.419925+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49717	40.68.123.157	192.168.2.5
2024-07-25T22:35:42.875935+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49706	58709	192.168.2.5	193.233.132.74
2024-07-25T22:35:50.981833+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49709	58709	192.168.2.5	193.233.132.74
2024-07-25T22:35:42.873236+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49705	58709	192.168.2.5	193.233.132.74

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 22:35:33.871870995 CEST	49704	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 22:35:33.877065897 CEST	58709	49704	193.233.132.74	192.168.2.5
Jul 25, 2024 22:35:33.877168894 CEST	49704	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 22:35:33.898253918 CEST	49704	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 22:35:33.903213978 CEST	58709	49704	193.233.132.74	192.168.2.5
Jul 25, 2024 22:35:36.888331890 CEST	49704	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 22:35:36.906835079 CEST	58709	49704	193.233.132.74	192.168.2.5
Jul 25, 2024 22:35:39.753460884 CEST	49705	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 22:35:39.753681898 CEST	49706	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 22:35:39.870589018 CEST	58709	49705	193.233.132.74	192.168.2.5
Jul 25, 2024 22:35:39.870623112 CEST	58709	49706	193.233.132.74	192.168.2.5
Jul 25, 2024 22:35:39.870687962 CEST	49705	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 22:35:39.870732069 CEST	49706	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 22:35:39.900957108 CEST	49706	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 22:35:39.902481079 CEST	49705	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 22:35:39.905869961 CEST	58709	49706	193.233.132.74	192.168.2.5
Jul 25, 2024 22:35:39.907398939 CEST	58709	49705	193.233.132.74	192.168.2.5
Jul 25, 2024 22:35:42.873235941 CEST	49705	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 22:35:42.875935078 CEST	49706	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 22:35:42.878331900 CEST	58709	49705	193.233.132.74	192.168.2.5
Jul 25, 2024 22:35:42.880894899 CEST	58709	49706	193.233.132.74	192.168.2.5
Jul 25, 2024 22:35:47.967374086 CEST	49709	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 22:35:47.972361088 CEST	58709	49709	193.233.132.74	192.168.2.5
Jul 25, 2024 22:35:47.972471952 CEST	49709	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 22:35:48.002965927 CEST	49709	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 22:35:48.009160042 CEST	58709	49709	193.233.132.74	192.168.2.5
Jul 25, 2024 22:35:50.981832981 CEST	49709	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 22:35:50.986999035 CEST	58709	49709	193.233.132.74	192.168.2.5
Jul 25, 2024 22:35:55.154416084 CEST	49716	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 22:35:55.159446955 CEST	58709	49716	193.233.132.74	192.168.2.5
Jul 25, 2024 22:35:55.159538031 CEST	49716	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 22:35:55.188407898 CEST	49716	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 22:35:55.193422079 CEST	58709	49716	193.233.132.74	192.168.2.5
Jul 25, 2024 22:35:55.298173904 CEST	58709	49704	193.233.132.74	192.168.2.5
Jul 25, 2024 22:35:55.298388004 CEST	49704	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 22:35:58.153768063 CEST	49716	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 22:35:58.158899069 CEST	58709	49716	193.233.132.74	192.168.2.5
Jul 25, 2024 22:36:01.293879986 CEST	58709	49705	193.233.132.74	192.168.2.5
Jul 25, 2024 22:36:01.294007063 CEST	49705	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 22:36:01.309449911 CEST	58709	49706	193.233.132.74	192.168.2.5
Jul 25, 2024 22:36:01.309639931 CEST	49706	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 22:36:09.420144081 CEST	58709	49709	193.233.132.74	192.168.2.5
Jul 25, 2024 22:36:09.420278072 CEST	49709	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 22:36:16.545372009 CEST	58709	49716	193.233.132.74	192.168.2.5
Jul 25, 2024 22:36:16.545458078 CEST	49716	58709	192.168.2.5	193.233.132.74

Target ID:	0
Start time:	16:35:28
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\LisectAVT_2403002A_218.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LisectAVT_2403002A_218.exe"
Imagebase:	0x9e0000
File size:	2'343'431 bytes
MD5 hash:	6B79EBBF323BC3F77FB55112E9110F12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000003.2038565636.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	16:35:33
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0xe90000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:35:33
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:35:33
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0xe90000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:35:33
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	16:35:34
Start date:	25/07/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0xac0000
File size:	2'343'431 bytes
MD5 hash:	6B79EBBF323BC3F77FB55112E9110F12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000006.00000003.2108165970.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	16:35:35
Start date:	25/07/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0xac0000
File size:	2'343'431 bytes
MD5 hash:	6B79EBBF323BC3F77FB55112E9110F12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000003.2109410350.00000000052E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	16:35:43
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x970000
File size:	2'343'431 bytes
MD5 hash:	6B79EBBF323BC3F77FB55112E9110F12
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000008.00000003.2182379846.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	16:35:51
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x970000
File size:	2'343'431 bytes
MD5 hash:	6B79EBBF323BC3F77FB55112E9110F12
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000000A.00000003.2262402855.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.5%
Dynamic/Decrypted Code Coverage:	1.5%
Signature Coverage:	2.1%
Total number of Nodes:	616
Total number of Limit Nodes:	61

Executed Functions

Function 009FE0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 009FE0CB
socket.WS2_32(?,?,?), ref: 009FE17E
connect.WS2_32(00000000,?,?), ref: 009FE192
closesocket.WS2_32(00000000), ref: 009FE19E

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: c843637cb94904a42ab8c003a4f313a10092caeaa9373ba547fc072836424424
Instruction ID: a53336a2b26ddcac3fb0b3ab66f002cc5e8582403f568d5fe18ff03b6a8cb292
Opcode Fuzzy Hash: c843637cb94904a42ab8c003a4f313a10092caeaa9373ba547fc072836424424
Instruction Fuzzy Hash: 7B31B2716093046FD7219F658C85B6BB7E8EB85328F015F1DFAA4972E0D33198088B92

Function 00A43A40 Relevance: 2.7, APIs: 2, Instructions: 157
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E9,?,00000001,00000000,?,?,?,?,?,?,?,?,00A43DB6), ref: 00A43B08
Sleep.KERNELBASE(00000001,?,00000001,00000000,?,?,?,?,?,?,?,?,00A43DB6), ref: 00A43BBA

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: d3e59d71b8843aa30dcf898d2598ea723fde877028961797a53566b0591417f2
Instruction ID: 70852f3d8cc9e6fae6090d412f03ec798b0d07cfcb9ea09af533d895db9e4e82
Opcode Fuzzy Hash: d3e59d71b8843aa30dcf898d2598ea723fde877028961797a53566b0591417f2
Instruction Fuzzy Hash: 1751AB3AA44215CFCF14CF58C8D0EA9B3B1EF85744B298599D445AF351D732EE06CB80

Function 04D00A81 Relevance: 1.9, APIs: 1, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D00C6C

Memory Dump Source

Source File: 00000000.00000002.3315055823.0000000004D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_LisectAVT_2403002A_218.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 992a9dcf566866e75ae7c138f62a615b2a67a80088952797274ffafb05babaab
Instruction ID: d65a648b2b7083f6fe77c42d3ce86593ea12707703009e40f66cf4a9c9a7ff10
Opcode Fuzzy Hash: 992a9dcf566866e75ae7c138f62a615b2a67a80088952797274ffafb05babaab
Instruction Fuzzy Hash: 42714DEB64C120BDB15381813B24BFB666EE6D6B30730C466F847D7582F6D49E892131

Function 00AD4623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 806bdb39056bfd60bcf21a95cf994778b8e8635a74c2694368ce632aeeb970e1
Instruction ID: 82c36fe6024be7cba5dd64e579616a95f4f152dac1762a839b42b346ea62fe58
Opcode Fuzzy Hash: 806bdb39056bfd60bcf21a95cf994778b8e8635a74c2694368ce632aeeb970e1
Instruction Fuzzy Hash: 0EB12470E04249AFEB11DFA9D841BEEBBB5EF4D304F14415AE452AB392CB709D41DBA0

Function 04D00A7A Relevance: 1.9, APIs: 1, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D00C6C

Memory Dump Source

Source File: 00000000.00000002.3315055823.0000000004D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_LisectAVT_2403002A_218.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 38dab8dcae2307b7440f36f30850d350c2485f7d02e2353949621511c3de8a58
Instruction ID: 585e3da82fffcd27efa32ffb583306152fdfd39b9ef62cdafede886ee56ff84b
Opcode Fuzzy Hash: 38dab8dcae2307b7440f36f30850d350c2485f7d02e2353949621511c3de8a58
Instruction Fuzzy Hash: 35715FEB64C220BDB15381813B64BFB666EE6D6B30730C46AF847D7642F6D49E893131

Function 04D00B5F Relevance: 1.9, APIs: 1, Instructions: 375
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3315055823.0000000004D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_LisectAVT_2403002A_218.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 998c339c4260892db74fe668d49bbd3f8a07140fb7759b8a687bce587e109255
Instruction ID: 18425620cbf11497f7c7985c3249960e088dbb9cf5350397268635d5c0e585bf
Opcode Fuzzy Hash: 998c339c4260892db74fe668d49bbd3f8a07140fb7759b8a687bce587e109255
Instruction Fuzzy Hash: E771E5EB64C210BDB21385813B64BF76B6DE6D6730330C46AF887D7582F2D4AE892171

Function 04D00AD5 Relevance: 1.8, APIs: 1, Instructions: 342
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3315055823.0000000004D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_LisectAVT_2403002A_218.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 179bb831bfeb2e80ebe5b55a80ab38e3050a58a200056b7518477d657f630a59
Instruction ID: 0486fe14e44c2225fe8153ef56038473f23ad8dcdf48e12ee79ffeb364ed8896
Opcode Fuzzy Hash: 179bb831bfeb2e80ebe5b55a80ab38e3050a58a200056b7518477d657f630a59
Instruction Fuzzy Hash: FC61A2EB24C120BDB15381823B24BF75A6EE2D6B30730C426F847D7682F6D4AE893171

Function 04D00ADE Relevance: 1.8, APIs: 1, Instructions: 338
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D00C6C

Memory Dump Source

Source File: 00000000.00000002.3315055823.0000000004D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_LisectAVT_2403002A_218.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 1839e2cd50d9245d8f4c2f869b621a2d484ddec1d2327f0beb6f22fc14f96dca
Instruction ID: 3d161274f867a8f29e8c60f564733969dcbf6032b8ccc4a61055301d0ed181c6
Opcode Fuzzy Hash: 1839e2cd50d9245d8f4c2f869b621a2d484ddec1d2327f0beb6f22fc14f96dca
Instruction Fuzzy Hash: 1D6191EB24C120BDB15381813B64BF75A6EE2D6B30730C426F887D7682F6D4AE893171

Function 04D00B02 Relevance: 1.8, APIs: 1, Instructions: 335
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D00C6C

Memory Dump Source

Source File: 00000000.00000002.3315055823.0000000004D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_LisectAVT_2403002A_218.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: e2227fd5b5b33c8cab11637b2c4e6cc2eb901b079414399da6b930872acf9ef3
Instruction ID: 648d951db0aab9c88ab27330369fa50eb9e949098060a486996f798b1d4c56c7
Opcode Fuzzy Hash: e2227fd5b5b33c8cab11637b2c4e6cc2eb901b079414399da6b930872acf9ef3
Instruction Fuzzy Hash: 0851B2EB24C120BDB15381813B64BF7566EE2D6B30730C46AF847E7682F6D4AE893131

Function 04D00B1C Relevance: 1.8, APIs: 1, Instructions: 334
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D00C6C

Memory Dump Source

Source File: 00000000.00000002.3315055823.0000000004D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_LisectAVT_2403002A_218.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 1f570adf3132cf2eecc4a7cd01a008b192488ee8ff81449b191219bf5405b463
Instruction ID: e0a31e5d1ee1c8a4e21039b7e56176f4f3d966f144ca03f21c2aeabd5d4749d1
Opcode Fuzzy Hash: 1f570adf3132cf2eecc4a7cd01a008b192488ee8ff81449b191219bf5405b463
Instruction Fuzzy Hash: F76183EB64C220BDB15381813B64BF76A6EE6D6730730C46AF887D7582F2D49E893171

Function 04D00AF5 Relevance: 1.8, APIs: 1, Instructions: 333
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D00C6C

Memory Dump Source

Source File: 00000000.00000002.3315055823.0000000004D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_LisectAVT_2403002A_218.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 7fc2ae3759e9799cc035036188c9cd9126025868e1e5303b946be868e1d823c7
Instruction ID: 63f54801e96cdc403d152d4b690b339a0ae30a37569f60fd95f50cb56590e264
Opcode Fuzzy Hash: 7fc2ae3759e9799cc035036188c9cd9126025868e1e5303b946be868e1d823c7
Instruction Fuzzy Hash: 105192EB64C120BDB15381813B64BF75A6EE6D6B30730C466F847D7682F6D4AE893131

Function 04D00B4F Relevance: 1.8, APIs: 1, Instructions: 315
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D00C6C

Memory Dump Source

Source File: 00000000.00000002.3315055823.0000000004D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_LisectAVT_2403002A_218.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: e3fc6e9daafe36380574b37dfd20c30e2826b96bc6d66404030901db9f254654
Instruction ID: b14338dc8c6515c6fddf423ec9dc048f79b7ae87876e048139e02ae15d77a608
Opcode Fuzzy Hash: e3fc6e9daafe36380574b37dfd20c30e2826b96bc6d66404030901db9f254654
Instruction Fuzzy Hash: B85181EB64C120BDB15381813B64BFB566EE6D6B30730C42AF847D7682F6D49E893171

Function 04D00B90 Relevance: 1.8, APIs: 1, Instructions: 307
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D00C6C

Memory Dump Source

Source File: 00000000.00000002.3315055823.0000000004D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_LisectAVT_2403002A_218.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: ac5db14624d55e986353935af7f69ca215edf3a7a4fd208e234a383c6bfa7cf9
Instruction ID: 797b2ace1b79eb0234e51dd6e2026ad7298059a0ab014f7308e4382b44df3fb0
Opcode Fuzzy Hash: ac5db14624d55e986353935af7f69ca215edf3a7a4fd208e234a383c6bfa7cf9
Instruction Fuzzy Hash: AF5160EB64C120BDB15381813B24BFB566EE6D6B30730C46AF847E7582F6D49E893131

Function 04D00BB3 Relevance: 1.8, APIs: 1, Instructions: 285
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D00C6C

Memory Dump Source

Source File: 00000000.00000002.3315055823.0000000004D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_LisectAVT_2403002A_218.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: f895e960ca9198a5a419f8ea528193b17fb1305eeb1d8014d30db35d23245ede
Instruction ID: 30ea630b11cf51335cfc7e8a97c11af193fd0e37ad44ef3a5a04d3ad2ac22f6c
Opcode Fuzzy Hash: f895e960ca9198a5a419f8ea528193b17fb1305eeb1d8014d30db35d23245ede
Instruction Fuzzy Hash: 905160EB64C120BDB15381813B24BF7566EE6D6B30730C46AF847E7681F6D4AE893171

Function 04D00BCC Relevance: 1.8, APIs: 1, Instructions: 281
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D00C6C

Memory Dump Source

Source File: 00000000.00000002.3315055823.0000000004D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_LisectAVT_2403002A_218.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: b33c9cb058af36ae5f1950537200d88cc4f44d7e4a0491f6e9ccf89c4cda9388
Instruction ID: 008f8e51354602a95a984c8e6aa1e1e0b1c76a8f6ea5ebb5d6b818bdd6639832
Opcode Fuzzy Hash: b33c9cb058af36ae5f1950537200d88cc4f44d7e4a0491f6e9ccf89c4cda9388
Instruction Fuzzy Hash: 0B5172EB64C120BDB11381813B24BF75A6EE6C6730730C46AF847D7582F6C49E893171

Function 04D00C0C Relevance: 1.8, APIs: 1, Instructions: 255COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D00C6C

Memory Dump Source

Source File: 00000000.00000002.3315055823.0000000004D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_LisectAVT_2403002A_218.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 8fb5fbf49f70b27e929a6d473d156aa37396794bb3356fabf0314aaf004e5a3f
Instruction ID: 0b0920d826741d1fc9c3614cb33f1be6dbc42ae8606e43c146e4e9679374daac
Opcode Fuzzy Hash: 8fb5fbf49f70b27e929a6d473d156aa37396794bb3356fabf0314aaf004e5a3f
Instruction Fuzzy Hash: 434150EB64C120BDB15381813B24BF7566EE6D6730730C466F887E7686F6C4AE893131

Function 009EA210 Relevance: 1.7, APIs: 1, Instructions: 231COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 009EA343

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: b7a3f66c33ec9cdc57d09b3f7bbe34659ae0e74d644eeeac4575655df8aefb57
Instruction ID: 2b8b0af8987db12879eb056d93061263b28bac4f6bb0979d4a7d6c49cd0eebed
Opcode Fuzzy Hash: b7a3f66c33ec9cdc57d09b3f7bbe34659ae0e74d644eeeac4575655df8aefb57
Instruction Fuzzy Hash: B4716970900245AFDB15DF69CD49B9EBBE8EF41300F10856DF8159B292E7B4AE40CBA2

Function 04D00CB8 Relevance: 1.7, APIs: 1, Instructions: 221COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D00C6C

Memory Dump Source

Source File: 00000000.00000002.3315055823.0000000004D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_LisectAVT_2403002A_218.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 33d32698f6fae1d367fc2c28bdbfc902714c6ef2f5883efef29ebde2683fa6fc
Instruction ID: c76cfab2c4761170c04361502284f5b57edce379cbc823725a577940ef94e5d5
Opcode Fuzzy Hash: 33d32698f6fae1d367fc2c28bdbfc902714c6ef2f5883efef29ebde2683fa6fc
Instruction Fuzzy Hash: A9417EEB64D114BDB15385813B24BF75A2EE6D6B30730C426F887E7681F6D4AE893131

Function 04D00C52 Relevance: 1.7, APIs: 1, Instructions: 215COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D00C6C

Memory Dump Source

Source File: 00000000.00000002.3315055823.0000000004D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_LisectAVT_2403002A_218.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 82d2b8148d88980c2c72482ebebe3c3937db2abb85cc30542cf76a7a3f98cdae
Instruction ID: 2f6768960da278b2a40074006b62751c05fe75a8d22f48b5477e065ef58a5c57
Opcode Fuzzy Hash: 82d2b8148d88980c2c72482ebebe3c3937db2abb85cc30542cf76a7a3f98cdae
Instruction Fuzzy Hash: F5416DEB64D124BDB15385813B24BF75A2EE2D6B30730C426F887E7681F6D4AE893131

Function 04D00C63 Relevance: 1.7, APIs: 1, Instructions: 209COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D00C6C

Memory Dump Source

Source File: 00000000.00000002.3315055823.0000000004D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d00000_LisectAVT_2403002A_218.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 0a8c5dbcb99540b220e8d30cd810c6ae9e76f383f1dfd4863e59ac46068e2972
Instruction ID: ca3c6d6f173b97ba980fd205863926fe0dd7903019e33bedb1b9b25bc3235833
Opcode Fuzzy Hash: 0a8c5dbcb99540b220e8d30cd810c6ae9e76f383f1dfd4863e59ac46068e2972
Instruction Fuzzy Hash: F3415CEB64C124BDB11385813B24BFB562EE6D6B30730C426F847E7681F694AE892131

Function 00AD549C Relevance: 1.7, APIs: 1, Instructions: 198fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000000,00AC9087,?,00000000,00000000,00000000,?,00000000,?,009EA3EB,00AC9087,00000000,009EA3EB,?,?), ref: 00AD5621

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 6cfcda78efa3475e09f278d72a6dec42bb66cac8b4f82d7ab63888b522523076
Instruction ID: 8a769733f841afc0945961b160e38579e81ad0ef6ecfa8ac1db667dd7d91a054
Opcode Fuzzy Hash: 6cfcda78efa3475e09f278d72a6dec42bb66cac8b4f82d7ab63888b522523076
Instruction Fuzzy Hash: E861B1B1D04519AFDF11DFB8D944EEEBBBAAF19304F58014AE802A7315D772D901CBA0

Function 00AC4942 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69c4a52cfe036083bccbe4529d72274fd6159733e3c84e81c6c17ce5eea8dc93
Instruction ID: 107f1ccc511a4e9e2f6bde16825a46cb3b8537d06ec7469320ad76905a34a5aa
Opcode Fuzzy Hash: 69c4a52cfe036083bccbe4529d72274fd6159733e3c84e81c6c17ce5eea8dc93
Instruction Fuzzy Hash: 0B51B570A00108AFDB14CF58C891FAABFB5EF4D364F26815CF8499B252D3319E51CB98

Function 00A50560 Relevance: 1.6, APIs: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00A506AE

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction ID: 1e1544a1ae7544c9d6c9fdb0d722977772c77c284b91e1606165c4dc96399736
Opcode Fuzzy Hash: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction Fuzzy Hash: D241F472A001149FCB15DF68DD80A9E7BA9BF89312F154169FC05DB302E770DE649BE1

Function 00AD4B12 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,00AD49F9,00000000,CF830579,00B11140,0000000C,00AD4AB5,00AC8BBD,?), ref: 00AD4B68

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: b5fbdabef05f6c18cfce0eab15b990ecdf2dea3461747e52e88e09cebba3eba7
Instruction ID: af80e51326b1019cd8893f8caafb64021e4049e3871ddec5542969cddd90c09c
Opcode Fuzzy Hash: b5fbdabef05f6c18cfce0eab15b990ecdf2dea3461747e52e88e09cebba3eba7
Instruction Fuzzy Hash: FA116B3364422457D72433346942B7E778ACBBAB74F29021FF81A8B3D2EE74DC415195

Function 00ACE05C Relevance: 1.6, APIs: 1, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00B10DF8,009EA3EB,00000002,009EA3EB,00000000,?,?,?,00ACE166,00000000,?,009EA3EB,00000002,00B10DF8), ref: 00ACE098

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: b908323ac42a57d46ea83ee74772b309eeb7757c2bb812100f7ef926b023d84a
Instruction ID: 4f88e12ce34a25b9413aa9eca8bc366b2607931748e38190554794a8b21990c8
Opcode Fuzzy Hash: b908323ac42a57d46ea83ee74772b309eeb7757c2bb812100f7ef926b023d84a
Instruction Fuzzy Hash: 3C012232650295AFCF15DF19CC01D9E7B6ADB81324F25020CF8509B2E1EAB2ED419BD0

Function 00ABF290 Relevance: 1.6, APIs: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 009E220E

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: d401e379500ae9bc4ee1765facb5c109f8c4336cb7dc2b998a7ec396ac2786b5
Instruction ID: 1aa8ba388aef43d70124f26fd0f0b0db97e7625ebce1064878ca5436ca23a0d2
Opcode Fuzzy Hash: d401e379500ae9bc4ee1765facb5c109f8c4336cb7dc2b998a7ec396ac2786b5
Instruction Fuzzy Hash: EC012B3550430DAFCB14AFA9DC01ED977ECDA00310B54843EFA18DBA52E770E9508790

Function 00AD63F3 Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00AC91F7,00000000,?,00AD5D79,00000001,00000364,00000000,00000006,000000FF,?,00000000,00ACD244,00AC89C3,00AC91F7,00000000), ref: 00AD6434

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a0c3f69f207fea4fdeb017436c5e5522b9b1c3c742e6d5b93d42599a820c552a
Instruction ID: 3e9e59262313cbe6bd83667002cb93dfb67418057316f3c541afdc84d7f30c17
Opcode Fuzzy Hash: a0c3f69f207fea4fdeb017436c5e5522b9b1c3c742e6d5b93d42599a820c552a
Instruction Fuzzy Hash: B3F0E9725451246ADB216B62DF06B5B3B98AF41B60B258023E807A7390CE70EC1046F1

Function 00AD6E2D Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00ADD635,4D88C033,?,00ADD635,00000220,?,00AD57EF,4D88C033), ref: 00AD6E60

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 36b0b137e8a35d1d8651485af7362342b688d51045e39cc5ac83fd0c33a58da0
Instruction ID: 4f1fb36577d4867f519712b058f4ffdcdcc7f54406d1bc6194817bc2b0f8e0e1
Opcode Fuzzy Hash: 36b0b137e8a35d1d8651485af7362342b688d51045e39cc5ac83fd0c33a58da0
Instruction Fuzzy Hash: 16E0ED3A180625AADA3023A5CE04BAB77AD8B827A0F060923EC1797390CF20C80081A4

Function 04D1046C Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3315106945.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_LisectAVT_2403002A_218.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5c654dfdc4875668e0b58c67efec343cb1bed57fd1360d6efaf92ee627c44f8
Instruction ID: 4d83239e531b4f7bb1b58d23d8b4bd568e7ac756116248cf4d6ed4091a1f670f
Opcode Fuzzy Hash: a5c654dfdc4875668e0b58c67efec343cb1bed57fd1360d6efaf92ee627c44f8
Instruction Fuzzy Hash: A421359B24C121BDB603B59177985F72F69E6D32303328822FC87C5963F154EACA6172

Function 04D103BA Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3315106945.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_LisectAVT_2403002A_218.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 372bff5df11d708c08315be2034ed8d75aca72f1da212e203c67fd406685afc6
Instruction ID: cc664b022d18213ad990ecacdbe2b6a1d4521ed21e26d55542ccaac39ed4bf35
Opcode Fuzzy Hash: 372bff5df11d708c08315be2034ed8d75aca72f1da212e203c67fd406685afc6
Instruction Fuzzy Hash: F82129A620C215FEB143B54176449B76769D6D3231330C422FD83D6923F2A0EAD96171

Function 04D103B1 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3315106945.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_LisectAVT_2403002A_218.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df18e15533a26e67ca86a65e62c48bf6321e4b049d42b0aa6ea0424f37f797db
Instruction ID: 9ca7db71ea531cd2386cb1207686719457d5911cc4b37596d9653e6622e23099
Opcode Fuzzy Hash: df18e15533a26e67ca86a65e62c48bf6321e4b049d42b0aa6ea0424f37f797db
Instruction Fuzzy Hash: 1511B1AB34C125FEB14370813A589BB6A59D2D3231331C422FD87D6D23F6A4EAD97171

Function 04D1044D Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3315106945.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_LisectAVT_2403002A_218.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfc65d77f82dd843be9bf3150fecbbffa1d50507be77e1b669e8829d34068c25
Instruction ID: c77eb09bbe3c202c3622d11a17c6328af8d98b11f1d870c78e317f2175ff4259
Opcode Fuzzy Hash: cfc65d77f82dd843be9bf3150fecbbffa1d50507be77e1b669e8829d34068c25
Instruction Fuzzy Hash: 851103AB64C125BDB143709137986F76A5DD2D3231331C422FD83D5D23B2A4EAC92171

Function 04D103DC Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3315106945.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_LisectAVT_2403002A_218.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4acab390215bd4b875dffb34ebdfc67420c81ea5a8357ee45a794f83db8b10a7
Instruction ID: 05663cb40614b75373a3ee72e168ec84babe4c2dbf6d6aba3fc78e9bee72badd
Opcode Fuzzy Hash: 4acab390215bd4b875dffb34ebdfc67420c81ea5a8357ee45a794f83db8b10a7
Instruction Fuzzy Hash: 6111D0AB24C125BDB14370813B989BB6A59D2D3231331C422FD87D5D23B2A4EAD97172

Function 04D103E6 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3315106945.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_LisectAVT_2403002A_218.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8582c4a8fb95252e26fe1c127e8e1fa0d74e34779e8770a102d8eea982107d1f
Instruction ID: c7c565ad401b38af0a354ee3f075426a9b5116ab45a4cece6f0e9a4d45f94232
Opcode Fuzzy Hash: 8582c4a8fb95252e26fe1c127e8e1fa0d74e34779e8770a102d8eea982107d1f
Instruction Fuzzy Hash: 031103EB20C225BEB143709137986F76A5DD2D3231331C422FD83D6D23B2A4EAC96171

Function 04D103FE Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3315106945.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_LisectAVT_2403002A_218.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c551964239f4f81d158b760e1d7f38fd13f328d7cf7d751ef7df53ffc245f414
Instruction ID: 6b29180ef081cf538cad72c3078cd2a835619916d7357972795abe310aeb5478
Opcode Fuzzy Hash: c551964239f4f81d158b760e1d7f38fd13f328d7cf7d751ef7df53ffc245f414
Instruction Fuzzy Hash: 4A11E6AB30C125BDB14375813B585B76A19E6D3231331C422FD87C9923F6A4EAC96171

Function 04D10415 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3315106945.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_LisectAVT_2403002A_218.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b0837c166c67186164e5d6c83f65a0875343fcf1e5732c7eb91c2491f1ee0c6
Instruction ID: e3f64f2b5bab3a640badae597967888c69d61a7d8d39624acf777edabcfbd6c3
Opcode Fuzzy Hash: 6b0837c166c67186164e5d6c83f65a0875343fcf1e5732c7eb91c2491f1ee0c6
Instruction Fuzzy Hash: AC1123AB30C121BDB143B19137589B76A69D6E3232330C827FC87D5A23F5A0EAC97131

Function 04D10439 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3315106945.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_LisectAVT_2403002A_218.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d6f83a85339662ff1984ccb6afa36e3df07bec93e2de6c46ca9a7c68b9f25b7
Instruction ID: 300ee4ad3458eb7bfbb4a6ab748013a24dadc97925d8d1fa50a95addc0050532
Opcode Fuzzy Hash: 3d6f83a85339662ff1984ccb6afa36e3df07bec93e2de6c46ca9a7c68b9f25b7
Instruction Fuzzy Hash: 1F11E5AB60C111BDB143B09137589F76A59D5D3231331C827FD83D5913B194EAC92172

Function 04D10465 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3315106945.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_LisectAVT_2403002A_218.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7397761b6e4d1b99aeae55674cd228acf0ea123c041d37f1b0b3408b296bfcf6
Instruction ID: d4796ebc754ac1010ffe00899a287fb508835624a179c9f7e9a0f95a6782c4b5
Opcode Fuzzy Hash: 7397761b6e4d1b99aeae55674cd228acf0ea123c041d37f1b0b3408b296bfcf6
Instruction Fuzzy Hash: 2401F2AB20C221BDB143B08137586B79B29D2E3231331C823FC83D2E13B294EAC93031

Function 04D104A2 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3315106945.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_LisectAVT_2403002A_218.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 209dfcbf8aec33a2c3aa3885b30ab099e413f19551dafbdf1cf2ec10106242d8
Instruction ID: 9284cbe6727d0015ca98b99c3361d1d70724a1b2a25ddf12e2b1be3dde887fc2
Opcode Fuzzy Hash: 209dfcbf8aec33a2c3aa3885b30ab099e413f19551dafbdf1cf2ec10106242d8
Instruction Fuzzy Hash: 01F02DAB64C110BDF143B09137281B66B58D6D3331371C463F983D2913B290D9893131

Function 04D104D1 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3315106945.0000000004D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d10000_LisectAVT_2403002A_218.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa429568e2c4a483a2b1d27384969a41bbc5bc04b73eb3794d313df21a30e221
Instruction ID: 816b33c83b9c450b26bfb25e51a128c64e8c4fa796a24c54f4dff1808300da74
Opcode Fuzzy Hash: aa429568e2c4a483a2b1d27384969a41bbc5bc04b73eb3794d313df21a30e221
Instruction Fuzzy Hash: 68F0505714C154BEB34371A5225C1FB6F14D6D31317318466E94386A12A2A0998D7231

Non-executed Functions

Function 009F9F50 Relevance: 13.6, Strings: 9, Instructions: 2331COMMON

Download Yara Rule

Strings

,, xrefs: 009FA6AF
., xrefs: 009FAB30
$, xrefs: 009FBD6D
%s|%s, xrefs: 009FA198
,, xrefs: 009FA5D2
131, xrefs: 009FA178, 009FA17F, 009FA190
type must be boolean, but is , xrefs: 009FBF3C, 009FBF6D, 009FC02B
., xrefs: 009FB0E2
:, xrefs: 009FA097

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID:
String ID: $$%s|%s$,$,$.$.$131$:$type must be boolean, but is
API String ID: 0-3347632522
Opcode ID: 1d6391184c76a3830dda888eab1aacbbf69ca5d4cf628e809cdff4db56277d88
Instruction ID: 5c81a8770b02967d08953cf4294269c5113443871be5ef2ba3686f8e806c51b0
Opcode Fuzzy Hash: 1d6391184c76a3830dda888eab1aacbbf69ca5d4cf628e809cdff4db56277d88
Instruction Fuzzy Hash: A023CFB0D0025C8FDB28DF68C958BEDBBB4BF45304F148199E549AB292DB359E84CF91

Function 00A573F0 Relevance: 7.9, APIs: 3, Strings: 1, Instructions: 897COMMON

Download Yara Rule

Strings

unordered_map/set too long, xrefs: 00A578C7

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID:
String ID: unordered_map/set too long
API String ID: 0-306623848
Opcode ID: d6f83b140a36e013be64e14ec6817d3bdb11071f32ed696bcf95122f1dfe8a49
Instruction ID: ea503d0094c0e2a26c7e5c491263c9cb59e62387ff868cc2a058612f95eeb04d
Opcode Fuzzy Hash: d6f83b140a36e013be64e14ec6817d3bdb11071f32ed696bcf95122f1dfe8a49
Instruction Fuzzy Hash: 7A6281B1E002099FCB14DF6DD980A9DBBB5FF88310F248669EC19AB395D730AD55CB90

Function 00AC84A0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction ID: 11b4e9827c41137e2607a520d2bcce1ae83cd52a521c3a20844d517e157b9056
Opcode Fuzzy Hash: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction Fuzzy Hash: D5022A71E012199FDF14CFA9C980BAEFBB1FF48314F25826DD919A7381DB35A9418B90

Function 00A550B0 Relevance: 5.3, Strings: 4, Instructions: 268COMMON

Download Yara Rule

Strings

/Kim, xrefs: 00A552A9
type must be number, but is , xrefs: 00A55241
type must be string, but is , xrefs: 00A55114
/Kim, xrefs: 00A552C2

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID:
String ID: /Kim$/Kim$type must be number, but is $type must be string, but is
API String ID: 0-1144537432
Opcode ID: 252ac13bfd7c7e2e383e2fc731134e754c1be8ca5232870b34f8d769f94af2ef
Instruction ID: e76d3810afbbb85942d9e460c856830d1896430e827a2b102ed04560509f7072
Opcode Fuzzy Hash: 252ac13bfd7c7e2e383e2fc731134e754c1be8ca5232870b34f8d769f94af2ef
Instruction Fuzzy Hash: B3910872E006089FCB08DF6CD9657DDBBA9FB88310F14826DE819D7391E6759D09CB80

Function 009E91A0 Relevance: 4.9, Strings: 3, Instructions: 1146COMMON

Download Yara Rule

Strings

\, xrefs: 009E9528
/, xrefs: 009E94E2
/\/, xrefs: 009E956A, 009E959C

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID:
String ID: /$/\/$\
API String ID: 0-1523196992
Opcode ID: 608f6fbbe8370d2af2f7ecc8c6eccc1df2d8b76fd3fd4e228207dfef5d2164c7
Instruction ID: 024b2096604efde192611ff974be3c08507acb9363d52a3c8285debf43382e48
Opcode Fuzzy Hash: 608f6fbbe8370d2af2f7ecc8c6eccc1df2d8b76fd3fd4e228207dfef5d2164c7
Instruction Fuzzy Hash: 14921671D002898FDF1ACFA9C8947EEBBB9BF45314F18426DD445AB282E7315E46CB50

Function 009E8D70 Relevance: 1.6, Strings: 1, Instructions: 327COMMON

Download Yara Rule

Strings

File, xrefs: 009E8F73

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID:
String ID: File
API String ID: 0-749574446
Opcode ID: b5715eaea7452b83bdb68475118bf65fe444bd1caabcf8513bbb12f174958563
Instruction ID: 2207506211dce609b32aeb62fb14dde43368cd197c41244542c570b22ce99d4c
Opcode Fuzzy Hash: b5715eaea7452b83bdb68475118bf65fe444bd1caabcf8513bbb12f174958563
Instruction Fuzzy Hash: C6C1AF70D0429D9AEF25DFA5CC85BEEBBB9FF05304F10006DE904AB281EB719A45CB65

Function 00ACBEAF Relevance: 1.5, Strings: 1, Instructions: 293COMMON

Download Yara Rule

Strings

0, xrefs: 00ACC01F

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 4685ad04bba33d30d22ca923b9ad0d62b72e95544c1c84a3029acf84acc3541a
Instruction ID: 6f865dd8ee0da54549d7df12b61430d0f9ce6033a53473541cb42a1b5df94136
Opcode Fuzzy Hash: 4685ad04bba33d30d22ca923b9ad0d62b72e95544c1c84a3029acf84acc3541a
Instruction Fuzzy Hash: 54B1CE34900646CFDB24CF69C981FBAB7B1AF05320F1A465DD45A9B392C732ED45CB60

Function 00ABF26A Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,?,00ABEC78,?,?,?,?,009F40EB,?,00A43C2E), ref: 00ABF283

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 0e78280027d4e2bc7f01754ddcace2cb3523d94e13f37cd0aab9f7c26ac14104
Instruction ID: 8349135217661a6bbbe6bd88a99b987c53ec30b35ee8697693df71252ae1c02f
Opcode Fuzzy Hash: 0e78280027d4e2bc7f01754ddcace2cb3523d94e13f37cd0aab9f7c26ac14104
Instruction Fuzzy Hash: 17D022379010385B8A153BC0AC008ECBF2ECE09B943084036EC046B114CF116C009BD4

Function 00A69880 Relevance: .7, Instructions: 748COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 270ec47e84ad16f90adf0a5b78032081837d7cc95b20ca816d63415026ea05fe
Instruction ID: e026d0dfba9cdbf27a58f63ade430536f960807c8a4297163c04adf9b5ec1200
Opcode Fuzzy Hash: 270ec47e84ad16f90adf0a5b78032081837d7cc95b20ca816d63415026ea05fe
Instruction Fuzzy Hash: 216290B0E002159FDB14CF59C5847AEBBF5AF88308F2881ADD818AB356D736D946CF91

Function 00ADF771 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e01a63de0acecfa5eb1506d60f94531ec9da83d204471109b6ed84efa514c088
Instruction ID: 75f638ce04ea5b333f968e67adc417a9605d25cf55fd49befaccfdf1acdb77a1
Opcode Fuzzy Hash: e01a63de0acecfa5eb1506d60f94531ec9da83d204471109b6ed84efa514c088
Instruction Fuzzy Hash: 65B1E1365007469FDB289B24CC92BBBB3A8EF44308F54453FE98786794EA75A985CB10

Function 00AD9824 Relevance: .3, Instructions: 270COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d081ceef8a78a141e5ac2dbd6bd4c379b44bf71b8fec22b9a63984f40651a3dd
Instruction ID: d34018717610bb550bab15b13943363a1b4c76f279b5f7b02845aa72028a1969
Opcode Fuzzy Hash: d081ceef8a78a141e5ac2dbd6bd4c379b44bf71b8fec22b9a63984f40651a3dd
Instruction Fuzzy Hash: E2B12C326106089FD715CF28C49ABA67BE0FF45364F25865DE89ACF3A1C735E992CB40

Function 009E24F0 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b13c60185003b5ad14668dcb3bc601f7d5a1edc7501da07896d0c4c3237e5350
Instruction ID: 483d6c1841cf8c8b22568798d007fb120f6a6ae0bad04761416a3d846c1cdb31
Opcode Fuzzy Hash: b13c60185003b5ad14668dcb3bc601f7d5a1edc7501da07896d0c4c3237e5350
Instruction Fuzzy Hash: 6971F4B4D002968FDB16CF6AC9D17FEFBB9EB19300F440269D86597342CB259D06C7A0

Function 00A66550 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d0c762883c5601642a628faadd3d23c8bd14addee5b4fc7474edd6becad6057
Instruction ID: b27a8ce40a56b4a2576870c2fb75e3cb1dc514e6bc5d101233391ab158e8a5a1
Opcode Fuzzy Hash: 2d0c762883c5601642a628faadd3d23c8bd14addee5b4fc7474edd6becad6057
Instruction Fuzzy Hash: 88612E716201654FD718CFDEECC04763772A78A311386462AEAC1DB3A6C739E927D7A0

Function 00A655B0 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57b62643dc163fa50f5cc0e6c8f0c8a786d6c6b31965158a7c8b99554546a1f3
Instruction ID: fe80458124c3c89f94eb6947826f6483aee12ff72f8bcb647aa8ea9298c139d9
Opcode Fuzzy Hash: 57b62643dc163fa50f5cc0e6c8f0c8a786d6c6b31965158a7c8b99554546a1f3
Instruction Fuzzy Hash: 6C8185B0C1429C9EDF18CFA5D4456EEBFB4EF06304F90809ED452AB651D778530ACB66

Function 009F4100 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10e515bf9a574895e222d320d781aa484cc2d8f2427c2d5a14b2124a32c28fda
Instruction ID: 652df5f8e15889cd12a71d8afa5d4be79d9813c9a4b730bda0e894d7d82cee92
Opcode Fuzzy Hash: 10e515bf9a574895e222d320d781aa484cc2d8f2427c2d5a14b2124a32c28fda
Instruction Fuzzy Hash: B351BF71E002099FCB18CF98D981AEEBBB9FB58310F14456DE925A7341D730AA44CBA0

Function 00AC646A Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 920c44e739ca4d08db5b5969fbc7a5a158caad0a814d8dad7807257cb044add9
Instruction ID: a144fc18bb491a8022e2bb4249ffc6a85fc4fe432bd1c4a57b8302d8ff87b848
Opcode Fuzzy Hash: 920c44e739ca4d08db5b5969fbc7a5a158caad0a814d8dad7807257cb044add9
Instruction Fuzzy Hash: 9C517F72D00219AFDF14CF99C941BEEBBB6FF88314F1A846DE915AB201D7349A50DB90

Function 00AC2CE0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 86cd4175e0247e0cf0f9e348b754af705a62760457773b80cbab2803d3d2ecd9
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: D311C8BB24018283D6578B2DD8B4FB6A7A5EBE532172F437ED0434B65CD222D9459700

Function 00A4F810 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00A4F833
std::_Lockit::_Lockit.LIBCPMT ref: 00A4F855
std::_Lockit::~_Lockit.LIBCPMT ref: 00A4F875
std::_Lockit::~_Lockit.LIBCPMT ref: 00A4F89F
std::_Lockit::_Lockit.LIBCPMT ref: 00A4F90D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00A4F959
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00A4F973
std::_Lockit::~_Lockit.LIBCPMT ref: 00A4FA08
std::_Facet_Register.LIBCPMT ref: 00A4FA15

Strings

bad locale name, xrefs: 00A4FA2F
Ps, xrefs: 00A4F96B, 00A4F972

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$Ps
API String ID: 3375549084-1174896957
Opcode ID: 0df79571b4dfd70a747309f3a51f358231318c1e8e8a741b00587d7dcc8b1e6a
Instruction ID: e1d57c3ee26af3369040fb9049467f9641fa89d95184c04262548f4eba9b0b1c
Opcode Fuzzy Hash: 0df79571b4dfd70a747309f3a51f358231318c1e8e8a741b00587d7dcc8b1e6a
Instruction Fuzzy Hash: B3618FB5D002489FEF10DFA4D945BDEBBF8AF54314F184468E805AB342EB75E905CBA1

Function 009E39F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 009E3A58
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 009E3AA4
__Getctype.LIBCPMT ref: 009E3ABA
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 009E3AE6
std::_Lockit::~_Lockit.LIBCPMT ref: 009E3B7B

Strings

bad locale name, xrefs: 009E3B96

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: e20d9d121ebd27153faef1291672bb6d4a590ec71bdece4fcd2d79d100205652
Instruction ID: 6f0b0a9467a4ed94756f8ec0169e92e4c1a81e337ce4b93082d74398b086c53c
Opcode Fuzzy Hash: e20d9d121ebd27153faef1291672bb6d4a590ec71bdece4fcd2d79d100205652
Instruction Fuzzy Hash: 925130B1D00248AFDF11DFA5D985BDEBBB8AF14314F188169E809AB342E775DA04CB51

Function 00AC2E10 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00AC2E47
___except_validate_context_record.LIBVCRUNTIME ref: 00AC2E4F
_ValidateLocalCookies.LIBCMT ref: 00AC2ED8
__IsNonwritableInCurrentImage.LIBCMT ref: 00AC2F03
_ValidateLocalCookies.LIBCMT ref: 00AC2F58

Strings

csm, xrefs: 00AC2EED

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: e8218bc463cadc924c6d2be925acadff5f7a0b22190eab741a3028bf2851e0fa
Instruction ID: 9586f95eb27859333fce13544f0ee25b7ec2cdd2f7067d7cc281d4995453125f
Opcode Fuzzy Hash: e8218bc463cadc924c6d2be925acadff5f7a0b22190eab741a3028bf2851e0fa
Instruction Fuzzy Hash: 10418D34A00209ABCF10DF68C885F9EBFF5AF49324F15845DE814AB392DB31AE55CB91

Function 00A4DE70 Relevance: 9.1, APIs: 6, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00A4DE93
std::_Lockit::_Lockit.LIBCPMT ref: 00A4DEB6
std::_Lockit::~_Lockit.LIBCPMT ref: 00A4DED6
std::_Facet_Register.LIBCPMT ref: 00A4DF4B
std::_Lockit::~_Lockit.LIBCPMT ref: 00A4DF63
Concurrency::cancel_current_task.LIBCPMT ref: 00A4DF7B

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: a7538ca9c49718676b8b31a6bafc28623c6315a8ad7b4ee139e93ab7a4accf52
Instruction ID: 40a1912e47eca92c420adc192cae92421399959f2bdc98103a4c36f2ef7a22a0
Opcode Fuzzy Hash: a7538ca9c49718676b8b31a6bafc28623c6315a8ad7b4ee139e93ab7a4accf52
Instruction Fuzzy Hash: 4A410475900219DFCB24DF58D981AEEBBB8FB84720F148269E8159B352DB31ED05CBD1

Function 009E4C50 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 442COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 009E4F72
___std_exception_destroy.LIBVCRUNTIME ref: 009E4FFF
___std_exception_copy.LIBVCRUNTIME ref: 009E50C8

Strings

recursive_directory_iterator::operator++, xrefs: 009E504C

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$___std_exception_copy
String ID: recursive_directory_iterator::operator++
API String ID: 1206660477-953255998
Opcode ID: 5c55c9c2a1cbf582171cb28f277e0c8593c62d5fd900136e9c5c1c5f63758067
Instruction ID: 4c85a4a30ee2b4a25335fdf76ee1b546828cd3fd2587e6c48d8bbed3ef6fa963
Opcode Fuzzy Hash: 5c55c9c2a1cbf582171cb28f277e0c8593c62d5fd900136e9c5c1c5f63758067
Instruction Fuzzy Hash: 1CE114719002459FCB28DF68DD45BAEBBF9FF48300F148A2DE45693781E774A944CBA1

Function 009E7820 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 009E799A
___std_exception_copy.LIBVCRUNTIME ref: 009E7B75

Strings

type_error, xrefs: 009E784A
out_of_range, xrefs: 009E7A27

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: out_of_range$type_error
API String ID: 2659868963-3702451861
Opcode ID: f9f5bfa1c393e036fe894ea63d2a4f22daf9d2e04797c17d806d0d8cd980f9d7
Instruction ID: 383d897f365f77d85a63d36b4d0658b5addcba99a766082df16d66e0068a63f2
Opcode Fuzzy Hash: f9f5bfa1c393e036fe894ea63d2a4f22daf9d2e04797c17d806d0d8cd980f9d7
Instruction Fuzzy Hash: 5AC169B19002489FDB18CFA8D984B9DFBF5FF48300F148669E419EB782E7749984CB65

Function 009E73B0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 009E75BE
___std_exception_destroy.LIBVCRUNTIME ref: 009E75CD

Strings

, column , xrefs: 009E7434, 009E744A
at line , xrefs: 009E73F7

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column
API String ID: 4194217158-191570568
Opcode ID: 56d92772fe8a15eeed9b9fa6438aa31de9c2c6f741a59f8e434abc78d88eb826
Instruction ID: e8b20ad16b085c740d2dcb8abc0aa9aa59f38e194f0a35814938df5f96974c8e
Opcode Fuzzy Hash: 56d92772fe8a15eeed9b9fa6438aa31de9c2c6f741a59f8e434abc78d88eb826
Instruction Fuzzy Hash: 0461D271A042459FDB09CFA8DD84BADFBB6FF44300F24862CF415A7792E774AA448B91

Function 009E3D10 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 009E3E7F

Strings

ios_base::eofbit set, xrefs: 009E3E41, 009E3E63
ios_base::badbit set, xrefs: 009E3E17
ios_base::failbit set, xrefs: 009E3D32

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: e015b56ed44c349a2c2291a515dc8fba8318ea7e19704285cdb31b37f840757e
Instruction ID: 9598d00ddc3cc080423da8eebe602718a6c2505792abe3b3310bc1dd3a198bb7
Opcode Fuzzy Hash: e015b56ed44c349a2c2291a515dc8fba8318ea7e19704285cdb31b37f840757e
Instruction Fuzzy Hash: ED41A4B2900248AFCB15DF69CC45B9EBBF8EB49310F14856EE915D7681E770AE408BA4

Function 009E3DE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 009E3E7F

Strings

ios_base::eofbit set, xrefs: 009E3E28, 009E3E41, 009E3E63
ios_base::badbit set, xrefs: 009E3E17
ios_base::failbit set, xrefs: 009E3D32, 009E3E1E

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: f0639693b36e982c517afb76afce396dcb12d987c86ad6a3ac251050552c19c7
Instruction ID: 7e6abf70fd2258f13348399cba7f7e63b8c3820f115d464b05d791b0462212e3
Opcode Fuzzy Hash: f0639693b36e982c517afb76afce396dcb12d987c86ad6a3ac251050552c19c7
Instruction Fuzzy Hash: 0F2105B2900344AFC714DF59D809F96B7DCAB44310F18C86EFA688B681E770EE14CB90

Function 009E6F40 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 349COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 009E7340

Strings

parse_error, xrefs: 009E6F8B
parse error, xrefs: 009E6FFF, 009E7018

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: parse error$parse_error
API String ID: 2659868963-1820534363
Opcode ID: 3183306d6a5dd4187a4c1abc046a330d59a6456fab544149ef9b30a1fc56a498
Instruction ID: f6c37189876dd512e6c036450bd04044d908f3da3cab1b0d2231aae096600a6b
Opcode Fuzzy Hash: 3183306d6a5dd4187a4c1abc046a330d59a6456fab544149ef9b30a1fc56a498
Instruction Fuzzy Hash: 37E16D709042498FDB19CFA8D984B9DFBB1BF48300F248269E419EB792D7749A85CF51

Function 009E6C60 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 009E6F11
___std_exception_destroy.LIBVCRUNTIME ref: 009E6F20

Strings

[json.exception., xrefs: 009E6CB8

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.
API String ID: 4194217158-791563284
Opcode ID: 1130c61991e487304b1fd777a5a0c9bbea015732199785f8cc564c9327ca5fef
Instruction ID: 8463cae85499404b051d4774b84e6206f3862f976d11258f69c21e4e38e1cc46
Opcode Fuzzy Hash: 1130c61991e487304b1fd777a5a0c9bbea015732199785f8cc564c9327ca5fef
Instruction Fuzzy Hash: B191E270A002459FDB19CF68D984B9EBBF6FF55300F20866CE415AB792D770AE81CB50

Function 00A5E440 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00A5E491

Strings

type must be string, but is , xrefs: 00A5E4F8
type must be boolean, but is , xrefs: 00A5E582

Memory Dump Source

Source File: 00000000.00000002.3307468308.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.3307413069.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307468308.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307736561.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000D91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3307790549.0000000000DE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308363344.0000000000DE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3308789391.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_LisectAVT_2403002A_218.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: type must be boolean, but is $type must be string, but is
API String ID: 118556049-436076039
Opcode ID: 9c52e3875467446e8f40c33a9107ca9a255f6ddb66b0bfa0f80d4b1578117a75
Instruction ID: 6b4fe54d9c13d945bbe7458b904dd6059ae1e0768ccbd2f6dc1286f26aa64785
Opcode Fuzzy Hash: 9c52e3875467446e8f40c33a9107ca9a255f6ddb66b0bfa0f80d4b1578117a75
Instruction Fuzzy Hash: A5417EB5900288AFDB18EBA4D906F9EB7BCEB00310F144578F815D7682FB35AE44C796

Analysis Process: MPGPH131.exePID: 4580, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	1.3%
Signature Coverage:	0%
Total number of Nodes:	615
Total number of Limit Nodes:	61

Executed Functions

Function 00B23A40 Relevance: 2.7, APIs: 2, Instructions: 157
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E9,?,00000001,00000000,?,?,?,?,?,?,?,?,00B23DB6), ref: 00B23B08
Sleep.KERNELBASE(00000001,?,00000001,00000000,?,?,?,?,?,?,?,?,00B23DB6), ref: 00B23BBA

Memory Dump Source

Source File: 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.3306924399.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3306984601.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307574257.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308404955.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308895930.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 7e8f37ef7322ff1474acd68afaa316ee02e701272c2008aa4b3bd4c0cb3e1b1f
Instruction ID: b8e10b82d0dcbe38d74f3e00e66f4471a4a3ea86f263431015c1e22b68e126ca
Opcode Fuzzy Hash: 7e8f37ef7322ff1474acd68afaa316ee02e701272c2008aa4b3bd4c0cb3e1b1f
Instruction Fuzzy Hash: E651A935A042298FCB24CF58D8D4EADB7F1EF49B04B2945AAD449AF211D735EE06CB80

Function 00ADE0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00ADE0CB
socket.WS2_32(?,?,?), ref: 00ADE17F
connect.WS2_32(00000000,?,?), ref: 00ADE193
closesocket.WS2_32(00000000), ref: 00ADE19E

Memory Dump Source

Source File: 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.3306924399.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3306984601.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307574257.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308404955.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308895930.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: ea351c3d571c8d037864970aa3527e47a49f91ba3061ab11db6bb6d8752128a1
Instruction ID: f2e6f66df55bae9c2cc492a5e7d0fab8d1d430ca488fcd9180b054d4d079cdea
Opcode Fuzzy Hash: ea351c3d571c8d037864970aa3527e47a49f91ba3061ab11db6bb6d8752128a1
Instruction Fuzzy Hash: F431B2716043016BD720EF258D89B2FB7E4EB85324F015F1EF9A99B2E0D37198148B92

Function 00BB4623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.3306924399.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3306984601.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307574257.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308404955.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308895930.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2262e6f9c7f9ea63c333b4ff0014feb31fa748b8d72f497405e45016238625e2
Instruction ID: a2809ecebf8ae45f8d6b64abde92da3ac60c735a3f6cac99e0e76b93d7025444
Opcode Fuzzy Hash: 2262e6f9c7f9ea63c333b4ff0014feb31fa748b8d72f497405e45016238625e2
Instruction Fuzzy Hash: 3BB1BE70A04245AFDB119FA9D881BFEBBF5FF46304F1441D8E991AB292CBB09D41CB61

Function 00ACA210 Relevance: 1.7, APIs: 1, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 00ACA343

Memory Dump Source

Source File: 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.3306924399.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3306984601.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307574257.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308404955.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308895930.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 491c5bff25c4fd66c5438e5458d5fe28bb42ae04bae2dc8f9790c077d9ccadd6
Instruction ID: 2af49b2fcfe37154c475c81d9fb146a7bd5a6ef492f41c73f9cf153fef17b809
Opcode Fuzzy Hash: 491c5bff25c4fd66c5438e5458d5fe28bb42ae04bae2dc8f9790c077d9ccadd6
Instruction Fuzzy Hash: AB714970900248ABDF18DF68CC49FAEBBE8EF42704F1085ADF8059B782D7B59941C791

Function 00BB549C Relevance: 1.7, APIs: 1, Instructions: 198
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000000,00BA9087,?,00000000,00000000,00000000,?,00000000,?,00ACA3EB,00BA9087,00000000,00ACA3EB,?,?), ref: 00BB5621

Memory Dump Source

Source File: 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.3306924399.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3306984601.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307574257.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308404955.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308895930.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: b3f7848445e4d9e4a7948e17f0a2d7d98be47050824453030acdc83325684106
Instruction ID: cc105b2dd402bf5be2e2caf916676e31dd5205403435688d90398d4d4547985e
Opcode Fuzzy Hash: b3f7848445e4d9e4a7948e17f0a2d7d98be47050824453030acdc83325684106
Instruction Fuzzy Hash: ED61A071904519AFDF219FA8C884FFEBBFAEF19304F140185E805A7215D7B1D941CBA2

Function 00BA4942 Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.3306924399.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3306984601.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307574257.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308404955.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308895930.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acc89347469fc5a875324cb00f4bf7697ee50aa0afe06201ec885c46d77ea7c0
Instruction ID: c18e70237fb1df0c665182a74bc3c1e1dcac99ba557a6aaa654356e0ea53842e
Opcode Fuzzy Hash: acc89347469fc5a875324cb00f4bf7697ee50aa0afe06201ec885c46d77ea7c0
Instruction Fuzzy Hash: 1651A770A04108AFDB14CF58C885AAEBFF5EF8A354F248199F8499B252D3B1DE51CB94

Function 04E008EE Relevance: 1.7, APIs: 1, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(00000003), ref: 04E00A05

Memory Dump Source

Source File: 00000006.00000002.3315067438.0000000004E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e00000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 6110236343f483a4cac5439f032dfe86e70fd6a65b15f8ee02af50dbe643a1dd
Instruction ID: 92585638a1d3e98580d777c9a1bbf4278a2dba0e946cc9b8e970ee5822b0d7b3
Opcode Fuzzy Hash: 6110236343f483a4cac5439f032dfe86e70fd6a65b15f8ee02af50dbe643a1dd
Instruction Fuzzy Hash: D631E1F724C124BCF14281857B50BF766BEE7D2770770E52AB15792582F6902EC82572

Function 04E008F7 Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(00000003), ref: 04E00A05

Memory Dump Source

Source File: 00000006.00000002.3315067438.0000000004E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e00000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: f760d1a5df6af00205d433dd51e7c782a39e2962356e07c5fc9f7f9f2e3f71ce
Instruction ID: 6f4c8be37910e5b42576a374e5650742923ea55aa4170d8adb7432c8dac3caa1
Opcode Fuzzy Hash: f760d1a5df6af00205d433dd51e7c782a39e2962356e07c5fc9f7f9f2e3f71ce
Instruction Fuzzy Hash: 0C31EFF724C225BCF14282857B50BF7A6BEE7D2770730E52AB09381182F6902EC86572

Function 04E00900 Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(00000003), ref: 04E00A05

Memory Dump Source

Source File: 00000006.00000002.3315067438.0000000004E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e00000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 4ff13e9081d9e885d6fda6d12247fb9ccf3f059d4e9f4248f8649dfe8c490817
Instruction ID: 4ec83e34b3d533832cfc248d2926dac6f055146d1f3d9e819fcdc733188a8546
Opcode Fuzzy Hash: 4ff13e9081d9e885d6fda6d12247fb9ccf3f059d4e9f4248f8649dfe8c490817
Instruction Fuzzy Hash: 1931DFFB24C225BCF14281857B50BF76ABEE7D3770B30E52AB15791582F6902EC86132

Function 00B30560 Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00B306AE

Memory Dump Source

Source File: 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.3306924399.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3306984601.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307574257.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308404955.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308895930.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction ID: 6654e9d136040b5eab32869f4265f139173806e9cb1ef6a4250f309ba01b183c
Opcode Fuzzy Hash: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction Fuzzy Hash: 6E410572A041189FCB05EF68D9916AE7BE5EF89310F2501E9F805EB306DB30DD608BE1

Function 04E0091A Relevance: 1.6, APIs: 1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(00000003), ref: 04E00A05

Memory Dump Source

Source File: 00000006.00000002.3315067438.0000000004E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e00000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 0866c50e18fb08f989207f2de8344b3ea71708578e6ec5f2af8b1dfb4ac41e0a
Instruction ID: 8d119a35eb19e195297fc71b83ebb3799f3bff59241e6fb17968143a5b107fae
Opcode Fuzzy Hash: 0866c50e18fb08f989207f2de8344b3ea71708578e6ec5f2af8b1dfb4ac41e0a
Instruction Fuzzy Hash: EC2126F724C125ADF24282957B50BF76BBDEBD2730730E527A193921C2F6D02AC86172

Function 04E00968 Relevance: 1.6, APIs: 1, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(00000003), ref: 04E00A05

Memory Dump Source

Source File: 00000006.00000002.3315067438.0000000004E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e00000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 389ed5da9f217f74a1885c71d7bb550ceca6c95c4dbbc25810e8ff6c66ce898b
Instruction ID: df0cdcf0f76508b43a6fe48568e2508638273afb8825b13406f1bc95b54abdc2
Opcode Fuzzy Hash: 389ed5da9f217f74a1885c71d7bb550ceca6c95c4dbbc25810e8ff6c66ce898b
Instruction Fuzzy Hash: 1F2143B724C124ADF24292497B50BF6ABBDF7C3730730E426E0A786182FA902BC42561

Function 04E00983 Relevance: 1.6, APIs: 1, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(00000003), ref: 04E00A05

Memory Dump Source

Source File: 00000006.00000002.3315067438.0000000004E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e00000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 2589e61b0a0826e0dc950f9fcce6701fd86bb665ecc24e41c99a40e84187add9
Instruction ID: f2e93716acb8cfb32b84eca4a8309390542317d27f6510511ae69709ac43c414
Opcode Fuzzy Hash: 2589e61b0a0826e0dc950f9fcce6701fd86bb665ecc24e41c99a40e84187add9
Instruction Fuzzy Hash: 4A1166BB38C121BCF24291857B54BF76BBDE7C3B30730E926A09381582F6906AC42161

Function 04E009C1 Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(00000003), ref: 04E00A05

Memory Dump Source

Source File: 00000006.00000002.3315067438.0000000004E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e00000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 72f65172c7c1ab1f9c6ed2d2c060094bea38ed7a60590c14a71ec3f3851aa226
Instruction ID: 131a36c04930f846dad583d2dd6426ccbbf639a2128e937dfdeb883ac27cfd8c
Opcode Fuzzy Hash: 72f65172c7c1ab1f9c6ed2d2c060094bea38ed7a60590c14a71ec3f3851aa226
Instruction Fuzzy Hash: 151166BB38C121ACF24291457A40BF66BBDE7C3730330E927E0A781182F6902AC42561

Function 04E009D0 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(00000003), ref: 04E00A05

Memory Dump Source

Source File: 00000006.00000002.3315067438.0000000004E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e00000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 534382049625dfeab4189cd0b333dd1da4212f5afdd2689c2d3d6700fed0819b
Instruction ID: 0a81f44ccd3539ad4b9c823ebfc566c8f66b55b548425a288bc7d1899ff4b7b0
Opcode Fuzzy Hash: 534382049625dfeab4189cd0b333dd1da4212f5afdd2689c2d3d6700fed0819b
Instruction Fuzzy Hash: E321ADB374D224ADE71286547A90BF67BF8EB83730730E577D0D3561C2F6502AC59262

Function 04E009AA Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(00000003), ref: 04E00A05

Memory Dump Source

Source File: 00000006.00000002.3315067438.0000000004E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e00000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 9055a3f240717d28bcc06a0170b07516fbd986518f6ba5766aa409f46de8c34e
Instruction ID: 7daa1f8bf6d234c83489545631c4b4d0b68ebbecffe198ea3e8685388009e09a
Opcode Fuzzy Hash: 9055a3f240717d28bcc06a0170b07516fbd986518f6ba5766aa409f46de8c34e
Instruction Fuzzy Hash: C9115CB734C225ACE14155457A50BF76BFDE793730770F526A0E3951C2FA903AC06561

Function 00BB4B12 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,00BB49F9,00000000,CF830579,00BF1140,0000000C,00BB4AB5,00BA8BBD,?), ref: 00BB4B68

Memory Dump Source

Source File: 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.3306924399.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3306984601.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307574257.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308404955.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308895930.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 129f40e953f03c94d3509c939a35b55a7af99e4c4c1863386a8b0ea4f8ea8b14
Instruction ID: 649340c334db28511bb5b58db9cfdbe9c4d309f5ece93363266fc891adabbee7
Opcode Fuzzy Hash: 129f40e953f03c94d3509c939a35b55a7af99e4c4c1863386a8b0ea4f8ea8b14
Instruction Fuzzy Hash: 7B116B33A4412417D73526746841BFE7BC9DB827B4F2902C9FA158B0D3EFE0DC419155

Function 00BAE05C Relevance: 1.6, APIs: 1, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00BF0DF8,00ACA3EB,00000002,00ACA3EB,00000000,?,?,?,00BAE166,00000000,?,00ACA3EB,00000002,00BF0DF8), ref: 00BAE098

Memory Dump Source

Source File: 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.3306924399.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3306984601.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307574257.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308404955.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308895930.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: b277a1abf79e1dedb1d8d980294e35c0644f3d856d5a2b1161cada07466bd057
Instruction ID: 187a37f1f68b113ba117fa90c046308b37dbaa23cab00e23edeed27ca9c0e6b2
Opcode Fuzzy Hash: b277a1abf79e1dedb1d8d980294e35c0644f3d856d5a2b1161cada07466bd057
Instruction Fuzzy Hash: F6014E32614114AFCF159F54CC46C9E3B99DB82334F240188FC519B1D0E6B1ED41DBD0

Function 00B9F290 Relevance: 1.6, APIs: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00AC220E

Memory Dump Source

Source File: 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.3306924399.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3306984601.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307574257.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308404955.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308895930.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: b859dd82a4120a5fa9326d0f09865fb01e21d37ef7c9801e0945d7cd010f2441
Instruction ID: 31db5da4e7167cf896e25b0c62d1466188283e0b1377cbf0636a470b80f114ec
Opcode Fuzzy Hash: b859dd82a4120a5fa9326d0f09865fb01e21d37ef7c9801e0945d7cd010f2441
Instruction Fuzzy Hash: 23012B7650430EABCF14AFACD801AAA77ECDA01320F5444B9FA19DB691EB70E9548790

Function 00BB63F3 Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00BA91F7,00000000,?,00BB5D79,00000001,00000364,00000000,00000006,000000FF,?,00000000,00BAD244,00BA89C3,00BA91F7,00000000), ref: 00BB6435

Memory Dump Source

Source File: 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.3306924399.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3306984601.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307574257.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308404955.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308895930.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 191de1944743328cd3f2d23b95d3bff07c32ffeb8608f1e9e38b3d0c8ede4dcd
Instruction ID: 4b66ecf0727c0744beef30b31ee63505b4b19ee02ac6fc45d4427817fd181679
Opcode Fuzzy Hash: 191de1944743328cd3f2d23b95d3bff07c32ffeb8608f1e9e38b3d0c8ede4dcd
Instruction Fuzzy Hash: 04F0E931505E24679B216B669C16BFB3BC8DF81764F2580D2EC0497280CEF4DC1086F1

Function 00BB6E2D Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00BBD635,4D88C033,?,00BBD635,00000220,?,00BB57EF,4D88C033), ref: 00BB6E60

Memory Dump Source

Source File: 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.3306924399.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3306984601.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307574257.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308404955.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308895930.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 70738a5c0981e7d8a39397df4415cf2681f110c7a68f1cd81e3b4c43e52d4ef2
Instruction ID: 33359292537173386a24d6f70caee569159cc8d72045dd71dec6d2ec3723a2bf
Opcode Fuzzy Hash: 70738a5c0981e7d8a39397df4415cf2681f110c7a68f1cd81e3b4c43e52d4ef2
Instruction Fuzzy Hash: 0FE0ED391416216BDA3122AACD10BFB77C8DF927A0F1505E1EC0593090CFE8CC0087A4

Function 04E10105 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3315120693.0000000004E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e10000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad10b2369af0c0044a194b176dd5419ef266f8ce6be2bda1a020df9ba1fef615
Instruction ID: 68a5805eebc927bf56808d0bd782666b866a6b3e50a71a4d8bac76db2e37ba94
Opcode Fuzzy Hash: ad10b2369af0c0044a194b176dd5419ef266f8ce6be2bda1a020df9ba1fef615
Instruction Fuzzy Hash: 942190F72CC610EFC2421B5546442F13B1AFB57330730651AE1438BE23F6EA22C4E251

Function 04E10198 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3315120693.0000000004E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e10000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7a35ad923ee7976f778f0b03e694f3b8d295506c3614267f39406ab5126772f
Instruction ID: e6d5e414d38cafc0f37012baea49da77e29c29c91ad8c30b3fdbb2f44aeaff9a
Opcode Fuzzy Hash: a7a35ad923ee7976f778f0b03e694f3b8d295506c3614267f39406ab5126772f
Instruction Fuzzy Hash: E6119EB32CC710DAC1031A6546953F27F56AB27334B302117D1038BEA3F6EA32C4E642

Function 04E101CC Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3315120693.0000000004E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e10000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49cdfe8f01866cfd63ac3e429cf8063f82cec484e948c79671f2061da49fe446
Instruction ID: 04316ecea6b4ad7c3bdade7fa5a3c9a2cc6c9b65c55d0365db2eb42ec383d923
Opcode Fuzzy Hash: 49cdfe8f01866cfd63ac3e429cf8063f82cec484e948c79671f2061da49fe446
Instruction Fuzzy Hash: D5115CB378D290DED342056454860F07F54BB2763532854DED9829BD63F26521C9E353

Function 04E10182 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3315120693.0000000004E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e10000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec2a5289a9352bf58ade794cdd24e9fc20d199a1138060aa4521ef3afc88c3e4
Instruction ID: 20eedcec60548cfdb5c188155193de8d247b6e1e1b5f23f2555c43c66d696290
Opcode Fuzzy Hash: ec2a5289a9352bf58ade794cdd24e9fc20d199a1138060aa4521ef3afc88c3e4
Instruction Fuzzy Hash: 94F0A4B73C8220EEC082159642916F2295E77673307307106B94796E63B69E2AD4F156

Function 04E101B4 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3315120693.0000000004E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e10000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aef011f1a666b264dff270d5fb0635265589cf0eea5d040d8beb28812373b88d
Instruction ID: 1825f8e522d2c02a9b6b56146904d832633670f41525d75569b301a2764bda38
Opcode Fuzzy Hash: aef011f1a666b264dff270d5fb0635265589cf0eea5d040d8beb28812373b88d
Instruction Fuzzy Hash: DEF0E0B77CC310DEC08214A542D42F27A5F67673307307146A54396FA375DA36D4F556

Function 04E1024B Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3315120693.0000000004E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e10000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d6f61f4767c2a249728aebc4e65e89074842d8d95b8f36da42feb85c4133787
Instruction ID: 68a5b61039f01c3f99fc014de18ed99642a70380b5d37051c5600b459103f9c0
Opcode Fuzzy Hash: 8d6f61f4767c2a249728aebc4e65e89074842d8d95b8f36da42feb85c4133787
Instruction Fuzzy Hash: 9BE068E78CD2119F92064A8145812F5BF8EB7B3224330601FF0C393E53C5AA0284E362

Function 04E10209 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3315120693.0000000004E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e10000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3a654cbcdb250ac1b8dc4aca6442abe2c2ca5497f33dae294002eb60a5e89c6
Instruction ID: d7821627f10b43c36d3ee567fc76c1be331318f07eb961853774795051ceab91
Opcode Fuzzy Hash: a3a654cbcdb250ac1b8dc4aca6442abe2c2ca5497f33dae294002eb60a5e89c6
Instruction Fuzzy Hash: 27E0E5B668C3219EC181A5A201C81F23586BB37134360625E255346EE3B5AA32C4E546

Function 04E10232 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3315120693.0000000004E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e10000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4723eb72d54c0fe132aba835d5ce662ed3ea8e08c3db51e1fceb65b2a78b68d0
Instruction ID: 6dc556070eafb9b4c9adf274b5464286aa74c2436c22b55aa01a0b12713cc68d
Opcode Fuzzy Hash: 4723eb72d54c0fe132aba835d5ce662ed3ea8e08c3db51e1fceb65b2a78b68d0
Instruction Fuzzy Hash: 14D02BB358C210D5804215A202852F1364A6777230330A20B250342FB335AA23C4F157

Function 04E10241 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3315120693.0000000004E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e10000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 399997e5bb31944305a77b2ceab65f17307023c5d8c910fa8e19078acc4cc669
Instruction ID: 1b1da12fadefa277f4f99196c2bd2eeff6fc688c479c403ff7db4e4c294b0d14
Opcode Fuzzy Hash: 399997e5bb31944305a77b2ceab65f17307023c5d8c910fa8e19078acc4cc669
Instruction Fuzzy Hash: DAD0A7B759C711D5C0465A9102842F2764DA773231330B657395392EB3B5DB22C8F557

Non-executed Functions

Function 00BA84A0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.3306924399.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3306984601.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307574257.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308404955.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308895930.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction ID: 85fb7a385549add2261a335dbe85095800b94224ab5cabc2f4b36f67bf465112
Opcode Fuzzy Hash: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction Fuzzy Hash: BC022B71E052199BDF14CFA9C9806AEBBF1FF49314F2482A9D919E7780DB31AD418B90

Function 00B2F810 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B2F833
std::_Lockit::_Lockit.LIBCPMT ref: 00B2F855
std::_Lockit::~_Lockit.LIBCPMT ref: 00B2F875
std::_Lockit::~_Lockit.LIBCPMT ref: 00B2F89F
std::_Lockit::_Lockit.LIBCPMT ref: 00B2F90D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00B2F959
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00B2F973
std::_Lockit::~_Lockit.LIBCPMT ref: 00B2FA08
std::_Facet_Register.LIBCPMT ref: 00B2FA15

Strings

bad locale name, xrefs: 00B2FA2F
Ps, xrefs: 00B2F96B, 00B2F972

Memory Dump Source

Source File: 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.3306924399.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3306984601.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307574257.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308404955.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308895930.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$Ps
API String ID: 3375549084-1174896957
Opcode ID: 27fc1ea46a1138264f80f2fba7d44894dcb94915ffdf6505b84a48f03be709bc
Instruction ID: 4cfbeec4d1450ac204fe8f61323992ea968922fe3836065a1ce99eccef71ded6
Opcode Fuzzy Hash: 27fc1ea46a1138264f80f2fba7d44894dcb94915ffdf6505b84a48f03be709bc
Instruction Fuzzy Hash: 176168B1D00259DBEF10DFA5E845BAEBBF4AF14750F1441B8E819AB341EB34E905CBA1

Function 00B2DE70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B2DE93
std::_Lockit::_Lockit.LIBCPMT ref: 00B2DEB6
std::_Lockit::~_Lockit.LIBCPMT ref: 00B2DED6
std::_Facet_Register.LIBCPMT ref: 00B2DF4B
std::_Lockit::~_Lockit.LIBCPMT ref: 00B2DF63
Concurrency::cancel_current_task.LIBCPMT ref: 00B2DF7B

Strings

HT}, xrefs: 00B2DEA5, 00B2DF5A

Memory Dump Source

Source File: 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.3306924399.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3306984601.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307574257.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308404955.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308895930.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID: HT}
API String ID: 2081738530-1907069115
Opcode ID: 5f80820928cbcb0542637db3f1c9cde7fe022feb55b4c730a96c04bb0b7027fc
Instruction ID: 8fd36bc807609bc677973bf11204981e3ed0825472d475b7b62f01ca31e5d29f
Opcode Fuzzy Hash: 5f80820928cbcb0542637db3f1c9cde7fe022feb55b4c730a96c04bb0b7027fc
Instruction Fuzzy Hash: 0541E2719002299FCF14DF58E985AAEBBF4FB14720F2442A9E8196B352DB31AD01CBD5

Function 00AC39F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00AC3A58
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00AC3AA4
__Getctype.LIBCPMT ref: 00AC3ABA
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00AC3AE6
std::_Lockit::~_Lockit.LIBCPMT ref: 00AC3B7B

Strings

bad locale name, xrefs: 00AC3B96

Memory Dump Source

Source File: 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.3306924399.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3306984601.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307574257.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308404955.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308895930.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: f222bffe6cc8bb618aa29c7b635bc48fd543be8222f4f0e8a105be71c4b7f434
Instruction ID: f9e5782c862bcdbf26a80af3162d4fa32c92a4611b1a6a77564cd264c69b3dc4
Opcode Fuzzy Hash: f222bffe6cc8bb618aa29c7b635bc48fd543be8222f4f0e8a105be71c4b7f434
Instruction Fuzzy Hash: 4E5130B2D012489BDF14DFA5D985F9EBBF8AF14310F1480A9E809AB341E775DE04CBA1

Function 00BA2E10 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00BA2E47
___except_validate_context_record.LIBVCRUNTIME ref: 00BA2E4F
_ValidateLocalCookies.LIBCMT ref: 00BA2ED8
__IsNonwritableInCurrentImage.LIBCMT ref: 00BA2F03
_ValidateLocalCookies.LIBCMT ref: 00BA2F58

Strings

csm, xrefs: 00BA2EED

Memory Dump Source

Source File: 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.3306924399.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3306984601.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307574257.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308404955.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308895930.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 8b0a68fb37b8baebe0f52324572a0dab609c93fba674c4c7baef137ba043c79b
Instruction ID: 0032578aad216d509f3a6039e8b86530cdfeecb1d2a05d415d2faafc4479176d
Opcode Fuzzy Hash: 8b0a68fb37b8baebe0f52324572a0dab609c93fba674c4c7baef137ba043c79b
Instruction Fuzzy Hash: 15418F34A08209AFCF10DF6CC885A9EBBF5EF46314F1480A6E9149B752D732DE55CB91

Function 00AC4C50 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 442COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00AC4F72
___std_exception_destroy.LIBVCRUNTIME ref: 00AC4FFF
___std_exception_copy.LIBVCRUNTIME ref: 00AC50C8

Strings

recursive_directory_iterator::operator++, xrefs: 00AC504C

Memory Dump Source

Source File: 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.3306924399.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3306984601.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307574257.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308404955.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308895930.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$___std_exception_copy
String ID: recursive_directory_iterator::operator++
API String ID: 1206660477-953255998
Opcode ID: 06d683135217b3344a21e517b03c3dc3e840dfab4d10ead830902ccdb3f44286
Instruction ID: 9b3039e7a2e3af20509614b8547becf26240ed36361e3a1678be40fb7994a856
Opcode Fuzzy Hash: 06d683135217b3344a21e517b03c3dc3e840dfab4d10ead830902ccdb3f44286
Instruction Fuzzy Hash: 32E111719002049FCB28DF68D855FAEBBF9FF48700F108A6DE45693781EB74A904CBA5

Function 00AC7820 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00AC799A
___std_exception_copy.LIBVCRUNTIME ref: 00AC7B75

Strings

out_of_range, xrefs: 00AC7A27
type_error, xrefs: 00AC784A

Memory Dump Source

Source File: 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.3306924399.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3306984601.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307574257.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308404955.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308895930.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: out_of_range$type_error
API String ID: 2659868963-3702451861
Opcode ID: 1a2114e8b9b3736c364a3e400db2fcb3f4236e2e221efafcf4100f5af4914074
Instruction ID: 868ec8f48a8d822f2879e11f6785519944aa2dbb59df82fabee5a92982ae1761
Opcode Fuzzy Hash: 1a2114e8b9b3736c364a3e400db2fcb3f4236e2e221efafcf4100f5af4914074
Instruction Fuzzy Hash: AFC157B19042488FDB58CFA8D984BADBBF5FB48310F14866DE419EB791E774A9808F50

Function 00AC73B0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00AC75BE
___std_exception_destroy.LIBVCRUNTIME ref: 00AC75CD

Strings

, column , xrefs: 00AC7434, 00AC744A
at line , xrefs: 00AC73F7

Memory Dump Source

Source File: 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.3306924399.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3306984601.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307574257.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308404955.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308895930.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column
API String ID: 4194217158-191570568
Opcode ID: 5b2fd3fd5aeaf37cdea0c19e163b6c93dd1afd29d140096dc08917175e95084e
Instruction ID: 7552dc4c190d2e6e3f5277bd6b53dd518d3c5f6cd3f8d0d07af43a1de15d7c98
Opcode Fuzzy Hash: 5b2fd3fd5aeaf37cdea0c19e163b6c93dd1afd29d140096dc08917175e95084e
Instruction Fuzzy Hash: A561D071A042099FDB08DF68DD84BADBBF6FF49310F24866CE415A7B81D774AA408B91

Function 00AC3D10 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00AC3E7F

Strings

ios_base::failbit set, xrefs: 00AC3D32
ios_base::eofbit set, xrefs: 00AC3E41, 00AC3E63
ios_base::badbit set, xrefs: 00AC3E17

Memory Dump Source

Source File: 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.3306924399.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3306984601.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307574257.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308404955.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308895930.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: 64760899284bdc203de92c878f8312882bc4cd5316fd6182ce6ef5f97b07c997
Instruction ID: be76d91f285865abd0e8caba9114032320570ca9839f811d1adec0f6e370f693
Opcode Fuzzy Hash: 64760899284bdc203de92c878f8312882bc4cd5316fd6182ce6ef5f97b07c997
Instruction Fuzzy Hash: 8141A2B2900209AFCB14DF68C845FAEB7F9EB49310F14C56EF915D7641E770AA058BA0

Function 00AC3DE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00AC3E7F

Strings

ios_base::failbit set, xrefs: 00AC3D32, 00AC3E1E
ios_base::eofbit set, xrefs: 00AC3E28, 00AC3E41, 00AC3E63
ios_base::badbit set, xrefs: 00AC3E17

Memory Dump Source

Source File: 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.3306924399.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3306984601.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307574257.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308404955.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308895930.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: bd54f41b935f528c61754060c0528d737e060ea44de3b68a8a2ca6c75aa1808f
Instruction ID: 4052d86fbc2483f60695960b666e890c5b9235b1ab82e33ed48b401c2b000177
Opcode Fuzzy Hash: bd54f41b935f528c61754060c0528d737e060ea44de3b68a8a2ca6c75aa1808f
Instruction Fuzzy Hash: AF21D5B39043056FCB14DF58D805F96B7ECAB05310F18C8AEFA698B641E774EA148B95

Function 00AC6F40 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 349COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00AC7340

Strings

parse error, xrefs: 00AC6FFF, 00AC7018
parse_error, xrefs: 00AC6F8B

Memory Dump Source

Source File: 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.3306924399.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3306984601.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307574257.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308404955.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308895930.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: parse error$parse_error
API String ID: 2659868963-1820534363
Opcode ID: d1576440caa8bf982ce85922cf1aafd28daf7567ec881baa5e8f51bfed4d1b1e
Instruction ID: 98165fa6fdffd12f03b0085b610bc1e49b6807c8020d74e7c807f955d15bf237
Opcode Fuzzy Hash: d1576440caa8bf982ce85922cf1aafd28daf7567ec881baa5e8f51bfed4d1b1e
Instruction Fuzzy Hash: 90E150719042488FDB18CF68C895BADBBF1BF49300F2582ADE419EB792D7749A81CF51

Function 00AC6C60 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00AC6F11
___std_exception_destroy.LIBVCRUNTIME ref: 00AC6F20

Strings

[json.exception., xrefs: 00AC6CB8

Memory Dump Source

Source File: 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.3306924399.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3306984601.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307574257.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308404955.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308895930.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.
API String ID: 4194217158-791563284
Opcode ID: 188976cc905c12027eb910c332698a03c9ae67cea862253f61415ea200413fd6
Instruction ID: 9d8d296db0fd236ba86c21df8e0317791b4f559ab2f08deb56668f41edbd6a9c
Opcode Fuzzy Hash: 188976cc905c12027eb910c332698a03c9ae67cea862253f61415ea200413fd6
Instruction Fuzzy Hash: 3E91D370A002089FDB18CF68D985BAEBBF6EF49300F20856DE415EB792D775E941CB51

Function 00B3E440 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00B3E491

Strings

type must be string, but is , xrefs: 00B3E4F8
type must be boolean, but is , xrefs: 00B3E582

Memory Dump Source

Source File: 00000006.00000002.3306984601.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.3306924399.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3306984601.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307574257.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3307631002.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308404955.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3308895930.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: type must be boolean, but is $type must be string, but is
API String ID: 118556049-436076039
Opcode ID: 1109152b339f7ba311d3b3f7e0792c7070ed3f9327311d212eae57a9ff48b696
Instruction ID: f633a4be1f317d805fed688ebf9235a045cb569f613c424180b95ccfa796bf4c
Opcode Fuzzy Hash: 1109152b339f7ba311d3b3f7e0792c7070ed3f9327311d212eae57a9ff48b696
Instruction Fuzzy Hash: D64168B1900248AFDB14EBA4E902BAE77E8DB14310F1446F9F429D77C2EB35E944C796

Analysis Process: MPGPH131.exePID: 2656, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	3.1%
Dynamic/Decrypted Code Coverage:	1.5%
Signature Coverage:	0%
Total number of Nodes:	537
Total number of Limit Nodes:	64

Executed Functions

Function 00B23A40 Relevance: 2.7, APIs: 2, Instructions: 157
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E9,?,00000001,00000000,?,?,?,?,?,?,?,?,00B23DB6), ref: 00B23B08
Sleep.KERNELBASE(00000001,?,00000001,00000000,?,?,?,?,?,?,?,?,00B23DB6), ref: 00B23BBA

Memory Dump Source

Source File: 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000007.00000002.3306173101.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306270230.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306741677.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3307908013.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3308222938.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: aef241a17ee97245d0f1123c6a95867acdd04326fbcc9dd2bd27b259776eb388
Instruction ID: a843aa4309982644a69a25c7a80f5f1bb068c8fb54b4ed55c4e080ecd21d8127
Opcode Fuzzy Hash: aef241a17ee97245d0f1123c6a95867acdd04326fbcc9dd2bd27b259776eb388
Instruction Fuzzy Hash: EC51AA35A042298FCB14CF58D4D4EADB7F1EF49B04B2945EAD449AF211D735EE06CB80

Function 00ADE0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00ADE0CB
socket.WS2_32(?,?,?), ref: 00ADE17F
connect.WS2_32(00000000,?,?), ref: 00ADE193
closesocket.WS2_32(00000000), ref: 00ADE19E

Memory Dump Source

Source File: 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000007.00000002.3306173101.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306270230.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306741677.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3307908013.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3308222938.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: 922273a58053b07d95fac71f11eb4c4c160724667c6182dfe0d3870a99245821
Instruction ID: 840066c4a30562c6850c60a9cc864742e4ce87d882d83aa376e0e9ad759c22e1
Opcode Fuzzy Hash: 922273a58053b07d95fac71f11eb4c4c160724667c6182dfe0d3870a99245821
Instruction Fuzzy Hash: A931B2716043016BD720EF258C49B2BB7E4EB85734F025F1EF9A99B2E0D37198048B92

Function 00BB4623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000007.00000002.3306173101.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306270230.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306741677.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3307908013.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3308222938.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e352905b24fd4a01fc60f3f0e5ad6473ee5152ff122656261f079821cdecb45d
Instruction ID: d8ea44cfa1093fbd383d1a45ab8972013d78da97d1c8da740b3abaa708d664af
Opcode Fuzzy Hash: e352905b24fd4a01fc60f3f0e5ad6473ee5152ff122656261f079821cdecb45d
Instruction Fuzzy Hash: 6FB1AD70A04245AFDB119FA9D881BFEBBF5FF46310F1441D8E885AB292CBB09D41CB61

Function 00ACA210 Relevance: 1.7, APIs: 1, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 00ACA343

Memory Dump Source

Source File: 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000007.00000002.3306173101.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306270230.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306741677.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3307908013.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3308222938.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 8f101fd2b624b52a65f3d30a2859025330979bfc9a43f787bfbb76aa40c6a653
Instruction ID: 4ddd15a23553c89ac603e9c2f195f5c7c09e4d5ae479fcc3ed78259f9e79b757
Opcode Fuzzy Hash: 8f101fd2b624b52a65f3d30a2859025330979bfc9a43f787bfbb76aa40c6a653
Instruction Fuzzy Hash: FD714970900248AFDB18DF68CC49BAEBBE8EF42304F1085ADF8059B782D7B599418791

Function 00BB549C Relevance: 1.7, APIs: 1, Instructions: 198
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000000,00BA9087,?,00000000,00000000,00000000,?,00000000,?,00ACA3EB,00BA9087,00000000,00ACA3EB,?,?), ref: 00BB5621

Memory Dump Source

Source File: 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000007.00000002.3306173101.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306270230.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306741677.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3307908013.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3308222938.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: e3e0ad0f7779209529994720295bf935ab0803d4561b36daaf5272cd3f4a1309
Instruction ID: ef5516619814fcbb1cf06c47010ed9a222c758ca34246c27d098581c9c74b6ea
Opcode Fuzzy Hash: e3e0ad0f7779209529994720295bf935ab0803d4561b36daaf5272cd3f4a1309
Instruction Fuzzy Hash: 1361A071904519AFDF219FA8C884FFEBBFAEF19304F140185E805A7256D7B1D901CBA2

Function 00BA4942 Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000007.00000002.3306173101.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306270230.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306741677.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3307908013.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3308222938.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acc89347469fc5a875324cb00f4bf7697ee50aa0afe06201ec885c46d77ea7c0
Instruction ID: c18e70237fb1df0c665182a74bc3c1e1dcac99ba557a6aaa654356e0ea53842e
Opcode Fuzzy Hash: acc89347469fc5a875324cb00f4bf7697ee50aa0afe06201ec885c46d77ea7c0
Instruction Fuzzy Hash: 1651A770A04108AFDB14CF58C885AAEBFF5EF8A354F248199F8499B252D3B1DE51CB94

Function 00B30560 Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00B306AE

Memory Dump Source

Source File: 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000007.00000002.3306173101.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306270230.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306741677.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3307908013.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3308222938.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction ID: 6654e9d136040b5eab32869f4265f139173806e9cb1ef6a4250f309ba01b183c
Opcode Fuzzy Hash: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction Fuzzy Hash: 6E410572A041189FCB05EF68D9916AE7BE5EF89310F2501E9F805EB306DB30DD608BE1

Function 00BB4B12 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,00BB49F9,00000000,CF830579,00BF1140,0000000C,00BB4AB5,00BA8BBD,?), ref: 00BB4B68

Memory Dump Source

Source File: 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000007.00000002.3306173101.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306270230.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306741677.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3307908013.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3308222938.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 6431941980fe41d3696a15763b609874c80909a1119346da4c6408c81620d1c5
Instruction ID: 8758e33e51304caeaa6f453f59656ed0b492967e3a7ea864ecc3ac028d9b3a22
Opcode Fuzzy Hash: 6431941980fe41d3696a15763b609874c80909a1119346da4c6408c81620d1c5
Instruction Fuzzy Hash: 87114833A441141BDA3426355845BFE7BC9DB827B0F2902CDFA598B1C3EFE0DC419195

Function 00BAE05C Relevance: 1.6, APIs: 1, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00BF0DF8,00ACA3EB,00000002,00ACA3EB,00000000,?,?,?,00BAE166,00000000,?,00ACA3EB,00000002,00BF0DF8), ref: 00BAE098

Memory Dump Source

Source File: 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000007.00000002.3306173101.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306270230.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306741677.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3307908013.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3308222938.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 2ca6be806fad8905e2281db48e5e1ac61a4ed3b3de57e080da914dfcaca430a4
Instruction ID: 94ee7f894395841b7f2da91ff391fd39f9d8c7fdeedb3bd7ef08b20fdbc14eab
Opcode Fuzzy Hash: 2ca6be806fad8905e2281db48e5e1ac61a4ed3b3de57e080da914dfcaca430a4
Instruction Fuzzy Hash: 9C01DB32614155AFCF159F55CC46D9E3BAADB82330F240188F861972D1E6B1ED51DBD0

Function 00B9F290 Relevance: 1.6, APIs: 1, Instructions: 51
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00AC220E

Memory Dump Source

Source File: 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000007.00000002.3306173101.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306270230.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306741677.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3307908013.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3308222938.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: b859dd82a4120a5fa9326d0f09865fb01e21d37ef7c9801e0945d7cd010f2441
Instruction ID: 31db5da4e7167cf896e25b0c62d1466188283e0b1377cbf0636a470b80f114ec
Opcode Fuzzy Hash: b859dd82a4120a5fa9326d0f09865fb01e21d37ef7c9801e0945d7cd010f2441
Instruction Fuzzy Hash: 23012B7650430EABCF14AFACD801AAA77ECDA01320F5444B9FA19DB691EB70E9548790

Function 00BB63F3 Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,00BA91F7,00000000,?,00BB5D79,00000001,00000364,00000000,00000006,000000FF,?,00000000,00BAD244,00BA89C3,00BA91F7,00000000), ref: 00BB6435

Memory Dump Source

Source File: 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000007.00000002.3306173101.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306270230.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306741677.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3307908013.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3308222938.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 191de1944743328cd3f2d23b95d3bff07c32ffeb8608f1e9e38b3d0c8ede4dcd
Instruction ID: 4b66ecf0727c0744beef30b31ee63505b4b19ee02ac6fc45d4427817fd181679
Opcode Fuzzy Hash: 191de1944743328cd3f2d23b95d3bff07c32ffeb8608f1e9e38b3d0c8ede4dcd
Instruction Fuzzy Hash: 04F0E931505E24679B216B669C16BFB3BC8DF81764F2580D2EC0497280CEF4DC1086F1

Function 00BB6E2D Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00BBD635,4D88C033,?,00BBD635,00000220,?,00BB57EF,4D88C033), ref: 00BB6E60

Memory Dump Source

Source File: 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000007.00000002.3306173101.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306270230.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306741677.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3307908013.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3308222938.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 70738a5c0981e7d8a39397df4415cf2681f110c7a68f1cd81e3b4c43e52d4ef2
Instruction ID: 33359292537173386a24d6f70caee569159cc8d72045dd71dec6d2ec3723a2bf
Opcode Fuzzy Hash: 70738a5c0981e7d8a39397df4415cf2681f110c7a68f1cd81e3b4c43e52d4ef2
Instruction Fuzzy Hash: 0FE0ED391416216BDA3122AACD10BFB77C8DF927A0F1505E1EC0593090CFE8CC0087A4

Function 05570383 Relevance: 1.5, APIs: 1, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 055703A3

Memory Dump Source

Source File: 00000007.00000002.3314301778.0000000005570000.00000040.00001000.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5570000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 374ab46cafe290cb9f3895f30733fe7b59d841c1cb193db65b6be0194bcf701e
Instruction ID: d07907324e48fef77cec1acd97f62b2426450db361f944bcd7c4adcc520db02e
Opcode Fuzzy Hash: 374ab46cafe290cb9f3895f30733fe7b59d841c1cb193db65b6be0194bcf701e
Instruction Fuzzy Hash: 88E0689610C3246FDB03D17921E84B23BE7EC6313032804766081831E1EA5590845401

Function 05570369 Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 055703A3

Memory Dump Source

Source File: 00000007.00000002.3314301778.0000000005570000.00000040.00001000.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5570000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: dc8d5de9b7ef88dc34fb7a8142d4832e68d754ab555b383ff57f47de160038eb
Instruction ID: 1b41e5fdf89c00d4193b472be70fff32a6527050ae5b13e49961ffad57ad482b
Opcode Fuzzy Hash: dc8d5de9b7ef88dc34fb7a8142d4832e68d754ab555b383ff57f47de160038eb
Instruction Fuzzy Hash: 32E0C2EA00C3216F6203E1E912884F52DCFEC2323033114B630E2C56D1EAD44841A836

Non-executed Functions

Function 00BA84A0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000007.00000002.3306173101.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306270230.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306741677.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3307908013.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3308222938.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction ID: 85fb7a385549add2261a335dbe85095800b94224ab5cabc2f4b36f67bf465112
Opcode Fuzzy Hash: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction Fuzzy Hash: BC022B71E052199BDF14CFA9C9806AEBBF1FF49314F2482A9D919E7780DB31AD418B90

Function 00B2F810 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B2F833
std::_Lockit::_Lockit.LIBCPMT ref: 00B2F855
std::_Lockit::~_Lockit.LIBCPMT ref: 00B2F875
std::_Lockit::~_Lockit.LIBCPMT ref: 00B2F89F
std::_Lockit::_Lockit.LIBCPMT ref: 00B2F90D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00B2F959
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00B2F973
std::_Lockit::~_Lockit.LIBCPMT ref: 00B2FA08
std::_Facet_Register.LIBCPMT ref: 00B2FA15

Strings

bad locale name, xrefs: 00B2FA2F
Ps, xrefs: 00B2F96B, 00B2F972

Memory Dump Source

Source File: 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000007.00000002.3306173101.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306270230.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306741677.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3307908013.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3308222938.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$Ps
API String ID: 3375549084-1174896957
Opcode ID: 27fc1ea46a1138264f80f2fba7d44894dcb94915ffdf6505b84a48f03be709bc
Instruction ID: 4cfbeec4d1450ac204fe8f61323992ea968922fe3836065a1ce99eccef71ded6
Opcode Fuzzy Hash: 27fc1ea46a1138264f80f2fba7d44894dcb94915ffdf6505b84a48f03be709bc
Instruction Fuzzy Hash: 176168B1D00259DBEF10DFA5E845BAEBBF4AF14750F1441B8E819AB341EB34E905CBA1

Function 00AC39F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00AC3A58
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00AC3AA4
__Getctype.LIBCPMT ref: 00AC3ABA
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00AC3AE6
std::_Lockit::~_Lockit.LIBCPMT ref: 00AC3B7B

Strings

bad locale name, xrefs: 00AC3B96

Memory Dump Source

Source File: 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000007.00000002.3306173101.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306270230.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306741677.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3307908013.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3308222938.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: f222bffe6cc8bb618aa29c7b635bc48fd543be8222f4f0e8a105be71c4b7f434
Instruction ID: f9e5782c862bcdbf26a80af3162d4fa32c92a4611b1a6a77564cd264c69b3dc4
Opcode Fuzzy Hash: f222bffe6cc8bb618aa29c7b635bc48fd543be8222f4f0e8a105be71c4b7f434
Instruction Fuzzy Hash: 4E5130B2D012489BDF14DFA5D985F9EBBF8AF14310F1480A9E809AB341E775DE04CBA1

Function 00BA2E10 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00BA2E47
___except_validate_context_record.LIBVCRUNTIME ref: 00BA2E4F
_ValidateLocalCookies.LIBCMT ref: 00BA2ED8
__IsNonwritableInCurrentImage.LIBCMT ref: 00BA2F03
_ValidateLocalCookies.LIBCMT ref: 00BA2F58

Strings

csm, xrefs: 00BA2EED

Memory Dump Source

Source File: 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000007.00000002.3306173101.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306270230.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306741677.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3307908013.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3308222938.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 8b0a68fb37b8baebe0f52324572a0dab609c93fba674c4c7baef137ba043c79b
Instruction ID: 0032578aad216d509f3a6039e8b86530cdfeecb1d2a05d415d2faafc4479176d
Opcode Fuzzy Hash: 8b0a68fb37b8baebe0f52324572a0dab609c93fba674c4c7baef137ba043c79b
Instruction Fuzzy Hash: 15418F34A08209AFCF10DF6CC885A9EBBF5EF46314F1480A6E9149B752D732DE55CB91

Function 00B2DE70 Relevance: 9.1, APIs: 6, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B2DE93
std::_Lockit::_Lockit.LIBCPMT ref: 00B2DEB6
std::_Lockit::~_Lockit.LIBCPMT ref: 00B2DED6
std::_Facet_Register.LIBCPMT ref: 00B2DF4B
std::_Lockit::~_Lockit.LIBCPMT ref: 00B2DF63
Concurrency::cancel_current_task.LIBCPMT ref: 00B2DF7B

Memory Dump Source

Source File: 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000007.00000002.3306173101.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306270230.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306741677.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3307908013.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3308222938.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 5f80820928cbcb0542637db3f1c9cde7fe022feb55b4c730a96c04bb0b7027fc
Instruction ID: 8fd36bc807609bc677973bf11204981e3ed0825472d475b7b62f01ca31e5d29f
Opcode Fuzzy Hash: 5f80820928cbcb0542637db3f1c9cde7fe022feb55b4c730a96c04bb0b7027fc
Instruction Fuzzy Hash: 0541E2719002299FCF14DF58E985AAEBBF4FB14720F2442A9E8196B352DB31AD01CBD5

Function 00AC4C50 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 442COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00AC4F72
___std_exception_destroy.LIBVCRUNTIME ref: 00AC4FFF
___std_exception_copy.LIBVCRUNTIME ref: 00AC50C8

Strings

recursive_directory_iterator::operator++, xrefs: 00AC504C

Memory Dump Source

Source File: 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000007.00000002.3306173101.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306270230.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306741677.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3307908013.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3308222938.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$___std_exception_copy
String ID: recursive_directory_iterator::operator++
API String ID: 1206660477-953255998
Opcode ID: 06d683135217b3344a21e517b03c3dc3e840dfab4d10ead830902ccdb3f44286
Instruction ID: 9b3039e7a2e3af20509614b8547becf26240ed36361e3a1678be40fb7994a856
Opcode Fuzzy Hash: 06d683135217b3344a21e517b03c3dc3e840dfab4d10ead830902ccdb3f44286
Instruction Fuzzy Hash: 32E111719002049FCB28DF68D855FAEBBF9FF48700F108A6DE45693781EB74A904CBA5

Function 00AC7820 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00AC799A
___std_exception_copy.LIBVCRUNTIME ref: 00AC7B75

Strings

type_error, xrefs: 00AC784A
out_of_range, xrefs: 00AC7A27

Memory Dump Source

Source File: 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000007.00000002.3306173101.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306270230.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306741677.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3307908013.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3308222938.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: out_of_range$type_error
API String ID: 2659868963-3702451861
Opcode ID: 1a2114e8b9b3736c364a3e400db2fcb3f4236e2e221efafcf4100f5af4914074
Instruction ID: 868ec8f48a8d822f2879e11f6785519944aa2dbb59df82fabee5a92982ae1761
Opcode Fuzzy Hash: 1a2114e8b9b3736c364a3e400db2fcb3f4236e2e221efafcf4100f5af4914074
Instruction Fuzzy Hash: AFC157B19042488FDB58CFA8D984BADBBF5FB48310F14866DE419EB791E774A9808F50

Function 00AC73B0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00AC75BE
___std_exception_destroy.LIBVCRUNTIME ref: 00AC75CD

Strings

at line , xrefs: 00AC73F7
, column , xrefs: 00AC7434, 00AC744A

Memory Dump Source

Source File: 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000007.00000002.3306173101.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306270230.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306741677.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3307908013.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3308222938.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column
API String ID: 4194217158-191570568
Opcode ID: 5b2fd3fd5aeaf37cdea0c19e163b6c93dd1afd29d140096dc08917175e95084e
Instruction ID: 7552dc4c190d2e6e3f5277bd6b53dd518d3c5f6cd3f8d0d07af43a1de15d7c98
Opcode Fuzzy Hash: 5b2fd3fd5aeaf37cdea0c19e163b6c93dd1afd29d140096dc08917175e95084e
Instruction Fuzzy Hash: A561D071A042099FDB08DF68DD84BADBBF6FF49310F24866CE415A7B81D774AA408B91

Function 00AC3D10 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00AC3E7F

Strings

ios_base::eofbit set, xrefs: 00AC3E41, 00AC3E63
ios_base::badbit set, xrefs: 00AC3E17
ios_base::failbit set, xrefs: 00AC3D32

Memory Dump Source

Source File: 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000007.00000002.3306173101.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306270230.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306741677.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3307908013.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3308222938.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: 64760899284bdc203de92c878f8312882bc4cd5316fd6182ce6ef5f97b07c997
Instruction ID: be76d91f285865abd0e8caba9114032320570ca9839f811d1adec0f6e370f693
Opcode Fuzzy Hash: 64760899284bdc203de92c878f8312882bc4cd5316fd6182ce6ef5f97b07c997
Instruction Fuzzy Hash: 8141A2B2900209AFCB14DF68C845FAEB7F9EB49310F14C56EF915D7641E770AA058BA0

Function 00AC3DE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00AC3E7F

Strings

ios_base::eofbit set, xrefs: 00AC3E28, 00AC3E41, 00AC3E63
ios_base::badbit set, xrefs: 00AC3E17
ios_base::failbit set, xrefs: 00AC3D32, 00AC3E1E

Memory Dump Source

Source File: 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000007.00000002.3306173101.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306270230.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306741677.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3307908013.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3308222938.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: bd54f41b935f528c61754060c0528d737e060ea44de3b68a8a2ca6c75aa1808f
Instruction ID: 4052d86fbc2483f60695960b666e890c5b9235b1ab82e33ed48b401c2b000177
Opcode Fuzzy Hash: bd54f41b935f528c61754060c0528d737e060ea44de3b68a8a2ca6c75aa1808f
Instruction Fuzzy Hash: AF21D5B39043056FCB14DF58D805F96B7ECAB05310F18C8AEFA698B641E774EA148B95

Function 00AC6F40 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 349COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00AC7340

Strings

parse_error, xrefs: 00AC6F8B
parse error, xrefs: 00AC6FFF, 00AC7018

Memory Dump Source

Source File: 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000007.00000002.3306173101.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306270230.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306741677.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3307908013.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3308222938.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: parse error$parse_error
API String ID: 2659868963-1820534363
Opcode ID: d1576440caa8bf982ce85922cf1aafd28daf7567ec881baa5e8f51bfed4d1b1e
Instruction ID: 98165fa6fdffd12f03b0085b610bc1e49b6807c8020d74e7c807f955d15bf237
Opcode Fuzzy Hash: d1576440caa8bf982ce85922cf1aafd28daf7567ec881baa5e8f51bfed4d1b1e
Instruction Fuzzy Hash: 90E150719042488FDB18CF68C895BADBBF1BF49300F2582ADE419EB792D7749A81CF51

Function 00AC6C60 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00AC6F11
___std_exception_destroy.LIBVCRUNTIME ref: 00AC6F20

Strings

[json.exception., xrefs: 00AC6CB8

Memory Dump Source

Source File: 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000007.00000002.3306173101.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306270230.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306741677.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3307908013.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3308222938.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.
API String ID: 4194217158-791563284
Opcode ID: 188976cc905c12027eb910c332698a03c9ae67cea862253f61415ea200413fd6
Instruction ID: 9d8d296db0fd236ba86c21df8e0317791b4f559ab2f08deb56668f41edbd6a9c
Opcode Fuzzy Hash: 188976cc905c12027eb910c332698a03c9ae67cea862253f61415ea200413fd6
Instruction Fuzzy Hash: 3E91D370A002089FDB18CF68D985BAEBBF6EF49300F20856DE415EB792D775E941CB51

Function 00B3E440 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00B3E491

Strings

type must be string, but is , xrefs: 00B3E4F8
type must be boolean, but is , xrefs: 00B3E582

Memory Dump Source

Source File: 00000007.00000002.3306270230.0000000000AC1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000007.00000002.3306173101.0000000000AC0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306270230.0000000000BF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306741677.0000000000BF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000BFC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000D81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000E71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3306828991.0000000000EC0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3307908013.0000000000EC1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3308222938.000000000106A000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ac0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: type must be boolean, but is $type must be string, but is
API String ID: 118556049-436076039
Opcode ID: 1109152b339f7ba311d3b3f7e0792c7070ed3f9327311d212eae57a9ff48b696
Instruction ID: f633a4be1f317d805fed688ebf9235a045cb569f613c424180b95ccfa796bf4c
Opcode Fuzzy Hash: 1109152b339f7ba311d3b3f7e0792c7070ed3f9327311d212eae57a9ff48b696
Instruction Fuzzy Hash: D64168B1900248AFDB14EBA4E902BAE77E8DB14310F1446F9F429D77C2EB35E944C796

Analysis Process: RageMP131.exePID: 7324, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	1.8%
Signature Coverage:	0%
Total number of Nodes:	661
Total number of Limit Nodes:	69

Executed Functions

Function 009D3A40 Relevance: 2.7, APIs: 2, Instructions: 157
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E9,?,00000001,00000000,?,?,?,?,?,?,?,?,009D3DB6), ref: 009D3B08
Sleep.KERNELBASE(00000001,?,00000001,00000000,?,?,?,?,?,?,?,?,009D3DB6), ref: 009D3BBA

Memory Dump Source

Source File: 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000008.00000002.3307833701.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3307879772.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308139365.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308951526.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3309516714.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: e56891dd38a70376b920cd370b51b52a32c08d9c619c39c54c3e76d6581a63ca
Instruction ID: 96011418f801ff0ddb25ca1aeab65524751f667dc1fe500e3356119b915fe111
Opcode Fuzzy Hash: e56891dd38a70376b920cd370b51b52a32c08d9c619c39c54c3e76d6581a63ca
Instruction Fuzzy Hash: FE51A835A842198FCB24CF98C8D0EBAB3B9EF45705B28C59AD445AF351D735EE05CB81

Function 0098E0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 0098E0CA
socket.WS2_32(?,?,?), ref: 0098E17F
connect.WS2_32(00000000,?,?), ref: 0098E193
closesocket.WS2_32(00000000), ref: 0098E19E

Memory Dump Source

Source File: 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000008.00000002.3307833701.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3307879772.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308139365.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308951526.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3309516714.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: e4ad4b7d373d7cf34e08a74833548af83ea9f25b4ff99304a2c4c32c9eeab7b9
Instruction ID: 1e50f72f70db71204d25c6c43c813d5db6f7064918dd7c92240c699c05e1c34a
Opcode Fuzzy Hash: e4ad4b7d373d7cf34e08a74833548af83ea9f25b4ff99304a2c4c32c9eeab7b9
Instruction Fuzzy Hash: EE31A1726083016FD720AF658C99B2BB7E8EB85734F115F1DF9A8963E0D37598048B92

Function 00A64623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000008.00000002.3307833701.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3307879772.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308139365.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308951526.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3309516714.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9471816ad183e4072d86bde9caab6c303d7200abb614fd37e1fe2f6f7585a92
Instruction ID: 60baa6d24c3899841f72a000eb63d0ca8d00ad98d922bd03530e5347faa0219d
Opcode Fuzzy Hash: b9471816ad183e4072d86bde9caab6c303d7200abb614fd37e1fe2f6f7585a92
Instruction Fuzzy Hash: 01B1F371E04349AFEB11DFA8D881BAEBBB1BF4E314F144158E954AB382C7719D42CB60

Function 0097A210 Relevance: 1.7, APIs: 1, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 0097A343

Memory Dump Source

Source File: 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000008.00000002.3307833701.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3307879772.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308139365.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308951526.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3309516714.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: ebba9b5c1f73132d745a023ada7eb5f3e56ab24057562a7ccd3c1161bda8c495
Instruction ID: fcddcf7f82cd06ecc44d21ee6dba7edfd77afb2af18734544624bda01fbf3ea0
Opcode Fuzzy Hash: ebba9b5c1f73132d745a023ada7eb5f3e56ab24057562a7ccd3c1161bda8c495
Instruction Fuzzy Hash: 09716B71900205AFDB14DF68CD45BAEBBE8FF81704F10856DF8099B282E7B5DA44CB92

Function 00A6549C Relevance: 1.7, APIs: 1, Instructions: 198
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000000,00A59087,?,00000000,00000000,00000000,?,00000000,?,0097A3EB,00A59087,00000000,0097A3EB,?,?), ref: 00A65621

Memory Dump Source

Source File: 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000008.00000002.3307833701.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3307879772.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308139365.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308951526.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3309516714.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 6ede1ab7756e6832f3ad09db64df0161ae9e3b6320570533dbf1d1d8e5764392
Instruction ID: 42907795745cb78e1a12761c3a1ba64e237075381966769782e641aa1180c025
Opcode Fuzzy Hash: 6ede1ab7756e6832f3ad09db64df0161ae9e3b6320570533dbf1d1d8e5764392
Instruction Fuzzy Hash: F161B3B6D04519AFDF11DFB8CD48EEEBBBAAF09304F180189E801A7255D772D911CBA0

Function 04C10777 Relevance: 1.7, APIs: 1, Instructions: 174
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C10786

Memory Dump Source

Source File: 00000008.00000002.3314632522.0000000004C10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4c10000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 8f4e15db1ee904c50b18ea0fd959d6a0ffb4b0261cb37f29b8d81a0980258d5f
Instruction ID: 15b3c3287398d9236a98e5cf06ed107e77a018f2e20a52616671357cfb32811c
Opcode Fuzzy Hash: 8f4e15db1ee904c50b18ea0fd959d6a0ffb4b0261cb37f29b8d81a0980258d5f
Instruction Fuzzy Hash: 9C31E1EB34D111BDB10281832B24AFA6B2FE6D77307388476F907D1922F6C46AC975B0

Function 00A54942 Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000008.00000002.3307833701.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3307879772.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308139365.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308951526.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3309516714.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb3d1853bb73271abcc082419a7637254e54dd437727159dfa2d75c0e4455a09
Instruction ID: f7733db2ea583a5b7cb528d6510cef07c4aa86e6b92de43dfbaf766b49299466
Opcode Fuzzy Hash: fb3d1853bb73271abcc082419a7637254e54dd437727159dfa2d75c0e4455a09
Instruction Fuzzy Hash: ED51C670A00108AFDB54CF58CC81AAABFB1FF4D369F248158FD499B252D3319E85CB90

Function 009E0560 Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 009E06AE

Memory Dump Source

Source File: 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000008.00000002.3307833701.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3307879772.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308139365.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308951526.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3309516714.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction ID: bfb87c6db5d751a9a300851af93400cfbac8374cbaa6342a9cb56f901a48dcec
Opcode Fuzzy Hash: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction Fuzzy Hash: 7241E572A001549FCB16DF69D9806AE7BA9BFC8310F140669FC05DB306DB70DDA08BE1

Function 00A64B12 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,00A649F9,00000000,CF830579,00AA1140,0000000C,00A64AB5,00A58BBD,?), ref: 00A64B68

Memory Dump Source

Source File: 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000008.00000002.3307833701.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3307879772.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308139365.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308951526.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3309516714.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 170c1e8db5a26c68acbc55d5ddb96c804081f2e57d8ca5324cde8395b73af79a
Instruction ID: ffc6df3f2cadcb90990fa1419949dc177c4b317d025d9b6d8bf7ba76243c2c2e
Opcode Fuzzy Hash: 170c1e8db5a26c68acbc55d5ddb96c804081f2e57d8ca5324cde8395b73af79a
Instruction Fuzzy Hash: 5C116633A4022816D7257774E901B7EA7BACB9B774F290249F818AB0C2EF21EC824555

Function 00A5E05C Relevance: 1.6, APIs: 1, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00AA0DF8,0097A3EB,00000002,0097A3EB,00000000,?,?,?,00A5E166,00000000,?,0097A3EB,00000002,00AA0DF8), ref: 00A5E098

Memory Dump Source

Source File: 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000008.00000002.3307833701.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3307879772.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308139365.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308951526.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3309516714.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 15963079bd9bc53b1a04b86de24b70cbe99455e6340db27d94b984d6c7dbebc1
Instruction ID: c0b22fa22f408c6605be8f7df0be2d69040707ff468f88a1acf46d643dde28ed
Opcode Fuzzy Hash: 15963079bd9bc53b1a04b86de24b70cbe99455e6340db27d94b984d6c7dbebc1
Instruction Fuzzy Hash: BB01D632654159AFCF19DF59CC05C9E7B6AEB81335F240248FC509B2D1EAB2EE419BD0

Function 00A4F290 Relevance: 1.6, APIs: 1, Instructions: 51
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0097220E

Memory Dump Source

Source File: 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000008.00000002.3307833701.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3307879772.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308139365.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308951526.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3309516714.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 992a921226d8e4bb8ded6109923904ed1d90e9934d4cba8afb87cc543ea86abe
Instruction ID: 22a2696d432a6608e5b4a9cbd8fbeaa13c2650574e6b1bb6af919cd6a819077d
Opcode Fuzzy Hash: 992a921226d8e4bb8ded6109923904ed1d90e9934d4cba8afb87cc543ea86abe
Instruction Fuzzy Hash: 4201DB7A50430DAFCB14AFA8DC029997BACEA00310B54C43AFE1DDB591E770E954C791

Function 00A663F3 Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,00A591F7,00000000,?,00A65D79,00000001,00000364,00000000,00000006,000000FF,?,00000000,00A5D244,00A589C3,00A591F7,00000000), ref: 00A66435

Memory Dump Source

Source File: 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000008.00000002.3307833701.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3307879772.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308139365.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308951526.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3309516714.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: fa3a87d192a437a755ab2ddda1eccd140c05e05c0e54a564e2e30db1aa17cc4e
Instruction ID: 529a3740cc3afaf9aba86e3d9cf37160191f23531ed3d7e6cac42fe0b8cc6c97
Opcode Fuzzy Hash: fa3a87d192a437a755ab2ddda1eccd140c05e05c0e54a564e2e30db1aa17cc4e
Instruction Fuzzy Hash: DFF08931545125669B216B629F0AB6B7B7DEF51764F158411EC09961C0CF30E81146F1

Function 00A66E2D Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00A6D635,4D88C033,?,00A6D635,00000220,?,00A657EF,4D88C033), ref: 00A66E60

Memory Dump Source

Source File: 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000008.00000002.3307833701.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3307879772.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308139365.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308951526.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3309516714.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f6ea76123649671ffa8d5dad7d9a81f59ef093a178b06071640ac11d5c94d6e0
Instruction ID: 83dce4a03c76eb5cafc993d983e3c4f171c3a032bb6410c7a1a75b8e3675f6c7
Opcode Fuzzy Hash: f6ea76123649671ffa8d5dad7d9a81f59ef093a178b06071640ac11d5c94d6e0
Instruction Fuzzy Hash: 34E0223A9006226ADB3123A6DE00BAB7A7DDF823B0F050520FD05D60D0CB22CC0081E4

Non-executed Functions

Function 00A584A0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000008.00000002.3307833701.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3307879772.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308139365.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308951526.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3309516714.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction ID: f55709fc0da3e202e67fb7834342b0a84c7d97547c7a0f559539964932f7284a
Opcode Fuzzy Hash: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction Fuzzy Hash: A7024A71E012199FDF14CFA9C9806AEBBB1FF48315F248269E919F7380DB35A905CB90

Function 009DF810 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 009DF833
std::_Lockit::_Lockit.LIBCPMT ref: 009DF855
std::_Lockit::~_Lockit.LIBCPMT ref: 009DF875
std::_Lockit::~_Lockit.LIBCPMT ref: 009DF89F
std::_Lockit::_Lockit.LIBCPMT ref: 009DF90D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 009DF959
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 009DF973
std::_Lockit::~_Lockit.LIBCPMT ref: 009DFA08
std::_Facet_Register.LIBCPMT ref: 009DFA15

Strings

bad locale name, xrefs: 009DFA2F
Ps, xrefs: 009DF96B, 009DF972

Memory Dump Source

Source File: 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000008.00000002.3307833701.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3307879772.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308139365.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308951526.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3309516714.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$Ps
API String ID: 3375549084-1174896957
Opcode ID: ce95517ed9ae2262f36a7bb950abbeed97c1b7178fe02e524446ade995658edb
Instruction ID: 63c04cd3117b45367caeea04aac56310e997395aa275b6a4486d6387f2ce2557
Opcode Fuzzy Hash: ce95517ed9ae2262f36a7bb950abbeed97c1b7178fe02e524446ade995658edb
Instruction Fuzzy Hash: 8561D375D40209DFEF20DFA4D956B9EBBB8BF54310F148469E806AB381D734E905CB92

Function 009739F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00973A58
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00973AA4
__Getctype.LIBCPMT ref: 00973ABA
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00973AE6
std::_Lockit::~_Lockit.LIBCPMT ref: 00973B7B

Strings

bad locale name, xrefs: 00973B96

Memory Dump Source

Source File: 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000008.00000002.3307833701.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3307879772.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308139365.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308951526.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3309516714.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: c5beb7f35607ab28adfb175a2fb8cd48f15b82678a3e6ac1a652ca2eb6326910
Instruction ID: c25b72d9592859a4a20287e6987b0670515d93d32aa92165fe26244d2b11b8ed
Opcode Fuzzy Hash: c5beb7f35607ab28adfb175a2fb8cd48f15b82678a3e6ac1a652ca2eb6326910
Instruction Fuzzy Hash: B35120B5D002489FEF10DFA4D985B9EBBF8BF58314F148169E809AB341E775DA08CB91

Function 00A52E10 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00A52E47
___except_validate_context_record.LIBVCRUNTIME ref: 00A52E4F
_ValidateLocalCookies.LIBCMT ref: 00A52ED8
__IsNonwritableInCurrentImage.LIBCMT ref: 00A52F03
_ValidateLocalCookies.LIBCMT ref: 00A52F58

Strings

csm, xrefs: 00A52EED

Memory Dump Source

Source File: 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000008.00000002.3307833701.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3307879772.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308139365.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308951526.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3309516714.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 251493b1658508df91dbb4437bb223f77a8850d36551bf654a9003fb8abeab18
Instruction ID: 4a8beedb1b9461fc914fa3c721791dedbc84442d50f1b624fa15cc6961a56c10
Opcode Fuzzy Hash: 251493b1658508df91dbb4437bb223f77a8850d36551bf654a9003fb8abeab18
Instruction Fuzzy Hash: F5419E31A00209ABCF10DF68D885B9EBBB5BF46326F148455EC189B392D731EE59CB91

Function 009DDE70 Relevance: 9.1, APIs: 6, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 009DDE93
std::_Lockit::_Lockit.LIBCPMT ref: 009DDEB6
std::_Lockit::~_Lockit.LIBCPMT ref: 009DDED6
std::_Facet_Register.LIBCPMT ref: 009DDF4B
std::_Lockit::~_Lockit.LIBCPMT ref: 009DDF63
Concurrency::cancel_current_task.LIBCPMT ref: 009DDF7B

Memory Dump Source

Source File: 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000008.00000002.3307833701.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3307879772.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308139365.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308951526.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3309516714.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: cef3f70264490103a738cd5e9a658d8bd2c9932134364ed8dd810084ae79dd27
Instruction ID: e8fe439aa1ca1698fd6cc0f4a8d19c63444e17841397188fc35c44d37f2b361b
Opcode Fuzzy Hash: cef3f70264490103a738cd5e9a658d8bd2c9932134364ed8dd810084ae79dd27
Instruction Fuzzy Hash: 3C411271950216DFCB14DF98D841BAEBBB8FB46320F14866AE8159B392D730AD01CBE1

Function 00974C50 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 442COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00974F72
___std_exception_destroy.LIBVCRUNTIME ref: 00974FFF
___std_exception_copy.LIBVCRUNTIME ref: 009750C8

Strings

recursive_directory_iterator::operator++, xrefs: 0097504C

Memory Dump Source

Source File: 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000008.00000002.3307833701.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3307879772.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308139365.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308951526.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3309516714.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$___std_exception_copy
String ID: recursive_directory_iterator::operator++
API String ID: 1206660477-953255998
Opcode ID: 05034be23e4068c2c5b043ef95e177546d577267b8a25ef4d2fd9ef76001aaef
Instruction ID: b50a748b530d497b2759373a759b92376b38342d0ce41469dd6446c20653b8e9
Opcode Fuzzy Hash: 05034be23e4068c2c5b043ef95e177546d577267b8a25ef4d2fd9ef76001aaef
Instruction Fuzzy Hash: 30E115729002059FCB28DF68DD45B9EBBF9FF44300F148A2DE45A97782E774A944CBA1

Function 00977820 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0097799A
___std_exception_copy.LIBVCRUNTIME ref: 00977B75

Strings

type_error, xrefs: 0097784A
out_of_range, xrefs: 00977A27

Memory Dump Source

Source File: 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000008.00000002.3307833701.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3307879772.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308139365.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308951526.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3309516714.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: out_of_range$type_error
API String ID: 2659868963-3702451861
Opcode ID: 509614cdfe7299ca9431f89595ce8d8b327c487984186a240a8b98e915a3d215
Instruction ID: 569b8b12be433b157e908daacca14439ed5c5c42c22b36365998bceaea0f54e1
Opcode Fuzzy Hash: 509614cdfe7299ca9431f89595ce8d8b327c487984186a240a8b98e915a3d215
Instruction Fuzzy Hash: 64C147B1D012089FDB18DFA8D984B9DFBF5FF48300F14866AE419EB791E77499808B51

Function 009773B0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 009775BE
___std_exception_destroy.LIBVCRUNTIME ref: 009775CD

Strings

, column , xrefs: 00977434, 0097744A
at line , xrefs: 009773F7

Memory Dump Source

Source File: 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000008.00000002.3307833701.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3307879772.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308139365.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308951526.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3309516714.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column
API String ID: 4194217158-191570568
Opcode ID: 06333f5a0d154ea9e27abbc6aa15f4c326c86b2fcb0a9f0046d5e58748153fb4
Instruction ID: d88c99eca1c0e348eefbe21aafcd950425fa6d7cb98718a424258a3a870d248a
Opcode Fuzzy Hash: 06333f5a0d154ea9e27abbc6aa15f4c326c86b2fcb0a9f0046d5e58748153fb4
Instruction Fuzzy Hash: 3E61C471A042059FDB08DFA8DD85BADFBB6FF84300F24862CF419A7791D774AA448B91

Function 00973D10 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00973E7F

Strings

ios_base::failbit set, xrefs: 00973D32
ios_base::badbit set, xrefs: 00973E17
ios_base::eofbit set, xrefs: 00973E41, 00973E63

Memory Dump Source

Source File: 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000008.00000002.3307833701.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3307879772.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308139365.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308951526.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3309516714.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: 62f00ca119f38a5272209346b175ad7011acff66e509405378e49455914f4586
Instruction ID: 4b60929013bc6c6b414cf6f1c8d5666f977da76cc58d54a0f2b2aae3ad228e65
Opcode Fuzzy Hash: 62f00ca119f38a5272209346b175ad7011acff66e509405378e49455914f4586
Instruction Fuzzy Hash: 234193B6900208AFCB14DF68CC45B9EB7F8FF49710F14C52AF919D7681E774AA058BA1

Function 00973DE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00973E7F

Strings

ios_base::failbit set, xrefs: 00973D32, 00973E1E
ios_base::badbit set, xrefs: 00973E17
ios_base::eofbit set, xrefs: 00973E28, 00973E41, 00973E63

Memory Dump Source

Source File: 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000008.00000002.3307833701.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3307879772.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308139365.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308951526.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3309516714.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: 94649afaf1194d6202ef468b41f9a190fad77f45f5a584f6a4b91849c2785a74
Instruction ID: b949226de5ec7f3a08aa8dcfd7a9c7d35bd240fe2b9e4922b1f02074032ef121
Opcode Fuzzy Hash: 94649afaf1194d6202ef468b41f9a190fad77f45f5a584f6a4b91849c2785a74
Instruction Fuzzy Hash: DB2193B39047056FC714DE68D806B96B7DCAF44310F18C82AFA6C8B641E774EA14DB91

Function 00976F40 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 349COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00977340

Strings

parse_error, xrefs: 00976F8B
parse error, xrefs: 00976FFF, 00977018

Memory Dump Source

Source File: 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000008.00000002.3307833701.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3307879772.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308139365.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308951526.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3309516714.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: parse error$parse_error
API String ID: 2659868963-1820534363
Opcode ID: 05619d92f5c47758a82992666685f69589250bb8e0a527cce3c6fdef5c60cfcf
Instruction ID: eb2a72d160af7af67bdb59b79d3033e3b5e7c0a2e951242b18886a73271e84c0
Opcode Fuzzy Hash: 05619d92f5c47758a82992666685f69589250bb8e0a527cce3c6fdef5c60cfcf
Instruction Fuzzy Hash: 29E17F719042099FDB18CFA8D984B9DFBF1BF49300F248269E419EB792D7749A81CF91

Function 00976C60 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00976F11
___std_exception_destroy.LIBVCRUNTIME ref: 00976F20

Strings

[json.exception., xrefs: 00976CB8

Memory Dump Source

Source File: 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000008.00000002.3307833701.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3307879772.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308139365.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308951526.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3309516714.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.
API String ID: 4194217158-791563284
Opcode ID: 39ab16f2ef354aebdf1e4cb817c734e2cfe09b6fff32e3b69d78e6814c3df5e2
Instruction ID: 1ec21d78b14eb068462ac72ed4894373c312f8e587931c31e0e94822ad73d509
Opcode Fuzzy Hash: 39ab16f2ef354aebdf1e4cb817c734e2cfe09b6fff32e3b69d78e6814c3df5e2
Instruction Fuzzy Hash: 1991F671A006059FDB18CF68C984B9EBBF5FF45300F20C62CE459AB792D771AA41CB91

Function 009EE440 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 009EE491

Strings

type must be string, but is , xrefs: 009EE4F8
type must be boolean, but is , xrefs: 009EE582

Memory Dump Source

Source File: 00000008.00000002.3307879772.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000008.00000002.3307833701.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3307879772.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308139365.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308181266.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3308951526.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3309516714.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: type must be boolean, but is $type must be string, but is
API String ID: 118556049-436076039
Opcode ID: 461c970c5e6740df240f694f8d0ba8e13aced62032bf0b9a9bf37efa06b0e9a0
Instruction ID: 55046319a85a7420925dd2667c20934f3d2adbaf4b61c9ff1b4277c6160fbb05
Opcode Fuzzy Hash: 461c970c5e6740df240f694f8d0ba8e13aced62032bf0b9a9bf37efa06b0e9a0
Instruction Fuzzy Hash: 7C417BB5900248AFCB05EBA4D902B9EB7A8EB40310F148679F419D77D1FB35AD44C796

Analysis Process: RageMP131.exePID: 7652, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	3.1%
Dynamic/Decrypted Code Coverage:	0.5%
Signature Coverage:	0%
Total number of Nodes:	652
Total number of Limit Nodes:	68

Executed Functions

Function 009D3A40 Relevance: 2.7, APIs: 2, Instructions: 157
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E9,?,00000001,00000000,?,?,?,?,?,?,?,?,009D3DB6), ref: 009D3B08
Sleep.KERNELBASE(00000001,?,00000001,00000000,?,?,?,?,?,?,?,?,009D3DB6), ref: 009D3BBA

Memory Dump Source

Source File: 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 0000000A.00000002.3306833326.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3306912829.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307526853.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308342930.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308817329.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: f6c1435e940d217399ada86c42b8663570481760d96d672f37f0bbf3c256688d
Instruction ID: e5b48e8f24064d0f96d6701536eb56537ed6c8cb7b7f960de1ae89117d812772
Opcode Fuzzy Hash: f6c1435e940d217399ada86c42b8663570481760d96d672f37f0bbf3c256688d
Instruction Fuzzy Hash: 3B51B835A842198FCB24CF98C8D0EBAB3B9EF49705B28C59AD445AF311D735EE05CB80

Function 0098E0A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 0098E0CB
socket.WS2_32(?,?,?), ref: 0098E17F
connect.WS2_32(00000000,?,?), ref: 0098E193
closesocket.WS2_32(00000000), ref: 0098E19E

Strings

q, xrefs: 0098E128

Memory Dump Source

Source File: 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 0000000A.00000002.3306833326.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3306912829.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307526853.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308342930.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308817329.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: Startupclosesocketconnectsocket
String ID: q
API String ID: 3098855095-831824133
Opcode ID: d93a9471f740276fdae34f736f5fb9e5b807c4e1701c70bb6e17499561d87745
Instruction ID: 3bd88a1881e20c106260885b353f03e2398eb6cb9f524045bf0d7cae92816104
Opcode Fuzzy Hash: d93a9471f740276fdae34f736f5fb9e5b807c4e1701c70bb6e17499561d87745
Instruction Fuzzy Hash: 9731C4726083016FD7209F258C9972FB7E8EB85334F015F1DF9A8962E0D33598048B92

Function 04E50779 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(-0000CF3E), ref: 04E50896

Strings

G`PR, xrefs: 04E50788

Memory Dump Source

Source File: 0000000A.00000002.3315212624.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e50000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID: G`PR
API String ID: 2104809126-1351489844
Opcode ID: c5789c56174094519403af1cede6581ebe445bf2c354066960940a5d33bf668c
Instruction ID: 3da18cd4d0240c836d42c186b2cacbe413ae98d2ab18d43be8161ad60e934a9a
Opcode Fuzzy Hash: c5789c56174094519403af1cede6581ebe445bf2c354066960940a5d33bf668c
Instruction Fuzzy Hash: 7941F2FB20C121BDF212D2556B60BFB57AEE7D2730B30A426FC47D151AF3946A892032

Function 00A64623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 0000000A.00000002.3306833326.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3306912829.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307526853.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308342930.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308817329.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 715b0e42ac45a0e472d0acbf206c659c62b6b7e2063416eebb635cebba59f2a8
Instruction ID: 39427dfa854e7c9ba59bdfaecb78b077b870adb110accbc595581d43f7d1a5e5
Opcode Fuzzy Hash: 715b0e42ac45a0e472d0acbf206c659c62b6b7e2063416eebb635cebba59f2a8
Instruction Fuzzy Hash: 50B10271A04349AFEB11DFA8D881BAEBBB1FF4E314F144158E954AB382C7719D46CB60

Function 04E5068D Relevance: 1.7, APIs: 1, Instructions: 243
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(-0000CF3E), ref: 04E50896

Memory Dump Source

Source File: 0000000A.00000002.3315212624.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e50000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 2d72b06bbab6265ea7cba3e53783492dccc30fa2aed5af810a2c7eb008c8cff3
Instruction ID: 269cdf874b387928a76bdeaafe265962e5930dcb15318766fc546e8844f0d309
Opcode Fuzzy Hash: 2d72b06bbab6265ea7cba3e53783492dccc30fa2aed5af810a2c7eb008c8cff3
Instruction Fuzzy Hash: 8F41D3F730C221BDF11291516B54EFB576EEBD2730B30A42AFC47D1915F3946A892431

Function 04E506C4 Relevance: 1.7, APIs: 1, Instructions: 242
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(-0000CF3E), ref: 04E50896

Memory Dump Source

Source File: 0000000A.00000002.3315212624.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e50000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: ea2f3db90e373d2dd3e40e9495ff791bb5c20dc97d5224d33979cc71506aa7f5
Instruction ID: f7881a4d8d40825376108ef91dabb61262a738baceb161c28de925371e92716a
Opcode Fuzzy Hash: ea2f3db90e373d2dd3e40e9495ff791bb5c20dc97d5224d33979cc71506aa7f5
Instruction Fuzzy Hash: F241F2FB20C221BDF10291516B54AFB67AEEBD2730B30A42AFC47D1919F3946A892431

Function 04E5069C Relevance: 1.7, APIs: 1, Instructions: 242
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(-0000CF3E), ref: 04E50896

Memory Dump Source

Source File: 0000000A.00000002.3315212624.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e50000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: f36034845ed2ffe3854a507954ec1cea9b2b156641cb91444aecfc7a721eebc4
Instruction ID: 20d4cd381013ca6c06088cd86a06a1872227104718743189402d7daa9affbe77
Opcode Fuzzy Hash: f36034845ed2ffe3854a507954ec1cea9b2b156641cb91444aecfc7a721eebc4
Instruction Fuzzy Hash: 2B41F3F730C211BDF20291516B54EFB576EEBD2730B30A42AFC47D1919F3946A892431

Function 04E506B1 Relevance: 1.7, APIs: 1, Instructions: 240
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(-0000CF3E), ref: 04E50896

Memory Dump Source

Source File: 0000000A.00000002.3315212624.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e50000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 7a2a89163047bd87022bfa873cba6ccf97ea35b81676bf57aedd6e81d03e6f0b
Instruction ID: ed3dac3472190c27271a6de5113094f5c2ea0215eff9ad6dc4ad49eb080bf4c5
Opcode Fuzzy Hash: 7a2a89163047bd87022bfa873cba6ccf97ea35b81676bf57aedd6e81d03e6f0b
Instruction Fuzzy Hash: 124104F720C121BDF20292556B54BFB676EEBD2330B30A42AFC47D1919F3946A892431

Function 04E506F0 Relevance: 1.7, APIs: 1, Instructions: 237
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(-0000CF3E), ref: 04E50896

Memory Dump Source

Source File: 0000000A.00000002.3315212624.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e50000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: b986d39d91328e2bad3c8e0905634dc361c2f1ad760a37afe83fa2d061970753
Instruction ID: 2aac5eff4d536c21eb007094aa10db533723bb6d444f82e002ed677e6909feeb
Opcode Fuzzy Hash: b986d39d91328e2bad3c8e0905634dc361c2f1ad760a37afe83fa2d061970753
Instruction Fuzzy Hash: AD4117F730C121BDF20292556B54BFB57AEEBD2730B30A42AFC07C1919F3956A896431

Function 0097A210 Relevance: 1.7, APIs: 1, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 0097A343

Memory Dump Source

Source File: 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 0000000A.00000002.3306833326.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3306912829.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307526853.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308342930.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308817329.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 51ad14613b883c48832360ea8ea9e6f2d336730a4e860c677c9ece7d37e534a9
Instruction ID: d6aa694ea035e7835bc71fa104833fa4d2a1adfafacafefe686184fa8ee496af
Opcode Fuzzy Hash: 51ad14613b883c48832360ea8ea9e6f2d336730a4e860c677c9ece7d37e534a9
Instruction Fuzzy Hash: AC715B71900205AFDB14DF68DD45B9EBBE8FF81704F10856DF8099B282E7B59944CB92

Function 04E50725 Relevance: 1.7, APIs: 1, Instructions: 217
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(-0000CF3E), ref: 04E50896

Memory Dump Source

Source File: 0000000A.00000002.3315212624.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e50000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: ea12a148a4249c68fa425966708daae349d013b0476b27bb08be2f2b19e1df76
Instruction ID: a13e103e5013d4d13a31031ea2eb98c63bc25a3a4d950e0fb438816207d9ebd5
Opcode Fuzzy Hash: ea12a148a4249c68fa425966708daae349d013b0476b27bb08be2f2b19e1df76
Instruction Fuzzy Hash: C141F3F730C221BDF21292556B54BFB67AEEBD2730B30A42AFC47C1519F3946A892431

Function 04E50715 Relevance: 1.7, APIs: 1, Instructions: 214
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(-0000CF3E), ref: 04E50896

Memory Dump Source

Source File: 0000000A.00000002.3315212624.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e50000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 9e566b5183b9ed39fc3cb50764ce8ebe3c9d4b731da5287926a4c66c7e832272
Instruction ID: b2541ff18abdb6e9973b9a514a98e704dc349d30e6551c2bdaaca9d5f9605bb7
Opcode Fuzzy Hash: 9e566b5183b9ed39fc3cb50764ce8ebe3c9d4b731da5287926a4c66c7e832272
Instruction Fuzzy Hash: 3841C0E730C121BDF21292556B54BFB576EEBD2730B30A426FC47D191AF3946A892432

Function 04E507CB Relevance: 1.7, APIs: 1, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(-0000CF3E), ref: 04E50896

Memory Dump Source

Source File: 0000000A.00000002.3315212624.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e50000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 4b82b3b10d06e5b388b4777d8b17292bcbc8606b0b245fe362716f9ec5e638f6
Instruction ID: bfa32e37ed03fb97456dd03c83f73189062f673de161fd96e60f86d703f12c91
Opcode Fuzzy Hash: 4b82b3b10d06e5b388b4777d8b17292bcbc8606b0b245fe362716f9ec5e638f6
Instruction Fuzzy Hash: 794136FB20C1117DF202D6556A55EFB67AEEBC1730B30A42AFC43C2516F3956A892071

Function 04E50749 Relevance: 1.7, APIs: 1, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(-0000CF3E), ref: 04E50896

Memory Dump Source

Source File: 0000000A.00000002.3315212624.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e50000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: b97d5f2f6fc0436274dc946b795a815189d0369d2d3f6d768028e32465423c4d
Instruction ID: b8e9258b93709e0761eb2b21ad0972b1a876b13d25ead5f9bc942996c43ffcb8
Opcode Fuzzy Hash: b97d5f2f6fc0436274dc946b795a815189d0369d2d3f6d768028e32465423c4d
Instruction Fuzzy Hash: D141C1F720C121BDF21292556B54BFB57AEE7D2730B30A426FC47D1919F3946A892432

Function 04E50758 Relevance: 1.7, APIs: 1, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(-0000CF3E), ref: 04E50896

Memory Dump Source

Source File: 0000000A.00000002.3315212624.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e50000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 4f45a07af55a8170c4f71086b286e2b115545b0e94b1a5dbedc23e28d011814b
Instruction ID: fe0bfe884de7824542a5a84dd5e5f36296c3ad80f7f3fab58483b34d6c78eb79
Opcode Fuzzy Hash: 4f45a07af55a8170c4f71086b286e2b115545b0e94b1a5dbedc23e28d011814b
Instruction Fuzzy Hash: CC41CFE720C121BDF21292556A54BFB57AEE7D2730B30A426FC47C1919F2946A892431

Function 00A6549C Relevance: 1.7, APIs: 1, Instructions: 198fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000000,00A59087,?,00000000,00000000,00000000,?,00000000,?,0097A3EB,00A59087,00000000,0097A3EB,?,?), ref: 00A65621

Memory Dump Source

Source File: 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 0000000A.00000002.3306833326.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3306912829.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307526853.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308342930.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308817329.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3941bba524666be1c8fff27bc23793212f88fde9bc6b0f8adacdd1134579dd4c
Instruction ID: d3d80a81f956887cc5a1423a00545e11f2df6e435d4ef7e2bc845d84eb05bc07
Opcode Fuzzy Hash: 3941bba524666be1c8fff27bc23793212f88fde9bc6b0f8adacdd1134579dd4c
Instruction Fuzzy Hash: AD61B2B6D04519AFDF11DFB8C948EEEBBBAAF09304F180189E901A7255D772D911CBA0

Function 04E507B2 Relevance: 1.7, APIs: 1, Instructions: 195COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(-0000CF3E), ref: 04E50896

Memory Dump Source

Source File: 0000000A.00000002.3315212624.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e50000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 2edb7d6b96e4b3908d0e873ec7b12b3127341287667c848e2bd934bf2c80c85d
Instruction ID: 1049d50bcd5bb31aa1a83150b268282d5618b2baad3b865201107f6c93dca120
Opcode Fuzzy Hash: 2edb7d6b96e4b3908d0e873ec7b12b3127341287667c848e2bd934bf2c80c85d
Instruction Fuzzy Hash: 7B4103E720C1207DF212D2552B54BFB57AEE7D6730B30A42AFC47C161AF7856B892072

Function 04E50799 Relevance: 1.7, APIs: 1, Instructions: 192COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(-0000CF3E), ref: 04E50896

Memory Dump Source

Source File: 0000000A.00000002.3315212624.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e50000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: f2ff3c117da19df1bae074de34e7fbfc9bb0d536b56759e5753618f2796648a7
Instruction ID: f96ee68a27f29ee9e6f1e25e74ac9a9bd4febec8b0bf7059ea6fcd85f1aae376
Opcode Fuzzy Hash: f2ff3c117da19df1bae074de34e7fbfc9bb0d536b56759e5753618f2796648a7
Instruction Fuzzy Hash: E741D2F720C120BDF212D2556A50BFB67ADE7D1730B30A42AFD43D1519F3946A892432

Function 04E5080E Relevance: 1.7, APIs: 1, Instructions: 192COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(-0000CF3E), ref: 04E50896

Memory Dump Source

Source File: 0000000A.00000002.3315212624.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e50000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: b2bdf9af21949c432a0ef3709256386d3b762265e6ea702883b7e5b20e3e7eb6
Instruction ID: ff621ce0a8793b79c88801ecd65a905f9b06c5b2dd0d2567f5325dc59a37c43c
Opcode Fuzzy Hash: b2bdf9af21949c432a0ef3709256386d3b762265e6ea702883b7e5b20e3e7eb6
Instruction Fuzzy Hash: F54125F720C120BDF202D2512B50BFB67AEE7C6330B30A426FC47C191AF3846A896472

Function 00A54942 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 0000000A.00000002.3306833326.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3306912829.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307526853.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308342930.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308817329.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb3d1853bb73271abcc082419a7637254e54dd437727159dfa2d75c0e4455a09
Instruction ID: f7733db2ea583a5b7cb528d6510cef07c4aa86e6b92de43dfbaf766b49299466
Opcode Fuzzy Hash: fb3d1853bb73271abcc082419a7637254e54dd437727159dfa2d75c0e4455a09
Instruction Fuzzy Hash: ED51C670A00108AFDB54CF58CC81AAABFB1FF4D369F248158FD499B252D3319E85CB90

Function 04E5082E Relevance: 1.7, APIs: 1, Instructions: 152COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(-0000CF3E), ref: 04E50896

Memory Dump Source

Source File: 0000000A.00000002.3315212624.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e50000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 5fce6261838ccab86e3847ba6ea9e6a3c07e13af5e066f24fbae3941013643b3
Instruction ID: 5f52ee124754124bdede378fce6b7786260cf75c12bddc21c67ebf5633b94693
Opcode Fuzzy Hash: 5fce6261838ccab86e3847ba6ea9e6a3c07e13af5e066f24fbae3941013643b3
Instruction Fuzzy Hash: 4431F6E730C1607DF212D2652A54BFB57AED7D2730B30A426FD47D161AF3856A892072

Function 04E50841 Relevance: 1.6, APIs: 1, Instructions: 148COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(-0000CF3E), ref: 04E50896

Memory Dump Source

Source File: 0000000A.00000002.3315212624.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e50000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: af5170e1eb00b0ceb666f88c0c53901edf2e25705e35cc565d21bc06c230cfec
Instruction ID: 583d9ff94de893bab965398790c3162e602d007428ff7bfad3b122d6bc1c1e8a
Opcode Fuzzy Hash: af5170e1eb00b0ceb666f88c0c53901edf2e25705e35cc565d21bc06c230cfec
Instruction Fuzzy Hash: C531E5EB30C2207DF212D2552A55BFB57ADD7C2730B30A426FD43C161AF7846A892072

Function 04E50855 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(-0000CF3E), ref: 04E50896

Memory Dump Source

Source File: 0000000A.00000002.3315212624.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e50000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: d4971b7197e6ca0ba991dcf1ecefc52c9034618829ee39515baa3a7f7cf45154
Instruction ID: 8ecbac4b1cc2b3f879e05970e64663f52bdfc9972f2bab421987c8d15705847f
Opcode Fuzzy Hash: d4971b7197e6ca0ba991dcf1ecefc52c9034618829ee39515baa3a7f7cf45154
Instruction Fuzzy Hash: C83129FB70C2257DF212D2512651BFB67AEEBC2730B30A42AFD43C1519F7856A892071

Function 009E0560 Relevance: 1.6, APIs: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 009E06AE

Memory Dump Source

Source File: 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 0000000A.00000002.3306833326.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3306912829.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307526853.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308342930.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308817329.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction ID: bfb87c6db5d751a9a300851af93400cfbac8374cbaa6342a9cb56f901a48dcec
Opcode Fuzzy Hash: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction Fuzzy Hash: 7241E572A001549FCB16DF69D9806AE7BA9BFC8310F140669FC05DB306DB70DDA08BE1

Function 00A64B12 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,00A649F9,00000000,CF830579,00AA1140,0000000C,00A64AB5,00A58BBD,?), ref: 00A64B68

Memory Dump Source

Source File: 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 0000000A.00000002.3306833326.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3306912829.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307526853.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308342930.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308817329.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 09600d636bb50a51f07e02fc2baf45ba38d85402229e350d6626660c71418f57
Instruction ID: d6ed0fb69ee46de2e545384aefe1cbee0594c1282515821cd138d7be27fc79be
Opcode Fuzzy Hash: 09600d636bb50a51f07e02fc2baf45ba38d85402229e350d6626660c71418f57
Instruction Fuzzy Hash: 08116633B4022416D72577B4E901B7EA7BACB9B774F2A024DF818AB0C2EE21DC824555

Function 00A5E05C Relevance: 1.6, APIs: 1, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00AA0DF8,0097A3EB,00000002,0097A3EB,00000000,?,?,?,00A5E166,00000000,?,0097A3EB,00000002,00AA0DF8), ref: 00A5E098

Memory Dump Source

Source File: 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 0000000A.00000002.3306833326.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3306912829.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307526853.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308342930.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308817329.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 5def75eff799653aeb10b74b0b7c1d83ca20cf52a32fcc2b6a58832e4ef8068a
Instruction ID: e86192aed2cb7b99d5861739e0814e7a8891171ff9ffd2305932658a3ebe7e13
Opcode Fuzzy Hash: 5def75eff799653aeb10b74b0b7c1d83ca20cf52a32fcc2b6a58832e4ef8068a
Instruction Fuzzy Hash: EF012632654159AFCF19DF58CC01C9E3B6AEB81335B240208FC509B2D1E6B2EE458BD0

Function 00A4F290 Relevance: 1.6, APIs: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0097220E

Memory Dump Source

Source File: 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 0000000A.00000002.3306833326.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3306912829.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307526853.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308342930.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308817329.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 992a921226d8e4bb8ded6109923904ed1d90e9934d4cba8afb87cc543ea86abe
Instruction ID: 22a2696d432a6608e5b4a9cbd8fbeaa13c2650574e6b1bb6af919cd6a819077d
Opcode Fuzzy Hash: 992a921226d8e4bb8ded6109923904ed1d90e9934d4cba8afb87cc543ea86abe
Instruction Fuzzy Hash: 4201DB7A50430DAFCB14AFA8DC029997BACEA00310B54C43AFE1DDB591E770E954C791

Function 00A663F3 Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00A591F7,00000000,?,00A65D79,00000001,00000364,00000000,00000006,000000FF,?,00000000,00A5D244,00A589C3,00A591F7,00000000), ref: 00A66435

Memory Dump Source

Source File: 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 0000000A.00000002.3306833326.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3306912829.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307526853.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308342930.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308817329.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: fa3a87d192a437a755ab2ddda1eccd140c05e05c0e54a564e2e30db1aa17cc4e
Instruction ID: 529a3740cc3afaf9aba86e3d9cf37160191f23531ed3d7e6cac42fe0b8cc6c97
Opcode Fuzzy Hash: fa3a87d192a437a755ab2ddda1eccd140c05e05c0e54a564e2e30db1aa17cc4e
Instruction Fuzzy Hash: DFF08931545125669B216B629F0AB6B7B7DEF51764F158411EC09961C0CF30E81146F1

Function 00A66E2D Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00A6D635,4D88C033,?,00A6D635,00000220,?,00A657EF,4D88C033), ref: 00A66E60

Memory Dump Source

Source File: 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 0000000A.00000002.3306833326.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3306912829.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307526853.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308342930.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308817329.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f6ea76123649671ffa8d5dad7d9a81f59ef093a178b06071640ac11d5c94d6e0
Instruction ID: 83dce4a03c76eb5cafc993d983e3c4f171c3a032bb6410c7a1a75b8e3675f6c7
Opcode Fuzzy Hash: f6ea76123649671ffa8d5dad7d9a81f59ef093a178b06071640ac11d5c94d6e0
Instruction Fuzzy Hash: 34E0223A9006226ADB3123A6DE00BAB7A7DDF823B0F050520FD05D60D0CB22CC0081E4

Function 04E60009 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3315244353.0000000004E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e60000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e48daa1b11c6a74f6590a50e3a3528b61b6db4f3a762dc65780215c4844762ff
Instruction ID: ef11501feed3196f0745becd95cbccec2430e157600bc43eedc24867ac59694d
Opcode Fuzzy Hash: e48daa1b11c6a74f6590a50e3a3528b61b6db4f3a762dc65780215c4844762ff
Instruction Fuzzy Hash: 3F21E9EB2CC130BDE042D5416B14AF76B2EE7D67B4B30A917F417C5602F3A55A897432

Function 04E60000 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3315244353.0000000004E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e60000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25654c0eb250c6a965a2dc40f51908f31bff81436ac63278da23eaa13f52b71b
Instruction ID: 25c503e658ce1a5c75fe1ff73a579bbe623ccfa76a5bfb4dea0a294b2f7aeeb7
Opcode Fuzzy Hash: 25654c0eb250c6a965a2dc40f51908f31bff81436ac63278da23eaa13f52b71b
Instruction Fuzzy Hash: 3A21F8EB2CC130BEE083D4416B14AF76A2FE7D67B4B30A916F417C5602F3A55A997432

Function 04E6002C Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3315244353.0000000004E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e60000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3914df3a6526794c9a3211e2cb477a227e38cc32e7e74e3f2dd31888d296c4c2
Instruction ID: 6ccc7580385e5c4fae20b75116d25e0081c5481ba8119d2fdb942f24eade8809
Opcode Fuzzy Hash: 3914df3a6526794c9a3211e2cb477a227e38cc32e7e74e3f2dd31888d296c4c2
Instruction Fuzzy Hash: A52105EB2CC130BDE042D4416B146F76A2EE7D6BB0B30A926F407C5602F3956A893432

Function 04E6001C Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3315244353.0000000004E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e60000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f396956aaa77e5c5a15d0a2ecb20a4db9846b28fca2a512f9dc84e8c3c758057
Instruction ID: 714db0c6d7e435394e89b5eacc7489537fa71ffaf41951f095ee60d75e57848a
Opcode Fuzzy Hash: f396956aaa77e5c5a15d0a2ecb20a4db9846b28fca2a512f9dc84e8c3c758057
Instruction Fuzzy Hash: 2721B7EB2CC130BEF042D9416B14AF76B2EE7D67B4B309926F407C5602F3A55A997432

Function 04E60053 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3315244353.0000000004E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e60000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d84613fc8afb7dc60d847ea94a01a16e00cea78a04382818d18af55cbdbf3ee9
Instruction ID: da158eea32353d404994708c4a8aafcf998f25b2958bf74d2fed6e80012c7356
Opcode Fuzzy Hash: d84613fc8afb7dc60d847ea94a01a16e00cea78a04382818d18af55cbdbf3ee9
Instruction Fuzzy Hash: B121F6EF2CC230BEE042D8516B116F66B1EEBD67B0B30A526F417C5602F3A556997432

Function 04E6006D Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3315244353.0000000004E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e60000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbfae77ec76aaec689027f4adb11394ecb763c0777b251d8f8ff436981b41b35
Instruction ID: 0327c815b191066586e60834598b5c7cb396c61e9938d67d97ccc0c22c7bac05
Opcode Fuzzy Hash: dbfae77ec76aaec689027f4adb11394ecb763c0777b251d8f8ff436981b41b35
Instruction Fuzzy Hash: 642138EB2C8230EEE142D8516A112F67B5FEB927B0B306526F007C6602F3A566997432

Function 04E60095 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3315244353.0000000004E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e60000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d6a1192fa4e9346fd148e756c25b3557aa7c8d1650eee1ced8801d5009d44a6
Instruction ID: 59fcc259c1e266f8b987b8d1737710a1957869187ad49471357c9bcb85e4cb39
Opcode Fuzzy Hash: 4d6a1192fa4e9346fd148e756c25b3557aa7c8d1650eee1ced8801d5009d44a6
Instruction Fuzzy Hash: CD1126EB2C8130BEE043D8516B116F66A1FEBD67B0F30A516F017C5A02F3A556997832

Function 04E600AD Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3315244353.0000000004E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e60000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b1c617e695ab42bb51ad4db5072370dd9065d9fcb3f93ca22956b550fbb407e
Instruction ID: d06dc87cc037d13de1fc6f016a52c3ea09397a029a562616690ed8c89535686c
Opcode Fuzzy Hash: 0b1c617e695ab42bb51ad4db5072370dd9065d9fcb3f93ca22956b550fbb407e
Instruction Fuzzy Hash: 121178EB2C8130BEE043C9515A012F66B1FEBA77B0F306212F04786602F2A467997832

Function 04E600D6 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3315244353.0000000004E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e60000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e9b484eac68f002ead89ea028b2cbe0baafb804be7bf753f036bcfdf268ea5e
Instruction ID: a362274648511e48415a83c2a23a6029de89bc2a8a4a0dce05c001e75d500c00
Opcode Fuzzy Hash: 7e9b484eac68f002ead89ea028b2cbe0baafb804be7bf753f036bcfdf268ea5e
Instruction Fuzzy Hash: 8901D4DF2C8134FEC083D89567142F66D1BABA76F0F306216F05799B02B3A467987832

Function 04E6013A Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3315244353.0000000004E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e60000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcf5dca5a0aa6eae240b85ed283660ac720dd41817826e8c32c96e57648d39e0
Instruction ID: 6704ddb0b729d1bc3b37aebbfdd31690577818fc7fe89f7bcc8d7d5e662fcb5d
Opcode Fuzzy Hash: bcf5dca5a0aa6eae240b85ed283660ac720dd41817826e8c32c96e57648d39e0
Instruction Fuzzy Hash: E801D4DB2C8134FEC083D89556152F66C1BABA77F0F306216F05795A02B3A56B987832

Function 04E600EA Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3315244353.0000000004E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e60000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcec9b4d608de56509508670c197105fbfa39a2189b88bee0c50b779f2e502e3
Instruction ID: 4a3e3539c70540d9db19bf7dd1205d0e8f7d562dfbb9737104f0ca025167d448
Opcode Fuzzy Hash: fcec9b4d608de56509508670c197105fbfa39a2189b88bee0c50b779f2e502e3
Instruction Fuzzy Hash: C30166DB2C8230EFC083C95156442F17E2AABA32B0B301256F0939B642B3642A947932

Function 04E60163 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3315244353.0000000004E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e60000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32eb00b50d636590fa07b0bd3c3a70d3ed63957cc6bc1adc913308c0714f718c
Instruction ID: 65283a8bb14f2c6a1b8fe61af79e37225bbe962b0e4d6179442b8d37b2885003
Opcode Fuzzy Hash: 32eb00b50d636590fa07b0bd3c3a70d3ed63957cc6bc1adc913308c0714f718c
Instruction Fuzzy Hash: A3F0288A2D8130DDC486DC2122082F67E5667632F0F307307E09794A07B6547B99BC32

Function 04E60127 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3315244353.0000000004E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e60000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15ec27268cb921b94d5a5aa764a47a20a4778833bf578cfa7b869454b25fec2a
Instruction ID: 6df73116cce3ebd6ecfa99eeb7abe5b049099c6ffb3a75b07e7cfb44390b7d17
Opcode Fuzzy Hash: 15ec27268cb921b94d5a5aa764a47a20a4778833bf578cfa7b869454b25fec2a
Instruction Fuzzy Hash: 95F0E9DF2CC130DDC042DC5166092FA6D1AABA72F0F307617E02799A03B66467987C72

Function 04E60153 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3315244353.0000000004E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e60000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efdaf2f8f4cd04f650ffc1a5812971d88da5ea3d90e918c92b6aa7c0b9f772c0
Instruction ID: 284033b0270c13694f37029029151f538211cc6e501dc61a664b6c22b461c87d
Opcode Fuzzy Hash: efdaf2f8f4cd04f650ffc1a5812971d88da5ea3d90e918c92b6aa7c0b9f772c0
Instruction Fuzzy Hash: B7E0D84E2CC170D9C082E85113042F51C573B672F0F303313E05799A17F7A463597831

Function 04E60184 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3315244353.0000000004E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e60000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f5e5c992a68ff7a2648e7ad8af8c0cd1a2a94586cb21ceea214373e66f2a4cf
Instruction ID: b4f6d94b6b05d64520819031be927fa307a16c5cebac70786f985f982737bf32
Opcode Fuzzy Hash: 2f5e5c992a68ff7a2648e7ad8af8c0cd1a2a94586cb21ceea214373e66f2a4cf
Instruction Fuzzy Hash: C1F0DC6B7CC2B4CFC381E87120882E86E537F633B0F30163ED08357847E2085208B012

Non-executed Functions

Function 00A584A0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 0000000A.00000002.3306833326.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3306912829.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307526853.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308342930.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308817329.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction ID: f55709fc0da3e202e67fb7834342b0a84c7d97547c7a0f559539964932f7284a
Opcode Fuzzy Hash: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction Fuzzy Hash: A7024A71E012199FDF14CFA9C9806AEBBB1FF48315F248269E919F7380DB35A905CB90

Function 009DF810 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 009DF833
std::_Lockit::_Lockit.LIBCPMT ref: 009DF855
std::_Lockit::~_Lockit.LIBCPMT ref: 009DF875
std::_Lockit::~_Lockit.LIBCPMT ref: 009DF89F
std::_Lockit::_Lockit.LIBCPMT ref: 009DF90D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 009DF959
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 009DF973
std::_Lockit::~_Lockit.LIBCPMT ref: 009DFA08
std::_Facet_Register.LIBCPMT ref: 009DFA15

Strings

bad locale name, xrefs: 009DFA2F
Ps, xrefs: 009DF96B, 009DF972

Memory Dump Source

Source File: 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 0000000A.00000002.3306833326.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3306912829.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307526853.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308342930.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308817329.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$Ps
API String ID: 3375549084-1174896957
Opcode ID: ce95517ed9ae2262f36a7bb950abbeed97c1b7178fe02e524446ade995658edb
Instruction ID: 63c04cd3117b45367caeea04aac56310e997395aa275b6a4486d6387f2ce2557
Opcode Fuzzy Hash: ce95517ed9ae2262f36a7bb950abbeed97c1b7178fe02e524446ade995658edb
Instruction Fuzzy Hash: 8561D375D40209DFEF20DFA4D956B9EBBB8BF54310F148469E806AB381D734E905CB92

Function 009739F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00973A58
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00973AA4
__Getctype.LIBCPMT ref: 00973ABA
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00973AE6
std::_Lockit::~_Lockit.LIBCPMT ref: 00973B7B

Strings

bad locale name, xrefs: 00973B96

Memory Dump Source

Source File: 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 0000000A.00000002.3306833326.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3306912829.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307526853.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308342930.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308817329.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: c5beb7f35607ab28adfb175a2fb8cd48f15b82678a3e6ac1a652ca2eb6326910
Instruction ID: c25b72d9592859a4a20287e6987b0670515d93d32aa92165fe26244d2b11b8ed
Opcode Fuzzy Hash: c5beb7f35607ab28adfb175a2fb8cd48f15b82678a3e6ac1a652ca2eb6326910
Instruction Fuzzy Hash: B35120B5D002489FEF10DFA4D985B9EBBF8BF58314F148169E809AB341E775DA08CB91

Function 00A52E10 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00A52E47
___except_validate_context_record.LIBVCRUNTIME ref: 00A52E4F
_ValidateLocalCookies.LIBCMT ref: 00A52ED8
__IsNonwritableInCurrentImage.LIBCMT ref: 00A52F03
_ValidateLocalCookies.LIBCMT ref: 00A52F58

Strings

csm, xrefs: 00A52EED

Memory Dump Source

Source File: 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 0000000A.00000002.3306833326.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3306912829.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307526853.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308342930.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308817329.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 251493b1658508df91dbb4437bb223f77a8850d36551bf654a9003fb8abeab18
Instruction ID: 4a8beedb1b9461fc914fa3c721791dedbc84442d50f1b624fa15cc6961a56c10
Opcode Fuzzy Hash: 251493b1658508df91dbb4437bb223f77a8850d36551bf654a9003fb8abeab18
Instruction Fuzzy Hash: F5419E31A00209ABCF10DF68D885B9EBBB5BF46326F148455EC189B392D731EE59CB91

Function 009DDE70 Relevance: 9.1, APIs: 6, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 009DDE93
std::_Lockit::_Lockit.LIBCPMT ref: 009DDEB6
std::_Lockit::~_Lockit.LIBCPMT ref: 009DDED6
std::_Facet_Register.LIBCPMT ref: 009DDF4B
std::_Lockit::~_Lockit.LIBCPMT ref: 009DDF63
Concurrency::cancel_current_task.LIBCPMT ref: 009DDF7B

Memory Dump Source

Source File: 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 0000000A.00000002.3306833326.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3306912829.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307526853.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308342930.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308817329.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: cef3f70264490103a738cd5e9a658d8bd2c9932134364ed8dd810084ae79dd27
Instruction ID: e8fe439aa1ca1698fd6cc0f4a8d19c63444e17841397188fc35c44d37f2b361b
Opcode Fuzzy Hash: cef3f70264490103a738cd5e9a658d8bd2c9932134364ed8dd810084ae79dd27
Instruction Fuzzy Hash: 3C411271950216DFCB14DF98D841BAEBBB8FB46320F14866AE8159B392D730AD01CBE1

Function 00974C50 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 442COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00974F72
___std_exception_destroy.LIBVCRUNTIME ref: 00974FFF
___std_exception_copy.LIBVCRUNTIME ref: 009750C8

Strings

recursive_directory_iterator::operator++, xrefs: 0097504C

Memory Dump Source

Source File: 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 0000000A.00000002.3306833326.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3306912829.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307526853.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308342930.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308817329.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$___std_exception_copy
String ID: recursive_directory_iterator::operator++
API String ID: 1206660477-953255998
Opcode ID: 05034be23e4068c2c5b043ef95e177546d577267b8a25ef4d2fd9ef76001aaef
Instruction ID: b50a748b530d497b2759373a759b92376b38342d0ce41469dd6446c20653b8e9
Opcode Fuzzy Hash: 05034be23e4068c2c5b043ef95e177546d577267b8a25ef4d2fd9ef76001aaef
Instruction Fuzzy Hash: 30E115729002059FCB28DF68DD45B9EBBF9FF44300F148A2DE45A97782E774A944CBA1

Function 00977820 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0097799A
___std_exception_copy.LIBVCRUNTIME ref: 00977B75

Strings

out_of_range, xrefs: 00977A27
type_error, xrefs: 0097784A

Memory Dump Source

Source File: 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 0000000A.00000002.3306833326.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3306912829.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307526853.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308342930.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308817329.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: out_of_range$type_error
API String ID: 2659868963-3702451861
Opcode ID: 509614cdfe7299ca9431f89595ce8d8b327c487984186a240a8b98e915a3d215
Instruction ID: 569b8b12be433b157e908daacca14439ed5c5c42c22b36365998bceaea0f54e1
Opcode Fuzzy Hash: 509614cdfe7299ca9431f89595ce8d8b327c487984186a240a8b98e915a3d215
Instruction Fuzzy Hash: 64C147B1D012089FDB18DFA8D984B9DFBF5FF48300F14866AE419EB791E77499808B51

Function 009773B0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 009775BE
___std_exception_destroy.LIBVCRUNTIME ref: 009775CD

Strings

at line , xrefs: 009773F7
, column , xrefs: 00977434, 0097744A

Memory Dump Source

Source File: 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 0000000A.00000002.3306833326.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3306912829.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307526853.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308342930.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308817329.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column
API String ID: 4194217158-191570568
Opcode ID: 06333f5a0d154ea9e27abbc6aa15f4c326c86b2fcb0a9f0046d5e58748153fb4
Instruction ID: d88c99eca1c0e348eefbe21aafcd950425fa6d7cb98718a424258a3a870d248a
Opcode Fuzzy Hash: 06333f5a0d154ea9e27abbc6aa15f4c326c86b2fcb0a9f0046d5e58748153fb4
Instruction Fuzzy Hash: 3E61C471A042059FDB08DFA8DD85BADFBB6FF84300F24862CF419A7791D774AA448B91

Function 00973D10 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00973E7F

Strings

ios_base::badbit set, xrefs: 00973E17
ios_base::failbit set, xrefs: 00973D32
ios_base::eofbit set, xrefs: 00973E41, 00973E63

Memory Dump Source

Source File: 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 0000000A.00000002.3306833326.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3306912829.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307526853.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308342930.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308817329.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: 62f00ca119f38a5272209346b175ad7011acff66e509405378e49455914f4586
Instruction ID: 4b60929013bc6c6b414cf6f1c8d5666f977da76cc58d54a0f2b2aae3ad228e65
Opcode Fuzzy Hash: 62f00ca119f38a5272209346b175ad7011acff66e509405378e49455914f4586
Instruction Fuzzy Hash: 234193B6900208AFCB14DF68CC45B9EB7F8FF49710F14C52AF919D7681E774AA058BA1

Function 00973DE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00973E7F

Strings

ios_base::badbit set, xrefs: 00973E17
ios_base::failbit set, xrefs: 00973D32, 00973E1E
ios_base::eofbit set, xrefs: 00973E28, 00973E41, 00973E63

Memory Dump Source

Source File: 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 0000000A.00000002.3306833326.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3306912829.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307526853.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308342930.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308817329.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: 94649afaf1194d6202ef468b41f9a190fad77f45f5a584f6a4b91849c2785a74
Instruction ID: b949226de5ec7f3a08aa8dcfd7a9c7d35bd240fe2b9e4922b1f02074032ef121
Opcode Fuzzy Hash: 94649afaf1194d6202ef468b41f9a190fad77f45f5a584f6a4b91849c2785a74
Instruction Fuzzy Hash: DB2193B39047056FC714DE68D806B96B7DCAF44310F18C82AFA6C8B641E774EA14DB91

Function 00976F40 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 349COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00977340

Strings

parse error, xrefs: 00976FFF, 00977018
parse_error, xrefs: 00976F8B

Memory Dump Source

Source File: 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 0000000A.00000002.3306833326.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3306912829.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307526853.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308342930.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308817329.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: parse error$parse_error
API String ID: 2659868963-1820534363
Opcode ID: 05619d92f5c47758a82992666685f69589250bb8e0a527cce3c6fdef5c60cfcf
Instruction ID: eb2a72d160af7af67bdb59b79d3033e3b5e7c0a2e951242b18886a73271e84c0
Opcode Fuzzy Hash: 05619d92f5c47758a82992666685f69589250bb8e0a527cce3c6fdef5c60cfcf
Instruction Fuzzy Hash: 29E17F719042099FDB18CFA8D984B9DFBF1BF49300F248269E419EB792D7749A81CF91

Function 00976C60 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00976F11
___std_exception_destroy.LIBVCRUNTIME ref: 00976F20

Strings

[json.exception., xrefs: 00976CB8

Memory Dump Source

Source File: 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 0000000A.00000002.3306833326.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3306912829.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307526853.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308342930.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308817329.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.
API String ID: 4194217158-791563284
Opcode ID: 39ab16f2ef354aebdf1e4cb817c734e2cfe09b6fff32e3b69d78e6814c3df5e2
Instruction ID: 1ec21d78b14eb068462ac72ed4894373c312f8e587931c31e0e94822ad73d509
Opcode Fuzzy Hash: 39ab16f2ef354aebdf1e4cb817c734e2cfe09b6fff32e3b69d78e6814c3df5e2
Instruction Fuzzy Hash: 1991F671A006059FDB18CF68C984B9EBBF5FF45300F20C62CE459AB792D771AA41CB91

Function 009EE440 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 009EE491

Strings

type must be string, but is , xrefs: 009EE4F8
type must be boolean, but is , xrefs: 009EE582

Memory Dump Source

Source File: 0000000A.00000002.3306912829.0000000000971000.00000040.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 0000000A.00000002.3306833326.0000000000970000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3306912829.0000000000AA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307526853.0000000000AA8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000AAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000C31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D56000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3307579783.0000000000D70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308342930.0000000000D71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3308817329.0000000000F1A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_970000_RageMP131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: type must be boolean, but is $type must be string, but is
API String ID: 118556049-436076039
Opcode ID: 461c970c5e6740df240f694f8d0ba8e13aced62032bf0b9a9bf37efa06b0e9a0
Instruction ID: 55046319a85a7420925dd2667c20934f3d2adbaf4b61c9ff1b4277c6160fbb05
Opcode Fuzzy Hash: 461c970c5e6740df240f694f8d0ba8e13aced62032bf0b9a9bf37efa06b0e9a0
Instruction Fuzzy Hash: 7C417BB5900248AFCB05EBA4D902B9EB7A8EB40310F148679F419D77D1FB35AD44C796

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LisectAVT_2403002A_218.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\MPGPH131\MPGPH131.exe

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
LisectAVT_2403002A_218.exe

Function 009FE0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Function 00A43A40 Relevance: 2.7, APIs: 2, Instructions: 157
sleepCOMMON

Function 04D00A81 Relevance: 1.9, APIs: 1, Instructions: 393
COMMON

Function 00AD4623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Function 04D00A7A Relevance: 1.9, APIs: 1, Instructions: 393
COMMON

Function 04D00B5F Relevance: 1.9, APIs: 1, Instructions: 375
COMMON

Function 04D00AD5 Relevance: 1.8, APIs: 1, Instructions: 342
COMMON

Function 04D00ADE Relevance: 1.8, APIs: 1, Instructions: 338
COMMON

Function 04D00B02 Relevance: 1.8, APIs: 1, Instructions: 335
COMMON

Function 04D00B1C Relevance: 1.8, APIs: 1, Instructions: 334
COMMON

Function 04D00AF5 Relevance: 1.8, APIs: 1, Instructions: 333
COMMON

Function 04D00B4F Relevance: 1.8, APIs: 1, Instructions: 315
COMMON

Function 04D00B90 Relevance: 1.8, APIs: 1, Instructions: 307
COMMON

Function 04D00BB3 Relevance: 1.8, APIs: 1, Instructions: 285
COMMON

Function 04D00BCC Relevance: 1.8, APIs: 1, Instructions: 281
COMMON