Edit tour

Windows Analysis Report
LisectAVT_2403002A_191.exe

Overview

General Information

Sample name:	LisectAVT_2403002A_191.exe
Analysis ID:	1482443
MD5:	96a48d844ea7baae454fe84845e1e581
SHA1:	77f0819007790eef6ecd0ec1be0e49669132ad3d
SHA256:	dd43fbaaa8a894e08aa200e56c01dea30c346356440c4373082f25f7be4c3154
Tags:	exeRiseProStealer
Infos:

Detection

RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Yara detected RisePro Stealer

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

PE file contains section with special chars

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Uses schtasks.exe or at.exe to add and modify task schedules

Abnormal high CPU Usage

Contains capabilities to detect virtual machines

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Classification

Process Tree

System is w10x64

LisectAVT_2403002A_191.exe (PID: 2696 cmdline: "C:\Users\user\Desktop\LisectAVT_2403002A_191.exe" MD5: 96A48D844EA7BAAE454FE84845E1E581)

schtasks.exe (PID: 4268 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 5900 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MPGPH131.exe (PID: 3448 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 96A48D844EA7BAAE454FE84845E1E581)

MPGPH131.exe (PID: 7120 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 96A48D844EA7BAAE454FE84845E1E581)

RageMP131.exe (PID: 1876 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 96A48D844EA7BAAE454FE84845E1E581)

RageMP131.exe (PID: 2408 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 96A48D844EA7BAAE454FE84845E1E581)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000007.00000003.2062288442.0000000004820000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000008.00000003.2182605884.0000000004820000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000A.00000002.3274056165.0000000000571000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000006.00000003.2061020285.0000000004640000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000A.00000003.2264006131.0000000004450000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000003.2033248421.0000000004720000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: LisectAVT_2403002A_191.exe PID: 2696	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 3448	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 7120	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 1876	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 2408	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe, ProcessId: 2696, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 193.233.132.62

Timestamp:	2024-07-25T23:03:41.523769+0200
SID:	2046269
Source Port:	49704
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 193.233.132.62

Timestamp:	2024-07-25T23:03:57.680324+0200
SID:	2046269
Source Port:	49707
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.12.23.50 - Destination IP: 192.168.2.5

Timestamp:	2024-07-25T23:03:56.303473+0200
SID:	2022930
Source Port:	443
Destination Port:	49708
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 193.233.132.62

Timestamp:	2024-07-25T23:04:04.199047+0200
SID:	2046269
Source Port:	62193
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 193.233.132.62

Timestamp:	2024-07-25T23:03:43.977143+0200
SID:	2046269
Source Port:	49706
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.12.23.50 - Destination IP: 192.168.2.5

Timestamp:	2024-07-25T23:04:36.902166+0200
SID:	2022930
Source Port:	443
Destination Port:	62194
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE RisePro TCP Heartbeat Packet - Source IP: 192.168.2.5 - Destination IP: 193.233.132.62

Timestamp:	2024-07-25T23:03:38.545862+0200
SID:	2049060
Source Port:	49704
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 193.233.132.62

Timestamp:	2024-07-25T23:03:43.886481+0200
SID:	2046269
Source Port:	49705
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE RisePro TCP Heartbeat Packet - Source IP: 192.168.2.5 - Destination IP: 193.233.132.62

Timestamp:	2024-07-25T23:03:40.905756+0200
SID:	2049060
Source Port:	49705
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: LisectAVT_2403002A_191.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Avira: detection malicious, Label: TR/AD.Nekark.cxjdy
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Avira: detection malicious, Label: TR/AD.Nekark.cxjdy

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: LisectAVT_2403002A_191.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 193.233.132.62 ports 0,5,7,8,58709,9

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 193.233.132.62:58709

Source: Joe Sandbox View	IP Address: 193.233.132.62 193.233.132.62
Source: Joe Sandbox View	IP Address: 193.233.132.62 193.233.132.62

Source: Joe Sandbox View

ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU

Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62

Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe

Code function: 0_2_0016E0A0 recv,setsockopt,WSAStartup,closesocket,socket,connect,closesocket,

0_2_0016E0A0

Source: MPGPH131.exe, MPGPH131.exe, 00000007.00000003.2062288442.0000000004820000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000008.00000003.2182605884.0000000004820000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000A.00000002.3274056165.0000000000571000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000A.00000003.2264006131.0000000004450000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: MPGPH131.exe, RageMP131.exe	String found in binary or memory: https://ipinfo.io/
Source: LisectAVT_2403002A_191.exe, 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, LisectAVT_2403002A_191.exe, 00000000.00000003.2033248421.0000000004720000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2061020285.0000000004640000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000007.00000003.2062288442.0000000004820000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000008.00000003.2182605884.0000000004820000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000A.00000002.3274056165.0000000000571000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000A.00000003.2264006131.0000000004450000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: LisectAVT_2403002A_191.exe, 00000000.00000002.3275956463.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3274032651.000000000076D000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3274228386.0000000000A08000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3275956134.0000000000E9E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.3275957814.0000000000B0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: MPGPH131.exe, RageMP131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

System Summary

PE file contains section with special chars

Source: LisectAVT_2403002A_191.exe	Static PE information: section name:
Source: LisectAVT_2403002A_191.exe	Static PE information: section name: .idata
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name: .idata
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_0015B6A0	0_2_0015B6A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_00165B90	0_2_00165B90
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_00167DC0	0_2_00167DC0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001DE140	0_2_001DE140
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001591A0	0_2_001591A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_00169259	0_2_00169259
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001DF360	0_2_001DF360
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001E63D0	0_2_001E63D0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_0023646A	0_2_0023646A
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_002384A0	0_2_002384A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001DE490	0_2_001DE490
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001524F0	0_2_001524F0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001D6550	0_2_001D6550
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001DF600	0_2_001DF600
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_00166689	0_2_00166689
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_00249824	0_2_00249824
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001DF810	0_2_001DF810
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001D9880	0_2_001D9880
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001E68C0	0_2_001E68C0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001648E0	0_2_001648E0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001DE910	0_2_001DE910
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001D5B20	0_2_001D5B20
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_0023BB6D	0_2_0023BB6D
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001D6C00	0_2_001D6C00
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_00168C58	0_2_00168C58
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_00232CE0	0_2_00232CE0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001DBD50	0_2_001DBD50
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_0022CE10	0_2_0022CE10
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_0023BEAF	0_2_0023BEAF
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_00169F50	0_2_00169F50
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001D3F80	0_2_001D3F80
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00C8B6A0	6_2_00C8B6A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00C97E3E	6_2_00C97E3E
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00C948E0	6_2_00C948E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00D09880	6_2_00D09880
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00D0F810	6_2_00D0F810
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00D79824	6_2_00D79824
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00C891A0	6_2_00C891A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00D0E140	6_2_00D0E140
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00D0E910	6_2_00D0E910
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00C99259	6_2_00C99259
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00C95B90	6_2_00C95B90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00D0F360	6_2_00D0F360
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00D6BB6D	6_2_00D6BB6D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00D05B20	6_2_00D05B20
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00D62CE0	6_2_00D62CE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00C824F0	6_2_00C824F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00D0E490	6_2_00D0E490
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00C98C58	6_2_00C98C58
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00D06C00	6_2_00D06C00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00D06550	6_2_00D06550
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00D0BD50	6_2_00D0BD50
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00D6BEAF	6_2_00D6BEAF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00D5CE10	6_2_00D5CE10
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00D0F600	6_2_00D0F600
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00D03F80	6_2_00D03F80
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00C99F50	6_2_00C99F50
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00C8B6A0	7_2_00C8B6A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00C95B90	7_2_00C95B90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00C97DC0	7_2_00C97DC0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00C891A0	7_2_00C891A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00D0E140	7_2_00D0E140
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00C99259	7_2_00C99259
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00D163D0	7_2_00D163D0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00D0F360	7_2_00D0F360
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00C824F0	7_2_00C824F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00D0E490	7_2_00D0E490
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00D06550	7_2_00D06550
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00C96689	7_2_00C96689
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00D0F600	7_2_00D0F600
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00D168C0	7_2_00D168C0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00C948E0	7_2_00C948E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00D09880	7_2_00D09880
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00D0F810	7_2_00D0F810
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00D79824	7_2_00D79824
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00D0E910	7_2_00D0E910
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00D6BB6D	7_2_00D6BB6D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00D05B20	7_2_00D05B20
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00D62CE0	7_2_00D62CE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00C98C58	7_2_00C98C58
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00D06C00	7_2_00D06C00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00D0BD50	7_2_00D0BD50
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00D6BEAF	7_2_00D6BEAF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00D5CE10	7_2_00D5CE10
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00D03F80	7_2_00D03F80
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00C99F50	7_2_00C99F50
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00587E3E	8_2_00587E3E
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_0057B6A0	8_2_0057B6A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00669824	8_2_00669824
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_005FF810	8_2_005FF810
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_005848E0	8_2_005848E0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_005F9880	8_2_005F9880
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_005FE140	8_2_005FE140
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_005FE910	8_2_005FE910
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_005791A0	8_2_005791A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00589259	8_2_00589259
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_0065BB6D	8_2_0065BB6D
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_005FF360	8_2_005FF360
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_005F5B20	8_2_005F5B20
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00585B90	8_2_00585B90
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00588C58	8_2_00588C58
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_0065646A	8_2_0065646A
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_005F6C00	8_2_005F6C00
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00652CE0	8_2_00652CE0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_005724F0	8_2_005724F0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_006584A0	8_2_006584A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_005FE490	8_2_005FE490
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_005F6550	8_2_005F6550
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_005FBD50	8_2_005FBD50
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_005FF600	8_2_005FF600
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_0064CE10	8_2_0064CE10
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_0065BEAF	8_2_0065BEAF
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00589F50	8_2_00589F50
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_005F3F80	8_2_005F3F80

Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: String function: 0022FED0 appears 31 times
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 00D5FED0 appears 62 times
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 00D5F4FC appears 46 times
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 00D6FD51 appears 34 times
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: String function: 0064FED0 appears 31 times

Source: LisectAVT_2403002A_191.exe, 00000000.00000000.2027697816.0000000000288000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamefilezilla.exe4 vs LisectAVT_2403002A_191.exe
Source: LisectAVT_2403002A_191.exe, 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamefilezilla.exe4 vs LisectAVT_2403002A_191.exe
Source: LisectAVT_2403002A_191.exe, 00000000.00000002.3278566813.000000000472D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefilezilla.exe4 vs LisectAVT_2403002A_191.exe
Source: LisectAVT_2403002A_191.exe	Binary or memory string: OriginalFilenamefilezilla.exe4 vs LisectAVT_2403002A_191.exe

Source: LisectAVT_2403002A_191.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: LisectAVT_2403002A_191.exe	Static PE information: Section: ZLIB complexity 0.9990733225108225
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9990733225108225
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9990733225108225

Source: classification engine

Classification label: mal100.troj.evad.winEXE@11/5@0/1

Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe

File created: C:\Users\user\AppData\Local\RageMP131

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5720:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6148:120:WilError_03

Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe

File created: C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Command line argument: nI%		0_2_002548C0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Command line argument: nIg		8_2_006748C0

Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MPGPH131.exe, MPGPH131.exe, 00000007.00000003.2062288442.0000000004820000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000008.00000003.2182605884.0000000004820000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000A.00000002.3274056165.0000000000571000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000A.00000003.2264006131.0000000004450000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: LisectAVT_2403002A_191.exe, 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, LisectAVT_2403002A_191.exe, 00000000.00000003.2033248421.0000000004720000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2061020285.0000000004640000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000007.00000003.2062288442.0000000004820000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000008.00000003.2182605884.0000000004820000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000A.00000002.3274056165.0000000000571000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000A.00000003.2264006131.0000000004450000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

Source: LisectAVT_2403002A_191.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: LisectAVT_2403002A_191.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: MPGPH131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: MPGPH131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: RageMP131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: RageMP131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe

File read: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe "C:\Users\user\Desktop\LisectAVT_2403002A_191.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll	Jump to behavior

Source: LisectAVT_2403002A_191.exe

Static file information: File size 3159050 > 1048576

Source: LisectAVT_2403002A_191.exe

Static PE information: Raw size of wnjuhnsz is bigger than: 0x100000 < 0x26cc00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Unpacked PE file: 0.2.LisectAVT_2403002A_191.exe.150000.0.unpack :EW;.rsrc:W;.idata :W;wnjuhnsz:EW;unhxerdt:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;wnjuhnsz:EW;unhxerdt:EW;.taggant:EW;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 6.2.MPGPH131.exe.c80000.0.unpack :EW;.rsrc:W;.idata :W;wnjuhnsz:EW;unhxerdt:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;wnjuhnsz:EW;unhxerdt:EW;.taggant:EW;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 7.2.MPGPH131.exe.c80000.0.unpack :EW;.rsrc:W;.idata :W;wnjuhnsz:EW;unhxerdt:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;wnjuhnsz:EW;unhxerdt:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 8.2.RageMP131.exe.570000.0.unpack :EW;.rsrc:W;.idata :W;wnjuhnsz:EW;unhxerdt:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;wnjuhnsz:EW;unhxerdt:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 10.2.RageMP131.exe.570000.0.unpack :EW;.rsrc:W;.idata :W;wnjuhnsz:EW;unhxerdt:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;wnjuhnsz:EW;unhxerdt:EW;.taggant:EW;

Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe

Code function: 0_2_00169F50 LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,

0_2_00169F50

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: RageMP131.exe.0.dr	Static PE information: real checksum: 0x308924 should be: 0x30821d
Source: LisectAVT_2403002A_191.exe	Static PE information: real checksum: 0x308924 should be: 0x30821d
Source: MPGPH131.exe.0.dr	Static PE information: real checksum: 0x308924 should be: 0x30821d

Source: LisectAVT_2403002A_191.exe	Static PE information: section name:
Source: LisectAVT_2403002A_191.exe	Static PE information: section name: .idata
Source: LisectAVT_2403002A_191.exe	Static PE information: section name: wnjuhnsz
Source: LisectAVT_2403002A_191.exe	Static PE information: section name: unhxerdt
Source: LisectAVT_2403002A_191.exe	Static PE information: section name: .taggant
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name: .idata
Source: RageMP131.exe.0.dr	Static PE information: section name: wnjuhnsz
Source: RageMP131.exe.0.dr	Static PE information: section name: unhxerdt
Source: RageMP131.exe.0.dr	Static PE information: section name: .taggant
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name: .idata
Source: MPGPH131.exe.0.dr	Static PE information: section name: wnjuhnsz
Source: MPGPH131.exe.0.dr	Static PE information: section name: unhxerdt
Source: MPGPH131.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_0022FA97 push ecx; ret	0_2_0022FAAA
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_00171B20 push esi; ret	0_2_00171B22
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00D5FA97 push ecx; ret	6_2_00D5FAAA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00C97D53 push edi; retf 000Ch	6_2_00C97D56
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00D5FA97 push ecx; ret	7_2_00D5FAAA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00CA1B20 push esi; ret	7_2_00CA1B22
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_0064FA97 push ecx; ret	8_2_0064FAAA
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00587D53 push edi; retf 000Ch	8_2_00587D56

Source: LisectAVT_2403002A_191.exe	Static PE information: section name: entropy: 7.984907273726197
Source: RageMP131.exe.0.dr	Static PE information: section name: entropy: 7.984907273726197
Source: MPGPH131.exe.0.dr	Static PE information: section name: entropy: 7.984907273726197

Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe			Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe			Jump to dropped file

Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe

File created: C:\ProgramData\MPGPH131\MPGPH131.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe

Code function: 0_2_001D3F80 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_001D3F80

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 40F358 second address: 40F362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F57B8C3A836h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 40F362 second address: 40F366 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 40F366 second address: 40F381 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F57B8C3A83Fh 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 40F381 second address: 40F3B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnl 00007F57B901D13Ch 0x0000000e pushad 0x0000000f je 00007F57B901D136h 0x00000015 jo 00007F57B901D136h 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 push ebx 0x00000023 pop ebx 0x00000024 push edi 0x00000025 pop edi 0x00000026 pushad 0x00000027 popad 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b pushad 0x0000002c pushad 0x0000002d popad 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 40F3B7 second address: 40F3C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F57B8C3A836h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 40F3C2 second address: 40F3CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 40F3CA second address: 40F3FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B8C3A848h 0x00000007 jmp 00007F57B8C3A841h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 40F3FB second address: 40F3FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 40F3FF second address: 40F405 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 40F56E second address: 40F58B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F57B901D143h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 40F852 second address: 40F85C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F57B8C3A836h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 40F85C second address: 40F860 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 40F860 second address: 40F879 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F57B8C3A83Ch 0x0000000e jnc 00007F57B8C3A836h 0x00000014 push edi 0x00000015 push esi 0x00000016 pop esi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 40F9C2 second address: 40F9EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 pushad 0x00000007 jmp 00007F57B901D13Bh 0x0000000c jmp 00007F57B901D147h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 40FB46 second address: 40FB80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F57B8C3A83Fh 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F57B8C3A83Bh 0x00000012 jmp 00007F57B8C3A848h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 434D0B second address: 434D11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 432D33 second address: 432D37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 432D37 second address: 432D59 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F57B901D136h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F57B901D13Fh 0x0000000f pop edx 0x00000010 push ebx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 432EFE second address: 432F02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 43307C second address: 433085 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 433085 second address: 433089 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 433089 second address: 43308F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4331CD second address: 4331D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4331D7 second address: 4331DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4331DD second address: 4331E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 43334C second address: 433351 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 433351 second address: 43336D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B8C3A842h 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007F57B8C3A836h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 43336D second address: 433373 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 433373 second address: 43339B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F57B8C3A83Eh 0x0000000f jmp 00007F57B8C3A840h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 43339B second address: 4333A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F57B901D136h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 433638 second address: 433647 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B8C3A83Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 433647 second address: 43366B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F57B901D149h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 43366B second address: 433670 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 433670 second address: 433686 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F57B901D140h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 433686 second address: 4336C5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F57B8C3A846h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push edx 0x00000011 pop edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 popad 0x00000015 jmp 00007F57B8C3A849h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 428806 second address: 42881B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F57B901D13Bh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 42881B second address: 42881F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 3FF01E second address: 3FF023 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 434704 second address: 434710 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007F57B8C3A836h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 434710 second address: 434716 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 43487D second address: 434881 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4374F4 second address: 4374F9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4374F9 second address: 437507 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 437507 second address: 437519 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B901D13Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 437519 second address: 437528 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F57B8C3A83Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4385D4 second address: 4385E9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007F57B901D138h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4385E9 second address: 4385FD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F57B8C3A838h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 43D729 second address: 43D740 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F57B901D13Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 43D740 second address: 43D744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 43D744 second address: 43D758 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B901D140h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 43D758 second address: 43D78F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jc 00007F57B8C3A836h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 pushad 0x00000011 jmp 00007F57B8C3A840h 0x00000016 push esi 0x00000017 pushad 0x00000018 popad 0x00000019 pop esi 0x0000001a popad 0x0000001b mov eax, dword ptr [eax] 0x0000001d push esi 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F57B8C3A83Ch 0x00000025 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 43D78F second address: 43D7A3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007F57B901D136h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 43DDCA second address: 43DDD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 43DDD0 second address: 43DDD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 43E3F2 second address: 43E3F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 43E3F9 second address: 43E421 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], ebx 0x0000000a xor dword ptr [ebp+122D2490h], ebx 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F57B901D144h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 43E421 second address: 43E42F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F57B8C3A836h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 43E863 second address: 43E86D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F57B901D136h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 43E92F second address: 43E942 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F57B8C3A836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jnc 00007F57B8C3A836h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 43E942 second address: 43E953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007F57B901D138h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 43E953 second address: 43E959 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 43E959 second address: 43E9B2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F57B901D136h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007F57B901D138h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 xor esi, dword ptr [ebp+122D2B6Bh] 0x0000002d xchg eax, ebx 0x0000002e jc 00007F57B901D142h 0x00000034 jl 00007F57B901D13Ch 0x0000003a jnp 00007F57B901D136h 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 push esi 0x00000044 jmp 00007F57B901D13Eh 0x00000049 pop esi 0x0000004a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 43E9B2 second address: 43E9C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F57B8C3A841h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 43EEBA second address: 43EEC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 43F86B second address: 43F86F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 43F767 second address: 43F771 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F57B901D136h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 43F86F second address: 43F8D7 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F57B8C3A836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007F57B8C3A838h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 00000016h 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 mov dword ptr [ebp+122D377Ah], esi 0x0000002e push 00000000h 0x00000030 jl 00007F57B8C3A83Ch 0x00000036 mov dword ptr [ebp+122D37F6h], eax 0x0000003c push 00000000h 0x0000003e movsx edi, cx 0x00000041 xchg eax, ebx 0x00000042 jno 00007F57B8C3A83Ch 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007F57B8C3A843h 0x00000050 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 43F771 second address: 43F775 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 440316 second address: 4403A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop esi 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F57B8C3A838h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 0000001Dh 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push ecx 0x00000028 call 00007F57B8C3A838h 0x0000002d pop ecx 0x0000002e mov dword ptr [esp+04h], ecx 0x00000032 add dword ptr [esp+04h], 00000018h 0x0000003a inc ecx 0x0000003b push ecx 0x0000003c ret 0x0000003d pop ecx 0x0000003e ret 0x0000003f mov di, ax 0x00000042 mov dword ptr [ebp+122D259Bh], esi 0x00000048 push 00000000h 0x0000004a add esi, dword ptr [ebp+122D2D13h] 0x00000050 xchg eax, ebx 0x00000051 jmp 00007F57B8C3A83Dh 0x00000056 push eax 0x00000057 pushad 0x00000058 jng 00007F57B8C3A84Dh 0x0000005e jmp 00007F57B8C3A847h 0x00000063 push eax 0x00000064 push edx 0x00000065 pushad 0x00000066 popad 0x00000067 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 441722 second address: 44173D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F57B901D147h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4421FD second address: 442201 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 440AA0 second address: 440AA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 442201 second address: 442205 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 442205 second address: 44220B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 44220B second address: 442215 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F57B8C3A836h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 442BED second address: 442BF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 442CA9 second address: 442CAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 442CAF second address: 442CC8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jno 00007F57B901D136h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 je 00007F57B901D136h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 442CC8 second address: 442CCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 443707 second address: 44376E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B901D145h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edi 0x0000000b jg 00007F57B901D138h 0x00000011 pop edi 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F57B901D138h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 0000001Dh 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d push ebx 0x0000002e mov si, bx 0x00000031 pop edi 0x00000032 mov edi, 70613D81h 0x00000037 push 00000000h 0x00000039 xor dword ptr [ebp+122D22C4h], ecx 0x0000003f push 00000000h 0x00000041 mov esi, eax 0x00000043 xchg eax, ebx 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 44376E second address: 443772 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 443772 second address: 443778 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 443778 second address: 44377D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4485EC second address: 4485F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4485F0 second address: 4485FA instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F57B8C3A836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4485FA second address: 448613 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F57B901D145h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 44A70C second address: 44A718 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 44BC52 second address: 44BC5C instructions: 0x00000000 rdtsc 0x00000002 jl 00007F57B901D13Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 44BC5C second address: 44BC6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a jp 00007F57B8C3A836h 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 44BC6D second address: 44BCC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B901D140h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov bx, si 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007F57B901D138h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 0000001Dh 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 push 00000000h 0x0000002b xor dword ptr [ebp+122D36A9h], ecx 0x00000031 xchg eax, esi 0x00000032 jbe 00007F57B901D140h 0x00000038 pushad 0x00000039 pushad 0x0000003a popad 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 44CCCD second address: 44CCD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 44BE13 second address: 44BE19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 44BE19 second address: 44BE26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pushad 0x0000000b popad 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 44DCCE second address: 44DCD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 44DCD2 second address: 44DCDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 44EBB1 second address: 44EBB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 44EBB7 second address: 44EBBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 44DEF1 second address: 44DEF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 44EE33 second address: 44EE43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F57B8C3A83Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 450CDE second address: 450CE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 450CE2 second address: 450D28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B8C3A842h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov bx, E19Eh 0x0000000e push 00000000h 0x00000010 mov dword ptr [ebp+122D2FC9h], esi 0x00000016 push 00000000h 0x00000018 mov ebx, 7676ADC6h 0x0000001d xchg eax, esi 0x0000001e jnl 00007F57B8C3A83Eh 0x00000024 push eax 0x00000025 pushad 0x00000026 je 00007F57B8C3A838h 0x0000002c push edi 0x0000002d pop edi 0x0000002e push ebx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 451CD6 second address: 451CDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 452C28 second address: 452C2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 452C2D second address: 452C32 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 453D26 second address: 453D2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 453D2C second address: 453D92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B901D149h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jbe 00007F57B901D13Ch 0x00000013 jbe 00007F57B901D14Dh 0x00000019 popad 0x0000001a nop 0x0000001b push ebx 0x0000001c mov edi, ebx 0x0000001e pop edi 0x0000001f push 00000000h 0x00000021 mov dword ptr [ebp+122D20B0h], eax 0x00000027 push 00000000h 0x00000029 or bx, 0B62h 0x0000002e xchg eax, esi 0x0000002f push eax 0x00000030 push edx 0x00000031 push ebx 0x00000032 push ebx 0x00000033 pop ebx 0x00000034 pop ebx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 455F14 second address: 455F76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B8C3A845h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop eax 0x00000012 nop 0x00000013 sbb bx, 7AA5h 0x00000018 xor bh, FFFFFFF2h 0x0000001b push 00000000h 0x0000001d stc 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push ecx 0x00000023 call 00007F57B8C3A838h 0x00000028 pop ecx 0x00000029 mov dword ptr [esp+04h], ecx 0x0000002d add dword ptr [esp+04h], 0000001Bh 0x00000035 inc ecx 0x00000036 push ecx 0x00000037 ret 0x00000038 pop ecx 0x00000039 ret 0x0000003a mov di, AB3Bh 0x0000003e mov dword ptr [ebp+122D3838h], edx 0x00000044 xchg eax, esi 0x00000045 pushad 0x00000046 pushad 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 457FF3 second address: 458072 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F57B901D138h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007F57B901D138h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 mov ebx, dword ptr [ebp+122D1CF8h] 0x0000002f push 00000000h 0x00000031 call 00007F57B901D144h 0x00000036 mov edi, dword ptr [ebp+122D303Bh] 0x0000003c pop ebx 0x0000003d push 00000000h 0x0000003f pushad 0x00000040 sub dword ptr [ebp+122D2079h], eax 0x00000046 mov edx, 2B6448AFh 0x0000004b popad 0x0000004c push eax 0x0000004d pushad 0x0000004e jmp 00007F57B901D142h 0x00000053 jbe 00007F57B901D13Ch 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4560A0 second address: 4560A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 456175 second address: 456179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 45712E second address: 45713C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F57B8C3A836h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 45DF26 second address: 45DF79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F57B901D145h 0x0000000b popad 0x0000000c push edx 0x0000000d jmp 00007F57B901D141h 0x00000012 pop edx 0x00000013 jmp 00007F57B901D13Fh 0x00000018 popad 0x00000019 jo 00007F57B901D15Ch 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F57B901D13Ah 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 45DF79 second address: 45DF7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 43F75A second address: 43F767 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push eax 0x0000000b pop eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 467D04 second address: 467D08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 3F4E85 second address: 3F4EB0 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F57B901D13Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F57B901D136h 0x00000014 jmp 00007F57B901D147h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 3F4EB0 second address: 3F4EF3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F57B8C3A844h 0x0000000e jmp 00007F57B8C3A83Bh 0x00000013 jmp 00007F57B8C3A83Ah 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F57B8C3A83Fh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4669A7 second address: 4669B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4669B3 second address: 4669B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4669B7 second address: 4669CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F57B901D13Fh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 466FB9 second address: 466FBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 467121 second address: 467144 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F57B901D13Ah 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F57B901D13Fh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 467144 second address: 467148 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 46729B second address: 4672A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F57B901D136h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4672A5 second address: 4672AE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4672AE second address: 4672B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4672B4 second address: 4672BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4673F3 second address: 4673FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4673FA second address: 467402 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 467402 second address: 467418 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a jl 00007F57B901D136h 0x00000010 pop esi 0x00000011 pushad 0x00000012 push esi 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 467418 second address: 46741E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 46741E second address: 467423 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 467423 second address: 46742A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4675EE second address: 467607 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F57B901D136h 0x00000008 jmp 00007F57B901D13Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 467607 second address: 46760B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 467B43 second address: 467B49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 467B49 second address: 467B4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 467B4F second address: 467B5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B901D13Bh 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 467B5F second address: 467B76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F57B8C3A83Eh 0x0000000f push edi 0x00000010 pop edi 0x00000011 je 00007F57B8C3A836h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4707C4 second address: 4707C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 407500 second address: 40750D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jbe 00007F57B8C3A83Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 47791D second address: 477921 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 477DAF second address: 477DB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 478218 second address: 47821E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 478EC9 second address: 478ECF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4795DA second address: 4795E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4795E2 second address: 4795E8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 48082E second address: 480834 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 480834 second address: 480838 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 480838 second address: 480842 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F57B901D136h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 480842 second address: 480848 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 480848 second address: 48084E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 48084E second address: 480863 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F57B8C3A83Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 480863 second address: 480869 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 480869 second address: 48086F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 48086F second address: 48088F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F57B901D148h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 48020A second address: 480210 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 480210 second address: 48021E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F57B901D136h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 48021E second address: 480251 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F57B8C3A849h 0x00000009 jc 00007F57B8C3A836h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 push esi 0x00000014 pop esi 0x00000015 jnc 00007F57B8C3A836h 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4803EB second address: 4803FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 ja 00007F57B901D142h 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 481EEF second address: 481EF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 481EF5 second address: 481F17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F57B901D145h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 481F17 second address: 481F1C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4009D9 second address: 4009E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4009E2 second address: 4009F5 instructions: 0x00000000 rdtsc 0x00000002 je 00007F57B8C3A836h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4009F5 second address: 4009F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4009F9 second address: 400A12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 jns 00007F57B8C3A836h 0x0000000f je 00007F57B8C3A836h 0x00000015 pop edi 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 48D2EE second address: 48D2F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F57B901D136h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 48CE6A second address: 48CE70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 48CE70 second address: 48CE78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 48CFF9 second address: 48CFFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 48CFFF second address: 48D005 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 48D005 second address: 48D017 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 js 00007F57B8C3A836h 0x0000000e pop ebx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 48D017 second address: 48D04D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F57B901D136h 0x0000000a jnc 00007F57B901D136h 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F57B901D13Bh 0x0000001a jmp 00007F57B901D146h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 48D04D second address: 48D053 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 495D62 second address: 495D66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 495D66 second address: 495D6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 402547 second address: 40254B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 40254B second address: 40256D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F57B8C3A84Ch 0x0000000c jmp 00007F57B8C3A846h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 40256D second address: 402573 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 402573 second address: 402577 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4A140A second address: 4A1421 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B901D140h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4B995C second address: 4B9962 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4B9962 second address: 4B9966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4B9966 second address: 4B9977 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jnp 00007F57B8C3A836h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4C2353 second address: 4C2361 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4C1EAF second address: 4C1ED4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B8C3A83Dh 0x00000007 jnc 00007F57B8C3A836h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007F57B8C3A836h 0x00000017 jnl 00007F57B8C3A836h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4C3E2E second address: 4C3E48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B901D146h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4C3C60 second address: 4C3CA7 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F57B8C3A84Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F57B8C3A85Bh 0x00000010 pushad 0x00000011 push esi 0x00000012 pop esi 0x00000013 jnp 00007F57B8C3A836h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e jne 00007F57B8C3A836h 0x00000024 jmp 00007F57B8C3A83Bh 0x00000029 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4E7016 second address: 4E7020 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4E7020 second address: 4E7026 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4E7176 second address: 4E717A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4E717A second address: 4E717E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4E717E second address: 4E7199 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F57B901D140h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4E7199 second address: 4E719E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4E719E second address: 4E71A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4E74A4 second address: 4E74A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4E74A8 second address: 4E74E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B901D146h 0x00000007 jmp 00007F57B901D145h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jl 00007F57B901D136h 0x00000015 js 00007F57B901D136h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4E74E5 second address: 4E74EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4E77D9 second address: 4E77E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jbe 00007F57B901D13Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4E77E6 second address: 4E7809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F57B8C3A83Eh 0x0000000b jmp 00007F57B8C3A83Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4E7963 second address: 4E796E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4E796E second address: 4E7973 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4EA9DF second address: 4EA9FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F57B901D146h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4EAB25 second address: 4EAB55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F57B8C3A836h 0x00000009 jmp 00007F57B8C3A844h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 jmp 00007F57B8C3A83Ah 0x0000001b pop esi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	RDTSC instruction interceptor: First address: 4EAB55 second address: 4EAB5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F57B901D136h 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F3F358 second address: F3F362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F57B8C3A836h 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F3F362 second address: F3F366 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F3F366 second address: F3F381 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F57B8C3A83Fh 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F3F381 second address: F3F3B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnl 00007F57B901D13Ch 0x0000000e pushad 0x0000000f je 00007F57B901D136h 0x00000015 jo 00007F57B901D136h 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 push ebx 0x00000023 pop ebx 0x00000024 push edi 0x00000025 pop edi 0x00000026 pushad 0x00000027 popad 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b pushad 0x0000002c pushad 0x0000002d popad 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F3F3B7 second address: F3F3C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F57B8C3A836h 0x0000000a popad 0x0000000b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F3F3C2 second address: F3F3CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F3F3CA second address: F3F3FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B8C3A848h 0x00000007 jmp 00007F57B8C3A841h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F3F3FB second address: F3F3FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F3F3FF second address: F3F405 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F3F56E second address: F3F58B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F57B901D143h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F3F852 second address: F3F85C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F57B8C3A836h 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F3F85C second address: F3F860 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F3F860 second address: F3F879 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F57B8C3A83Ch 0x0000000e jnc 00007F57B8C3A836h 0x00000014 push edi 0x00000015 push esi 0x00000016 pop esi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F3F9C2 second address: F3F9EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 pushad 0x00000007 jmp 00007F57B901D13Bh 0x0000000c jmp 00007F57B901D147h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F3FB46 second address: F3FB80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F57B8C3A83Fh 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F57B8C3A83Bh 0x00000012 jmp 00007F57B8C3A848h 0x00000017 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F3F358 second address: F3F362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F57B901D136h 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F3F366 second address: F3F381 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F57B901D13Fh 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F3F381 second address: F3F3B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnl 00007F57B8C3A83Ch 0x0000000e pushad 0x0000000f je 00007F57B8C3A836h 0x00000015 jo 00007F57B8C3A836h 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 push ebx 0x00000023 pop ebx 0x00000024 push edi 0x00000025 pop edi 0x00000026 pushad 0x00000027 popad 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b pushad 0x0000002c pushad 0x0000002d popad 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F3F3B7 second address: F3F3C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F57B901D136h 0x0000000a popad 0x0000000b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F3F3CA second address: F3F3FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B901D148h 0x00000007 jmp 00007F57B901D141h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F3F56E second address: F3F58B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F57B8C3A843h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F3F852 second address: F3F85C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F57B901D136h 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F3F860 second address: F3F879 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F57B901D13Ch 0x0000000e jnc 00007F57B901D136h 0x00000014 push edi 0x00000015 push esi 0x00000016 pop esi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F3F9C2 second address: F3F9EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 pushad 0x00000007 jmp 00007F57B8C3A83Bh 0x0000000c jmp 00007F57B8C3A847h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F3FB46 second address: F3FB80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F57B901D13Fh 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F57B901D13Bh 0x00000012 jmp 00007F57B901D148h 0x00000017 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F64D0B second address: F64D11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F62D33 second address: F62D37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F62D37 second address: F62D59 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F57B8C3A836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F57B8C3A83Fh 0x0000000f pop edx 0x00000010 push ebx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F62EFE second address: F62F02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6307C second address: F63085 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F63085 second address: F63089 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F63089 second address: F6308F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F631CD second address: F631D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F631D7 second address: F631DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F631DD second address: F631E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6334C second address: F63351 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F63351 second address: F6336D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B901D142h 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007F57B901D136h 0x0000000f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6336D second address: F63373 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F63373 second address: F6339B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F57B901D13Eh 0x0000000f jmp 00007F57B901D140h 0x00000014 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6339B second address: F633A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F57B8C3A836h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F63638 second address: F63647 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B901D13Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F63647 second address: F6366B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F57B8C3A849h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6366B second address: F63670 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F63670 second address: F63686 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F57B8C3A840h 0x0000000b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F63686 second address: F636C5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F57B901D146h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push edx 0x00000011 pop edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 popad 0x00000015 jmp 00007F57B901D149h 0x0000001a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F58806 second address: F5881B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F57B8C3A83Bh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F5881B second address: F5881F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F2F01E second address: F2F023 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F64704 second address: F64710 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007F57B901D136h 0x0000000c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F64710 second address: F64716 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6487D second address: F64881 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F674F4 second address: F674F9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F674F9 second address: F67507 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F67507 second address: F67519 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B8C3A83Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F67519 second address: F67528 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F57B901D13Bh 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F685D4 second address: F685E9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007F57B8C3A838h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F685E9 second address: F685FD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F57B901D138h 0x00000012 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6D729 second address: F6D740 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F57B8C3A83Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6D740 second address: F6D744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6D744 second address: F6D758 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B8C3A840h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6D758 second address: F6D78F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jc 00007F57B901D136h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 pushad 0x00000011 jmp 00007F57B901D140h 0x00000016 push esi 0x00000017 pushad 0x00000018 popad 0x00000019 pop esi 0x0000001a popad 0x0000001b mov eax, dword ptr [eax] 0x0000001d push esi 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F57B901D13Ch 0x00000025 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6D78F second address: F6D7A3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007F57B8C3A836h 0x00000014 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6DDCA second address: F6DDD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6DDD0 second address: F6DDD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6E3F2 second address: F6E3F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6E3F9 second address: F6E421 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], ebx 0x0000000a xor dword ptr [ebp+122D2490h], ebx 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F57B8C3A844h 0x00000019 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6E421 second address: F6E42F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F57B901D136h 0x0000000e rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6E863 second address: F6E86D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F57B8C3A836h 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6E92F second address: F6E942 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F57B901D136h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jnc 00007F57B901D136h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6E942 second address: F6E953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007F57B8C3A838h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6E953 second address: F6E959 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6E959 second address: F6E9B2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F57B8C3A836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007F57B8C3A838h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 xor esi, dword ptr [ebp+122D2B6Bh] 0x0000002d xchg eax, ebx 0x0000002e jc 00007F57B8C3A842h 0x00000034 jl 00007F57B8C3A83Ch 0x0000003a jnp 00007F57B8C3A836h 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 push esi 0x00000044 jmp 00007F57B8C3A83Eh 0x00000049 pop esi 0x0000004a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6E9B2 second address: F6E9C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F57B901D141h 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6EEBA second address: F6EEC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6F86B second address: F6F86F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6F86F second address: F6F8D7 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F57B8C3A836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007F57B8C3A838h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 00000016h 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 mov dword ptr [ebp+122D377Ah], esi 0x0000002e push 00000000h 0x00000030 jl 00007F57B8C3A83Ch 0x00000036 mov dword ptr [ebp+122D37F6h], eax 0x0000003c push 00000000h 0x0000003e movsx edi, cx 0x00000041 xchg eax, ebx 0x00000042 jno 00007F57B8C3A83Ch 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007F57B8C3A843h 0x00000050 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6F767 second address: F6F771 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F57B901D136h 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6F771 second address: F6F775 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F70316 second address: F703A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop esi 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F57B901D138h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 0000001Dh 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push ecx 0x00000028 call 00007F57B901D138h 0x0000002d pop ecx 0x0000002e mov dword ptr [esp+04h], ecx 0x00000032 add dword ptr [esp+04h], 00000018h 0x0000003a inc ecx 0x0000003b push ecx 0x0000003c ret 0x0000003d pop ecx 0x0000003e ret 0x0000003f mov di, ax 0x00000042 mov dword ptr [ebp+122D259Bh], esi 0x00000048 push 00000000h 0x0000004a add esi, dword ptr [ebp+122D2D13h] 0x00000050 xchg eax, ebx 0x00000051 jmp 00007F57B901D13Dh 0x00000056 push eax 0x00000057 pushad 0x00000058 jng 00007F57B901D14Dh 0x0000005e push eax 0x0000005f push edx 0x00000060 pushad 0x00000061 popad 0x00000062 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F70AA0 second address: F70AA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F71722 second address: F7173D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F57B901D147h 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F721FD second address: F72201 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F72201 second address: F72205 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F72205 second address: F7220B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F7220B second address: F72215 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F57B901D136h 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F72BED second address: F72BF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F72CA9 second address: F72CAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F72CAF second address: F72CC8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jno 00007F57B8C3A836h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 je 00007F57B8C3A836h 0x00000018 popad 0x00000019 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F72CC8 second address: F72CCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F73707 second address: F7376E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B8C3A845h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edi 0x0000000b jg 00007F57B8C3A838h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pop edi 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007F57B8C3A838h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 0000001Dh 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f push ebx 0x00000030 mov si, bx 0x00000033 pop edi 0x00000034 mov edi, 70613D81h 0x00000039 push 00000000h 0x0000003b xor dword ptr [ebp+122D22C4h], ecx 0x00000041 push 00000000h 0x00000043 mov esi, eax 0x00000045 xchg eax, ebx 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b popad 0x0000004c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F7376E second address: F73772 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F73772 second address: F73778 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F73778 second address: F7377D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F785EC second address: F785F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F785F0 second address: F785FA instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F57B901D136h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F785FA second address: F78613 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F57B8C3A845h 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F7A70C second address: F7A718 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F7BC52 second address: F7BC5C instructions: 0x00000000 rdtsc 0x00000002 jl 00007F57B8C3A83Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F7BC5C second address: F7BC6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a jp 00007F57B901D136h 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F7BC6D second address: F7BCC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B8C3A840h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov bx, si 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007F57B8C3A838h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 0000001Dh 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 push 00000000h 0x0000002b xor dword ptr [ebp+122D36A9h], ecx 0x00000031 xchg eax, esi 0x00000032 jbe 00007F57B8C3A840h 0x00000038 pushad 0x00000039 pushad 0x0000003a popad 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F7CCCD second address: F7CCD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F7BE13 second address: F7BE19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F7BE19 second address: F7BE26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pushad 0x0000000b popad 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F7DCCE second address: F7DCD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F7DCD2 second address: F7DCDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F7EBB1 second address: F7EBB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F7EBB7 second address: F7EBBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F7DEF1 second address: F7DEF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F7EE33 second address: F7EE43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F57B901D13Ch 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F80CDE second address: F80CE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F80CE2 second address: F80D28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B901D142h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov bx, E19Eh 0x0000000e push 00000000h 0x00000010 mov dword ptr [ebp+122D2FC9h], esi 0x00000016 push 00000000h 0x00000018 mov ebx, 7676ADC6h 0x0000001d xchg eax, esi 0x0000001e jnl 00007F57B901D13Eh 0x00000024 push eax 0x00000025 pushad 0x00000026 je 00007F57B901D138h 0x0000002c push edi 0x0000002d pop edi 0x0000002e push ebx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F81CD6 second address: F81CDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F82C28 second address: F82C2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F82C2D second address: F82C32 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F83D26 second address: F83D2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F83D2C second address: F83D92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B8C3A849h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jbe 00007F57B8C3A83Ch 0x00000013 jbe 00007F57B8C3A84Dh 0x00000019 popad 0x0000001a nop 0x0000001b push ebx 0x0000001c mov edi, ebx 0x0000001e pop edi 0x0000001f push 00000000h 0x00000021 mov dword ptr [ebp+122D20B0h], eax 0x00000027 push 00000000h 0x00000029 or bx, 0B62h 0x0000002e xchg eax, esi 0x0000002f push eax 0x00000030 push edx 0x00000031 push ebx 0x00000032 push ebx 0x00000033 pop ebx 0x00000034 pop ebx 0x00000035 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F85F14 second address: F85F76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B901D145h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop eax 0x00000012 nop 0x00000013 sbb bx, 7AA5h 0x00000018 xor bh, FFFFFFF2h 0x0000001b push 00000000h 0x0000001d stc 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push ecx 0x00000023 call 00007F57B901D138h 0x00000028 pop ecx 0x00000029 mov dword ptr [esp+04h], ecx 0x0000002d add dword ptr [esp+04h], 0000001Bh 0x00000035 inc ecx 0x00000036 push ecx 0x00000037 ret 0x00000038 pop ecx 0x00000039 ret 0x0000003a mov di, AB3Bh 0x0000003e mov dword ptr [ebp+122D3838h], edx 0x00000044 xchg eax, esi 0x00000045 pushad 0x00000046 pushad 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F860A0 second address: F860A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F86175 second address: F86179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F87FF3 second address: F88072 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F57B8C3A838h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007F57B8C3A838h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 mov ebx, dword ptr [ebp+122D1CF8h] 0x0000002f push 00000000h 0x00000031 call 00007F57B8C3A844h 0x00000036 mov edi, dword ptr [ebp+122D303Bh] 0x0000003c pop ebx 0x0000003d push 00000000h 0x0000003f pushad 0x00000040 sub dword ptr [ebp+122D2079h], eax 0x00000046 mov edx, 2B6448AFh 0x0000004b popad 0x0000004c push eax 0x0000004d pushad 0x0000004e jmp 00007F57B8C3A842h 0x00000053 jbe 00007F57B8C3A83Ch 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F8712E second address: F8713C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F57B901D136h 0x0000000e rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F8DF26 second address: F8DF79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F57B8C3A845h 0x0000000b popad 0x0000000c push edx 0x0000000d jmp 00007F57B8C3A841h 0x00000012 pop edx 0x00000013 jmp 00007F57B8C3A83Fh 0x00000018 popad 0x00000019 jo 00007F57B8C3A85Ch 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F57B8C3A83Ah 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F8DF79 second address: F8DF7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F97D04 second address: F97D08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F24E85 second address: F24EB0 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F57B901D13Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F57B901D136h 0x00000014 jmp 00007F57B901D147h 0x00000019 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F24EB0 second address: F24EF3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F57B8C3A844h 0x0000000e jmp 00007F57B8C3A83Bh 0x00000013 jmp 00007F57B8C3A83Ah 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F57B8C3A83Fh 0x0000001f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F969A7 second address: F969B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F969B3 second address: F969B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F969B7 second address: F969CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F57B901D13Fh 0x0000000b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F96FB9 second address: F96FBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F97121 second address: F97144 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F57B901D13Ah 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F57B901D13Fh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F97144 second address: F97148 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F9729B second address: F972A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F57B901D136h 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F972A5 second address: F972AE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F972AE second address: F972B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F972B4 second address: F972BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F973F3 second address: F973FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F973FA second address: F97402 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F97402 second address: F97418 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a jl 00007F57B901D136h 0x00000010 pop esi 0x00000011 pushad 0x00000012 push esi 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F97418 second address: F9741E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F9741E second address: F97423 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F97423 second address: F9742A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F975EE second address: F97607 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F57B901D136h 0x00000008 jmp 00007F57B901D13Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F97607 second address: F9760B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F97B43 second address: F97B49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F97B49 second address: F97B4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F97B4F second address: F97B5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B901D13Bh 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F97B5F second address: F97B76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F57B8C3A83Eh 0x0000000f push edi 0x00000010 pop edi 0x00000011 je 00007F57B8C3A836h 0x00000017 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FA07C4 second address: FA07C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F37500 second address: F3750D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jbe 00007F57B8C3A83Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FA791D second address: FA7921 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FA7DAF second address: FA7DB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FA8218 second address: FA821E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FA8EC9 second address: FA8ECF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FA95DA second address: FA95E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FA95E2 second address: FA95E8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FB082E second address: FB0834 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FB0834 second address: FB0838 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FB0838 second address: FB0842 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F57B901D136h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FB0842 second address: FB0848 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FB0848 second address: FB084E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FB084E second address: FB0863 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F57B8C3A83Bh 0x0000000f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FB0863 second address: FB0869 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FB0869 second address: FB086F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FB086F second address: FB088F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F57B901D148h 0x0000000d rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FB020A second address: FB0210 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FB0210 second address: FB021E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F57B901D136h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FB021E second address: FB0251 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F57B8C3A849h 0x00000009 jc 00007F57B8C3A836h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 push esi 0x00000014 pop esi 0x00000015 jnc 00007F57B8C3A836h 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FB03EB second address: FB03FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 ja 00007F57B901D142h 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FB1EEF second address: FB1EF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FB1EF5 second address: FB1F17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F57B901D145h 0x00000011 popad 0x00000012 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FB1F17 second address: FB1F1C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F309D9 second address: F309E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F309E2 second address: F309F5 instructions: 0x00000000 rdtsc 0x00000002 je 00007F57B8C3A836h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F309F5 second address: F309F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F309F9 second address: F30A12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 jns 00007F57B8C3A836h 0x0000000f je 00007F57B8C3A836h 0x00000015 pop edi 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6F75A second address: F6F767 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push eax 0x0000000b pop eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FBD2EE second address: FBD2F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F57B8C3A836h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FBCE6A second address: FBCE70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FBCE70 second address: FBCE78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FBCFF9 second address: FBCFFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FBCFFF second address: FBD005 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FBD005 second address: FBD017 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 js 00007F57B901D136h 0x0000000e pop ebx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FBD017 second address: FBD04D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F57B8C3A836h 0x0000000a jnc 00007F57B8C3A836h 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F57B8C3A83Bh 0x0000001a jmp 00007F57B8C3A846h 0x0000001f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FBD04D second address: FBD053 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FC5D62 second address: FC5D66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FC5D66 second address: FC5D6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F32547 second address: F3254B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F3254B second address: F3256D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F57B901D14Ch 0x0000000c jmp 00007F57B901D146h 0x00000011 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F3256D second address: F32573 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F32573 second address: F32577 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FD140A second address: FD1421 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B8C3A840h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F63351 second address: F6336D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B8C3A842h 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007F57B8C3A836h 0x0000000f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F63373 second address: F6339B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F57B8C3A83Eh 0x0000000f jmp 00007F57B8C3A840h 0x00000014 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6339B second address: F633A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F57B901D136h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F63638 second address: F63647 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B8C3A83Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F63647 second address: F6366B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F57B901D149h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F63670 second address: F63686 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F57B901D140h 0x0000000b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F63686 second address: F636C5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F57B8C3A846h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push edx 0x00000011 pop edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 popad 0x00000015 jmp 00007F57B8C3A849h 0x0000001a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F58806 second address: F5881B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F57B901D13Bh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F64704 second address: F64710 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007F57B8C3A836h 0x0000000c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F67507 second address: F67519 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B901D13Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F67519 second address: F67528 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F57B8C3A83Bh 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F685D4 second address: F685E9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007F57B901D138h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F685E9 second address: F685FD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F57B8C3A838h 0x00000012 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6D729 second address: F6D740 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F57B901D13Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6D744 second address: F6D758 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B901D140h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6D758 second address: F6D78F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jc 00007F57B8C3A836h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 pushad 0x00000011 jmp 00007F57B8C3A840h 0x00000016 push esi 0x00000017 pushad 0x00000018 popad 0x00000019 pop esi 0x0000001a popad 0x0000001b mov eax, dword ptr [eax] 0x0000001d push esi 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F57B8C3A83Ch 0x00000025 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6D78F second address: F6D7A3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007F57B901D136h 0x00000014 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6E3F9 second address: F6E421 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], ebx 0x0000000a xor dword ptr [ebp+122D2490h], ebx 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F57B901D144h 0x00000019 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6E421 second address: F6E42F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F57B8C3A836h 0x0000000e rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6E863 second address: F6E86D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F57B901D136h 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6E92F second address: F6E942 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F57B8C3A836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jnc 00007F57B8C3A836h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6E942 second address: F6E953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007F57B901D138h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6E959 second address: F6E9B2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F57B901D136h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007F57B901D138h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 xor esi, dword ptr [ebp+122D2B6Bh] 0x0000002d xchg eax, ebx 0x0000002e jc 00007F57B901D142h 0x00000034 jl 00007F57B901D13Ch 0x0000003a jnp 00007F57B901D136h 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 push esi 0x00000044 jmp 00007F57B901D13Eh 0x00000049 pop esi 0x0000004a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6E9B2 second address: F6E9C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F57B8C3A841h 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6F86F second address: F6F8D7 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F57B901D136h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007F57B901D138h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 00000016h 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 mov dword ptr [ebp+122D377Ah], esi 0x0000002e push 00000000h 0x00000030 jl 00007F57B901D13Ch 0x00000036 mov dword ptr [ebp+122D37F6h], eax 0x0000003c push 00000000h 0x0000003e movsx edi, cx 0x00000041 xchg eax, ebx 0x00000042 jno 00007F57B901D13Ch 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007F57B901D143h 0x00000050 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F6F767 second address: F6F771 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F57B8C3A836h 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F70316 second address: F703A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop esi 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F57B8C3A838h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 0000001Dh 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push ecx 0x00000028 call 00007F57B8C3A838h 0x0000002d pop ecx 0x0000002e mov dword ptr [esp+04h], ecx 0x00000032 add dword ptr [esp+04h], 00000018h 0x0000003a inc ecx 0x0000003b push ecx 0x0000003c ret 0x0000003d pop ecx 0x0000003e ret 0x0000003f mov di, ax 0x00000042 mov dword ptr [ebp+122D259Bh], esi 0x00000048 push 00000000h 0x0000004a add esi, dword ptr [ebp+122D2D13h] 0x00000050 xchg eax, ebx 0x00000051 jmp 00007F57B8C3A83Dh 0x00000056 push eax 0x00000057 pushad 0x00000058 jng 00007F57B8C3A84Dh 0x0000005e jmp 00007F57B8C3A847h 0x00000063 push eax 0x00000064 push edx 0x00000065 pushad 0x00000066 popad 0x00000067 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FE995C second address: FE9962 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FE9962 second address: FE9966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FE9966 second address: FE9977 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jnp 00007F57B901D136h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F87FF3 second address: F88072 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F57B901D138h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007F57B901D138h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 mov ebx, dword ptr [ebp+122D1CF8h] 0x0000002f push 00000000h 0x00000031 call 00007F57B901D144h 0x00000036 mov edi, dword ptr [ebp+122D303Bh] 0x0000003c pop ebx 0x0000003d push 00000000h 0x0000003f pushad 0x00000040 sub dword ptr [ebp+122D2079h], eax 0x00000046 mov edx, 2B6448AFh 0x0000004b popad 0x0000004c push eax 0x0000004d pushad 0x0000004e jmp 00007F57B901D142h 0x00000053 jbe 00007F57B901D13Ch 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F8712E second address: F8713C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F57B8C3A836h 0x0000000e rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F8DF26 second address: F8DF79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F57B901D145h 0x0000000b popad 0x0000000c push edx 0x0000000d jmp 00007F57B901D141h 0x00000012 pop edx 0x00000013 jmp 00007F57B901D13Fh 0x00000018 popad 0x00000019 jo 00007F57B901D15Ch 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F57B901D13Ah 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F24E85 second address: F24EB0 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F57B8C3A83Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F57B8C3A836h 0x00000014 jmp 00007F57B8C3A847h 0x00000019 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F24EB0 second address: F24EF3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F57B901D144h 0x0000000e jmp 00007F57B901D13Bh 0x00000013 jmp 00007F57B901D13Ah 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F57B901D13Fh 0x0000001f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F969B7 second address: F969CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F57B8C3A83Fh 0x0000000b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F97121 second address: F97144 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F57B8C3A83Ah 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F57B8C3A83Fh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F9729B second address: F972A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F57B8C3A836h 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F97402 second address: F97418 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a jl 00007F57B8C3A836h 0x00000010 pop esi 0x00000011 pushad 0x00000012 push esi 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F975EE second address: F97607 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F57B8C3A836h 0x00000008 jmp 00007F57B8C3A83Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F97B4F second address: F97B5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B8C3A83Bh 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F97B5F second address: F97B76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F57B901D13Eh 0x0000000f push edi 0x00000010 pop edi 0x00000011 je 00007F57B901D136h 0x00000017 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F37500 second address: F3750D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jbe 00007F57B901D13Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FF2353 second address: FF2361 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FF1EAF second address: FF1ED4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B901D13Dh 0x00000007 jnc 00007F57B901D136h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007F57B901D136h 0x00000017 jnl 00007F57B901D136h 0x0000001d rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FF3E2E second address: FF3E48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B8C3A846h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FF3C60 second address: FF3CA7 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F57B901D14Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F57B901D15Bh 0x00000010 pushad 0x00000011 push esi 0x00000012 pop esi 0x00000013 jnp 00007F57B901D136h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e jne 00007F57B901D136h 0x00000024 jmp 00007F57B901D13Bh 0x00000029 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 1017016 second address: 1017020 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 1017020 second address: 1017026 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 1017176 second address: 101717A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 101717A second address: 101717E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 101717E second address: 1017199 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F57B8C3A840h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 1017199 second address: 101719E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 101719E second address: 10171A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 10174A4 second address: 10174A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 10174A8 second address: 10174E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B8C3A846h 0x00000007 jmp 00007F57B8C3A845h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jl 00007F57B8C3A836h 0x00000015 js 00007F57B8C3A836h 0x0000001b popad 0x0000001c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 10174E5 second address: 10174EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 10177D9 second address: 10177E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jbe 00007F57B8C3A83Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 10177E6 second address: 1017809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F57B901D13Eh 0x0000000b jmp 00007F57B901D13Fh 0x00000010 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 1017963 second address: 101796E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 101796E second address: 1017973 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 101A9DF second address: 101A9FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F57B8C3A846h 0x0000000f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 101AB25 second address: 101AB55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F57B901D136h 0x00000009 jmp 00007F57B901D144h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 jmp 00007F57B901D13Ah 0x0000001b pop esi 0x0000001c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 101AB55 second address: 101AB5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F57B8C3A836h 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FBD2EE second address: FBD2F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F57B901D136h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FBD005 second address: FBD017 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 js 00007F57B8C3A836h 0x0000000e pop ebx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FBD017 second address: FBD04D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F57B901D136h 0x0000000a jnc 00007F57B901D136h 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F57B901D13Bh 0x0000001a jmp 00007F57B901D146h 0x0000001f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: F3254B second address: F3256D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F57B8C3A84Ch 0x0000000c jmp 00007F57B8C3A846h 0x00000011 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FD140A second address: FD1421 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B901D140h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FE9966 second address: FE9977 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jnp 00007F57B8C3A836h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FF1EAF second address: FF1ED4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B8C3A83Dh 0x00000007 jnc 00007F57B8C3A836h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007F57B8C3A836h 0x00000017 jnl 00007F57B8C3A836h 0x0000001d rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FF3E2E second address: FF3E48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B901D146h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: FF3C60 second address: FF3CA7 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F57B8C3A84Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F57B8C3A85Bh 0x00000010 pushad 0x00000011 push esi 0x00000012 pop esi 0x00000013 jnp 00007F57B8C3A836h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e jne 00007F57B8C3A836h 0x00000024 jmp 00007F57B8C3A83Bh 0x00000029 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 101717E second address: 1017199 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F57B901D140h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 10174A8 second address: 10174E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B901D146h 0x00000007 jmp 00007F57B901D145h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jl 00007F57B901D136h 0x00000015 js 00007F57B901D136h 0x0000001b popad 0x0000001c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 10177D9 second address: 10177E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jbe 00007F57B901D13Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 10177E6 second address: 1017809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F57B8C3A83Eh 0x0000000b jmp 00007F57B8C3A83Fh 0x00000010 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 101A9DF second address: 101A9FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F57B901D146h 0x0000000f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 101AB25 second address: 101AB55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F57B8C3A836h 0x00000009 jmp 00007F57B8C3A844h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 jmp 00007F57B8C3A83Ah 0x0000001b pop esi 0x0000001c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 101AB55 second address: 101AB5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F57B901D136h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 82F358 second address: 82F362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F57B8C3A836h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 82F362 second address: 82F366 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 82F366 second address: 82F381 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F57B8C3A83Fh 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 82F381 second address: 82F3B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnl 00007F57B901D13Ch 0x0000000e pushad 0x0000000f je 00007F57B901D136h 0x00000015 jo 00007F57B901D136h 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 push ebx 0x00000023 pop ebx 0x00000024 push edi 0x00000025 pop edi 0x00000026 pushad 0x00000027 popad 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b pushad 0x0000002c pushad 0x0000002d popad 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 82F3B7 second address: 82F3C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F57B8C3A836h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 82F3C2 second address: 82F3CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 82F3CA second address: 82F3FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57B8C3A848h 0x00000007 jmp 00007F57B8C3A841h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 82F3FB second address: 82F3FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 82F3FF second address: 82F405 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 82F56E second address: 82F58B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F57B901D143h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 82F852 second address: 82F85C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F57B8C3A836h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 82F85C second address: 82F860 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 82F860 second address: 82F879 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F57B8C3A83Ch 0x0000000e jnc 00007F57B8C3A836h 0x00000014 push edi 0x00000015 push esi 0x00000016 pop esi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 82F9C2 second address: 82F9EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 pushad 0x00000007 jmp 00007F57B901D13Bh 0x0000000c jmp 00007F57B901D147h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 82FB46 second address: 82FB80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F57B8C3A83Fh 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F57B8C3A83Bh 0x00000012 jmp 00007F57B8C3A848h 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 854D0B second address: 854D11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 852D33 second address: 852D37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 852D37 second address: 852D59 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F57B901D136h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F57B901D13Fh 0x0000000f pop edx 0x00000010 push ebx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 852EFE second address: 852F02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 85307C second address: 853085 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 853085 second address: 853089 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 853089 second address: 85308F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Special instruction interceptor: First address: 48AB62 instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: FBAB62 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: 8AAB62 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Window / User API: threadDelayed 1401	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 1088	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 423	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 1017	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 416	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1217	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1079	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1109	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1182	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1234	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe TID: 5044	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe TID: 5044	Thread sleep time: -68034s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe TID: 4616	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe TID: 4616	Thread sleep time: -76038s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe TID: 5820	Thread sleep count: 294 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe TID: 6252	Thread sleep count: 247 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe TID: 2792	Thread sleep count: 1401 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe TID: 2792	Thread sleep time: -2803401s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1172	Thread sleep count: 115 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1172	Thread sleep time: -230115s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5280	Thread sleep count: 126 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5280	Thread sleep time: -252126s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4748	Thread sleep count: 1088 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4748	Thread sleep time: -109888s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3692	Thread sleep count: 423 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3692	Thread sleep count: 115 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5524	Thread sleep count: 122 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5524	Thread sleep time: -244122s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6156	Thread sleep count: 95 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6156	Thread sleep time: -190095s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5324	Thread sleep count: 96 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5324	Thread sleep time: -192096s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5676	Thread sleep count: 115 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5676	Thread sleep time: -230115s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3992	Thread sleep count: 110 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3992	Thread sleep time: -220110s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5756	Thread sleep count: 1017 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5756	Thread sleep time: -102717s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 320	Thread sleep count: 416 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 320	Thread sleep count: 149 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3500	Thread sleep count: 135 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3500	Thread sleep time: -270135s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 6148	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 5248	Thread sleep count: 1217 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 5248	Thread sleep time: -2435217s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 5636	Thread sleep count: 93 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 5636	Thread sleep count: 265 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 2320	Thread sleep count: 222 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 4320	Thread sleep count: 1079 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 4320	Thread sleep time: -2159079s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 4220	Thread sleep count: 1109 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 4220	Thread sleep time: -2219109s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 5252	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 6096	Thread sleep count: 1182 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 6096	Thread sleep time: -2365182s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 2260	Thread sleep count: 289 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 6384	Thread sleep count: 248 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 5296	Thread sleep count: 1234 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 5296	Thread sleep time: -2469234s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001B9610 GetKeyboardLayoutList followed by cmp: cmp ecx, edx and CTI: je 001B962Ah	0_2_001B9610
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001B7750 GetKeyboardLayoutList followed by cmp: cmp eax, 0eh and CTI: jc 001B7760h country: Hungarian (hu)	0_2_001B7750
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001B7780 GetKeyboardLayoutList followed by cmp: cmp eax, 21h and CTI: jc 001B7790h country: Indonesian (id)	0_2_001B7780
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001B7D40 GetKeyboardLayoutList followed by cmp: cmp eax, 2eh and CTI: jc 001B7D50h country: Upper Sorbian (hsb)	0_2_001B7D40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00CE7D40 GetKeyboardLayoutList followed by cmp: cmp eax, 2eh and CTI: jc 00CE7D50h country: Upper Sorbian (hsb)	6_2_00CE7D40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00CE9610 GetKeyboardLayoutList followed by cmp: cmp ecx, edx and CTI: je 00CE962Ah	6_2_00CE9610
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00CE7780 GetKeyboardLayoutList followed by cmp: cmp eax, 21h and CTI: jc 00CE7790h country: Indonesian (id)	6_2_00CE7780
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00CE7750 GetKeyboardLayoutList followed by cmp: cmp eax, 0eh and CTI: jc 00CE7760h country: Hungarian (hu)	6_2_00CE7750
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00CE9610 GetKeyboardLayoutList followed by cmp: cmp ecx, edx and CTI: je 00CE962Ah	7_2_00CE9610
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00CE7780 GetKeyboardLayoutList followed by cmp: cmp eax, 21h and CTI: jc 00CE7790h country: Indonesian (id)	7_2_00CE7780
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00CE7750 GetKeyboardLayoutList followed by cmp: cmp eax, 0eh and CTI: jc 00CE7760h country: Hungarian (hu)	7_2_00CE7750
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00CE7D40 GetKeyboardLayoutList followed by cmp: cmp eax, 2eh and CTI: jc 00CE7D50h country: Upper Sorbian (hsb)	7_2_00CE7D40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_005D7D40 GetKeyboardLayoutList followed by cmp: cmp eax, 2eh and CTI: jc 005D7D50h country: Upper Sorbian (hsb)	8_2_005D7D40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_005D9610 GetKeyboardLayoutList followed by cmp: cmp ecx, edx and CTI: je 005D962Ah	8_2_005D9610
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_005D7750 GetKeyboardLayoutList followed by cmp: cmp eax, 0eh and CTI: jc 005D7760h country: Hungarian (hu)	8_2_005D7750
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_005D7780 GetKeyboardLayoutList followed by cmp: cmp eax, 21h and CTI: jc 005D7790h country: Indonesian (id)	8_2_005D7780

Source: LisectAVT_2403002A_191.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: RageMP131.exe, 00000008.00000002.3275956134.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\
Source: LisectAVT_2403002A_191.exe, 00000000.00000002.3275956463.0000000000E6F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 3c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_78BF175D`
Source: MPGPH131.exe, 00000007.00000002.3274228386.0000000000A42000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_78BF175D
Source: RageMP131.exe, 0000000A.00000002.3274007853.000000000055D000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 00000007.00000002.3274228386.0000000000A08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}tP
Source: MPGPH131.exe, 00000007.00000003.2073921795.0000000000A42000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}x
Source: MPGPH131.exe, 00000006.00000002.3274032651.000000000076D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlli
Source: RageMP131.exe, 00000008.00000002.3275956134.0000000000E90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000VISION=8f08ProgramData=C:\PrL
Source: MPGPH131.exe, 00000006.00000002.3273997793.000000000073C000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}v
Source: MPGPH131.exe, 00000007.00000003.2073921795.0000000000A40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 00000006.00000002.3274032651.000000000076D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: y\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000s\user\AppData\Local\Temp\h
Source: RageMP131.exe, 0000000A.00000002.3275957814.0000000000B32000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}/
Source: LisectAVT_2403002A_191.exe, 00000000.00000002.3275956463.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll`
Source: RageMP131.exe, 00000008.00000002.3275956134.0000000000E90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000=Q
Source: RageMP131.exe, 0000000A.00000002.3275957814.0000000000B0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}.
Source: RageMP131.exe, 0000000A.00000002.3275957814.0000000000B0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: RageMP131.exe, 0000000A.00000002.3275957814.0000000000B0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: MPGPH131.exe, 00000006.00000002.3274032651.00000000007AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (w#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 00000007.00000002.3274228386.0000000000A08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: LisectAVT_2403002A_191.exe, 00000000.00000002.3275714719.00000000009AC000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&0000
Source: MPGPH131.exe, 00000006.00000002.3274032651.00000000007AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: RageMP131.exe, 0000000A.00000002.3275957814.0000000000B32000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: scsi#disk&ven_vmware&proQ
Source: RageMP131.exe, 0000000A.00000003.2275959248.0000000000B32000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}.
Source: LisectAVT_2403002A_191.exe, 00000000.00000002.3275956463.0000000000E6F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 3c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_78BF175D
Source: RageMP131.exe, 00000008.00000002.3275956134.0000000000E9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_78BF175D
Source: MPGPH131.exe, 00000007.00000002.3274228386.0000000000A08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll>
Source: LisectAVT_2403002A_191.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: MPGPH131.exe, 00000007.00000002.3274228386.0000000000A08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}&Ph7
Source: MPGPH131.exe, 00000006.00000002.3274032651.000000000076D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: RageMP131.exe, 00000008.00000002.3275956134.0000000000E9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllC

Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe

Code function: 0_2_00169F50 LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,

0_2_00169F50

Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_00165B90 mov ecx, dword ptr fs:[00000030h]	0_2_00165B90
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_0016C0A0 mov eax, dword ptr fs:[00000030h]	0_2_0016C0A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_0016C0A0 mov eax, dword ptr fs:[00000030h]	0_2_0016C0A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_00164100 mov eax, dword ptr fs:[00000030h]	0_2_00164100
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_0016C0A0 mov eax, dword ptr fs:[00000030h]	0_2_0016C0A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_00165498 mov eax, dword ptr fs:[00000030h]	0_2_00165498
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_0016C0A0 mov eax, dword ptr fs:[00000030h]	0_2_0016C0A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001657B8 mov eax, dword ptr fs:[00000030h]	0_2_001657B8
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001648E0 mov eax, dword ptr fs:[00000030h]	0_2_001648E0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001648E0 mov eax, dword ptr fs:[00000030h]	0_2_001648E0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001648E0 mov eax, dword ptr fs:[00000030h]	0_2_001648E0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001648E0 mov eax, dword ptr fs:[00000030h]	0_2_001648E0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001648E0 mov eax, dword ptr fs:[00000030h]	0_2_001648E0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001648E0 mov eax, dword ptr fs:[00000030h]	0_2_001648E0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001648E0 mov eax, dword ptr fs:[00000030h]	0_2_001648E0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001648E0 mov eax, dword ptr fs:[00000030h]	0_2_001648E0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001648E0 mov eax, dword ptr fs:[00000030h]	0_2_001648E0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001648E0 mov eax, dword ptr fs:[00000030h]	0_2_001648E0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001648E0 mov eax, dword ptr fs:[00000030h]	0_2_001648E0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_001648E0 mov eax, dword ptr fs:[00000030h]	0_2_001648E0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_0016C0A0 mov eax, dword ptr fs:[00000030h]	0_2_0016C0A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Code function: 0_2_00164DC9 mov eax, dword ptr fs:[00000030h]	0_2_00164DC9
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00C948E0 mov eax, dword ptr fs:[00000030h]	6_2_00C948E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00C948E0 mov eax, dword ptr fs:[00000030h]	6_2_00C948E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00C948E0 mov eax, dword ptr fs:[00000030h]	6_2_00C948E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00C948E0 mov eax, dword ptr fs:[00000030h]	6_2_00C948E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00C948E0 mov eax, dword ptr fs:[00000030h]	6_2_00C948E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00C948E0 mov eax, dword ptr fs:[00000030h]	6_2_00C948E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00C948E0 mov eax, dword ptr fs:[00000030h]	6_2_00C948E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00C948E0 mov eax, dword ptr fs:[00000030h]	6_2_00C948E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00C948E0 mov eax, dword ptr fs:[00000030h]	6_2_00C948E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00C948E0 mov eax, dword ptr fs:[00000030h]	6_2_00C948E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00C948E0 mov eax, dword ptr fs:[00000030h]	6_2_00C948E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00C948E0 mov eax, dword ptr fs:[00000030h]	6_2_00C948E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00C9C0A0 mov eax, dword ptr fs:[00000030h]	6_2_00C9C0A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00C94100 mov eax, dword ptr fs:[00000030h]	6_2_00C94100
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00C9C0A0 mov eax, dword ptr fs:[00000030h]	6_2_00C9C0A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00C9C0A0 mov eax, dword ptr fs:[00000030h]	6_2_00C9C0A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00C9C0A0 mov eax, dword ptr fs:[00000030h]	6_2_00C9C0A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00C95498 mov eax, dword ptr fs:[00000030h]	6_2_00C95498
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00C94DC9 mov eax, dword ptr fs:[00000030h]	6_2_00C94DC9
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00C9C0A0 mov eax, dword ptr fs:[00000030h]	6_2_00C9C0A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00C957B8 mov eax, dword ptr fs:[00000030h]	6_2_00C957B8
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00C95B90 mov ecx, dword ptr fs:[00000030h]	7_2_00C95B90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00C9C0A0 mov eax, dword ptr fs:[00000030h]	7_2_00C9C0A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00C94100 mov eax, dword ptr fs:[00000030h]	7_2_00C94100
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00C9C0A0 mov eax, dword ptr fs:[00000030h]	7_2_00C9C0A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00C9C0A0 mov eax, dword ptr fs:[00000030h]	7_2_00C9C0A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00C95498 mov eax, dword ptr fs:[00000030h]	7_2_00C95498
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00C9C0A0 mov eax, dword ptr fs:[00000030h]	7_2_00C9C0A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00C957B8 mov eax, dword ptr fs:[00000030h]	7_2_00C957B8
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00C948E0 mov eax, dword ptr fs:[00000030h]	7_2_00C948E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00C948E0 mov eax, dword ptr fs:[00000030h]	7_2_00C948E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00C948E0 mov eax, dword ptr fs:[00000030h]	7_2_00C948E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00C948E0 mov eax, dword ptr fs:[00000030h]	7_2_00C948E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00C948E0 mov eax, dword ptr fs:[00000030h]	7_2_00C948E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00C948E0 mov eax, dword ptr fs:[00000030h]	7_2_00C948E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00C948E0 mov eax, dword ptr fs:[00000030h]	7_2_00C948E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00C948E0 mov eax, dword ptr fs:[00000030h]	7_2_00C948E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00C948E0 mov eax, dword ptr fs:[00000030h]	7_2_00C948E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00C948E0 mov eax, dword ptr fs:[00000030h]	7_2_00C948E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00C948E0 mov eax, dword ptr fs:[00000030h]	7_2_00C948E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00C948E0 mov eax, dword ptr fs:[00000030h]	7_2_00C948E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00C9C0A0 mov eax, dword ptr fs:[00000030h]	7_2_00C9C0A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00C94DC9 mov eax, dword ptr fs:[00000030h]	7_2_00C94DC9
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_005848E0 mov eax, dword ptr fs:[00000030h]	8_2_005848E0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_005848E0 mov eax, dword ptr fs:[00000030h]	8_2_005848E0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_005848E0 mov eax, dword ptr fs:[00000030h]	8_2_005848E0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_005848E0 mov eax, dword ptr fs:[00000030h]	8_2_005848E0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_005848E0 mov eax, dword ptr fs:[00000030h]	8_2_005848E0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_005848E0 mov eax, dword ptr fs:[00000030h]	8_2_005848E0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_005848E0 mov eax, dword ptr fs:[00000030h]	8_2_005848E0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_005848E0 mov eax, dword ptr fs:[00000030h]	8_2_005848E0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_005848E0 mov eax, dword ptr fs:[00000030h]	8_2_005848E0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_005848E0 mov eax, dword ptr fs:[00000030h]	8_2_005848E0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_005848E0 mov eax, dword ptr fs:[00000030h]	8_2_005848E0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_005848E0 mov eax, dword ptr fs:[00000030h]	8_2_005848E0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_0058C0A0 mov eax, dword ptr fs:[00000030h]	8_2_0058C0A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_0058C0A0 mov eax, dword ptr fs:[00000030h]	8_2_0058C0A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00584100 mov eax, dword ptr fs:[00000030h]	8_2_00584100
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_0058C0A0 mov eax, dword ptr fs:[00000030h]	8_2_0058C0A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_0058C0A0 mov eax, dword ptr fs:[00000030h]	8_2_0058C0A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00585498 mov eax, dword ptr fs:[00000030h]	8_2_00585498
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00584DC9 mov eax, dword ptr fs:[00000030h]	8_2_00584DC9
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_0058C0A0 mov eax, dword ptr fs:[00000030h]	8_2_0058C0A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_005857B8 mov eax, dword ptr fs:[00000030h]	8_2_005857B8

Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe

Code function: 0_2_00164400 cpuid

0_2_00164400

Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe

Code function: 0_2_0022F26A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_0022F26A

Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe

Code function: 0_2_00167DC0 GetUserNameA,GetFileAttributesA,__Mtx_unlock,__Mtx_unlock,CopyFileA,RegOpenKeyExA,RegSetValueExA,GetFileAttributesA,__Mtx_unlock,__Mtx_unlock,CopyFileA,

0_2_00167DC0

Source: C:\Users\user\Desktop\LisectAVT_2403002A_191.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected RisePro Stealer

Source: Yara match	File source: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2062288442.0000000004820000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2182605884.0000000004820000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3274056165.0000000000571000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2061020285.0000000004640000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2264006131.0000000004450000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2033248421.0000000004720000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_191.exe PID: 2696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 3448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 1876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 2408, type: MEMORYSTR

Remote Access Functionality

Yara detected RisePro Stealer

Source: Yara match	File source: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2062288442.0000000004820000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2182605884.0000000004820000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3274056165.0000000000571000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2061020285.0000000004640000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2264006131.0000000004450000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2033248421.0000000004720000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_191.exe PID: 2696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 3448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 1876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 2408, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	2 Virtualization/Sandbox Evasion	LSASS Memory	311 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 Process Injection	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	233 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
LisectAVT_2403002A_191.exe	100%	Avira	TR/AD.Nekark.cxjdy

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	100%	Avira	TR/AD.Nekark.cxjdy
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Avira	TR/AD.Nekark.cxjdy

Source	Detection	Scanner	Label
http://www.winimage.com/zLibDll	0%	URL Reputation	safe
https://ipinfo.io/	0%	URL Reputation	safe
https://t.me/RiseProSUPPORT	0%	Avira URL Cloud	safe
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	0%	Avira URL Cloud	safe
https://www.maxmind.com/en/locate-my-ip-address	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	LisectAVT_2403002A_191.exe, 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, LisectAVT_2403002A_191.exe, 00000000.00000003.2033248421.0000000004720000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2061020285.0000000004640000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000007.00000003.2062288442.0000000004820000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000008.00000003.2182605884.0000000004820000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000A.00000002.3274056165.0000000000571000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000A.00000003.2264006131.0000000004450000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDll	MPGPH131.exe, MPGPH131.exe, 00000007.00000003.2062288442.0000000004820000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000008.00000003.2182605884.0000000004820000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000A.00000002.3274056165.0000000000571000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000A.00000003.2264006131.0000000004450000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://t.me/RiseProSUPPORT	LisectAVT_2403002A_191.exe, 00000000.00000002.3275956463.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3274032651.000000000076D000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3274228386.0000000000A08000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3275956134.0000000000E9E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.3275957814.0000000000B0C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/	MPGPH131.exe, RageMP131.exe	false	URL Reputation: safe	unknown
https://www.maxmind.com/en/locate-my-ip-address	MPGPH131.exe, RageMP131.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.233.132.62	unknown	Russian Federation		2895	FREE-NET-ASFREEnetEU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1482443
Start date and time:	2024-07-25 23:02:46 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LisectAVT_2403002A_191.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@11/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: LisectAVT_2403002A_191.exe

Simulations

Behavior and APIs

Time	Type	Description
17:04:05	API Interceptor	2288555x Sleep call for process: LisectAVT_2403002A_191.exe modified
17:04:08	API Interceptor	4773x Sleep call for process: MPGPH131.exe modified
17:04:20	API Interceptor	1790028x Sleep call for process: RageMP131.exe modified
23:03:37	Task Scheduler	Run new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
23:03:37	Task Scheduler	Run new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
23:03:41	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
23:03:49	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.233.132.62	SecuriteInfo.com.Win32.PWSX-gen.14899.4987.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	193.233.132.62:57893/hera/amadka.exe
	SecuriteInfo.com.Win32.PWSX-gen.580.27252.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	193.233.132.62:57893/hera/amadka.exe
	SecuriteInfo.com.Win32.PWSX-gen.15960.19323.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	193.233.132.62:57893/hera/amadka.exe
	9iz0QM9rMM.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	193.233.132.62:57893/hera/amadka.exe
	4fMLTRkOfB.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	193.233.132.62:57893/hera/amadka.exe
	q7a5JOlhLZ.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	193.233.132.62:57893/hera/amadka.exe
	7jv1U7CgKF.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	193.233.132.62:57893/hera/amadka.exe
	file.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	193.233.132.62:57893/hera/amadka.exe
	SecuriteInfo.com.Win32.PWSX-gen.10022.32492.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	193.233.132.62:57893/hera/amadka.exe
	file.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	193.233.132.62:57893/hera/amadka.exe

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FREE-NET-ASFREEnetEU	LisectAVT_2403002A_218.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.74
	LisectAVT_2403002A_228.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.74
	LisectAVT_2403002A_30.exe	Get hash	malicious	Amadey	Browse	193.233.132.56
	LisectAVT_2403002A_33.exe	Get hash	malicious	Amadey	Browse	193.233.132.56
	LisectAVT_2403002A_376.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.74
	LisectAVT_2403002A_389.exe	Get hash	malicious	Amadey	Browse	193.233.132.56
	LisectAVT_2403002A_419.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.67
	LisectAVT_2403002A_419.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.67
	LisectAVT_2403002A_464.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.109
	LisectAVT_2403002A_464.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.109

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_191.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3159050
Entropy (8bit):	6.660609566905349
Encrypted:	false
SSDEEP:	49152:cCq+iwUDIvKCdNlxk6FXA773bojmr2qjZfWP+cxNgK:c3kyCjXk6FXA3304jYpx
MD5:	96A48D844EA7BAAE454FE84845E1E581
SHA1:	77F0819007790EEF6ECD0EC1BE0E49669132AD3D
SHA-256:	DD43FBAAA8A894E08AA200E56C01DEA30C346356440C4373082F25F7BE4C3154
SHA-512:	386E0B8DEEDDD1F66ABA2511D3AE62097B37A4E1703595F5107619FCC75985EC30A896BB6B003331086A032A7DA27FC695985A504E2677C47BB788E3B6B0A94E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$......."...f.{Tf.{Tf.{T-.xUk.{T-.~U..{T-.\|Ug.{T)..Tb.{T)..Ut.{T).xUq.{T).~U3.{T-..U..{T-.}Ug.{T-.zU}.{Tf.zT@.{T..rUz.{T..{Ug.{T...Tg.{Tf..Tg.{T..yUg.{TRichf.{T................PE..L....b.e...............".....0........:...........@...........................:.....$.0...@.........................l.:.L...m...........X+.......................................................................................................... . .p..........................@....rsrc...X+.......,..................@....idata .............B..............@...wnjuhnsz..&.......&..D..............@...unhxerdt......:.......0.............@....taggant.0....:.."....0.............@...........................................................................................................................................................................................................................

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_191.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_191.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3159050
Entropy (8bit):	6.660609566905349
Encrypted:	false
SSDEEP:	49152:cCq+iwUDIvKCdNlxk6FXA773bojmr2qjZfWP+cxNgK:c3kyCjXk6FXA3304jYpx
MD5:	96A48D844EA7BAAE454FE84845E1E581
SHA1:	77F0819007790EEF6ECD0EC1BE0E49669132AD3D
SHA-256:	DD43FBAAA8A894E08AA200E56C01DEA30C346356440C4373082F25F7BE4C3154
SHA-512:	386E0B8DEEDDD1F66ABA2511D3AE62097B37A4E1703595F5107619FCC75985EC30A896BB6B003331086A032A7DA27FC695985A504E2677C47BB788E3B6B0A94E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$......."...f.{Tf.{Tf.{T-.xUk.{T-.~U..{T-.\|Ug.{T)..Tb.{T)..Ut.{T).xUq.{T).~U3.{T-..U..{T-.}Ug.{T-.zU}.{Tf.zT@.{T..rUz.{T..{Ug.{T...Tg.{Tf..Tg.{T..yUg.{TRichf.{T................PE..L....b.e...............".....0........:...........@...........................:.....$.0...@.........................l.:.L...m...........X+.......................................................................................................... . .p..........................@....rsrc...X+.......,..................@....idata .............B..............@...wnjuhnsz..&.......&..D..............@...unhxerdt......:.......0.............@....taggant.0....:.."....0.............@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_191.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_191.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	13
Entropy (8bit):	2.8731406795131336
Encrypted:	false
SSDEEP:	3:LEjGQ:qH
MD5:	6794D6F401187368B9107C6CBBFF2249
SHA1:	20F399AFFEF237E4E91E746018168D08C10C6401
SHA-256:	0D84C2CDE76B80BF231C58D25614898CA0002012EA001D6B4204C88B8CE7F3C5
SHA-512:	9CEA1EED41A1B1B403B0837FCE258ECB572207DB42041031739D90E52E59BB8F2450C45CD427C640B249F6C0C8F30B8313D35E888AE7E2CA3341C2B5D29B2BDD
Malicious:	false
Reputation:	low
Preview:	1721945193265

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.660609566905349
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	LisectAVT_2403002A_191.exe
File size:	3'159'050 bytes
MD5:	96a48d844ea7baae454fe84845e1e581
SHA1:	77f0819007790eef6ecd0ec1be0e49669132ad3d
SHA256:	dd43fbaaa8a894e08aa200e56c01dea30c346356440c4373082f25f7be4c3154
SHA512:	386e0b8deeddd1f66aba2511d3ae62097b37a4e1703595f5107619fcc75985ec30a896bb6b003331086a032a7da27fc695985a504e2677c47bb788e3b6b0a94e
SSDEEP:	49152:cCq+iwUDIvKCdNlxk6FXA773bojmr2qjZfWP+cxNgK:c3kyCjXk6FXA3304jYpx
TLSH:	D7E55A91A90CB2CFD48A277C952BCD52595D43B8572019C79E2E78BA7DB3CC112BEC28
File Content Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$......."...f.{Tf.{Tf.{T-.xUk.{T-.~U..{T-.\|Ug.{T)..Tb.{T)..Ut.{T).xUq.{T).~U3.{T-..U..{T-.}Ug.{T-.zU}.{Tf.zT@.{T..rUz.{T..{Ug.{T...Tg.{

File Icon


Icon Hash:	c769eccc64f6e2bb

Static PE Info

General

Entrypoint:	0x7aa000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x65FD62AE [Fri Mar 22 10:51:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	baa93d47220682c04d92f7797d9224ce

Entrypoint Preview

Instruction
jmp 00007F57B87B706Ah
movlps xmm6, qword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], bl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x3a8a6c	0x4c	wnjuhnsz
IMAGE_DIRECTORY_ENTRY_IMPORT	0x13b06d	0x95	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x138000	0x2b58	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x13b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x137000	0x90600	680f70ec36b50494e59d99899763ca27	False	0.9990733225108225	data	7.984907273726197	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x138000	0x2b58	0x2c00	b606861556e06d174e42b11831f5e5db	False	0.22487571022727273	data	3.9665421773066165	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x13b000	0x1000	0x200	37f5282c0fa356b1e50be5becbf91e72	False	0.181640625	data	1.3087225765280863	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
wnjuhnsz	0x13c000	0x26d000	0x26cc00	1caad884f8d3adccaefc823da1665b91	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
unhxerdt	0x3a9000	0x1000	0x200	ec77134026abc595ad2a3aff08893bbf	False	0.484375	data	3.8006430756371983	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x3aa000	0x3000	0x2200	5b6b5243b69d9baf5593d1f0406b403b	False	0.06950827205882353	DOS executable (COM)	0.7178443537062317	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x138418	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Russian	Russia	0.1892116182572614
RT_GROUP_ICON	0x13a9c0	0x14	data	Russian	Russia	1.15
RT_VERSION	0x138130	0x2e4	data	Russian	Russia	0.4689189189189189
RT_MANIFEST	0x13a9d8	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy
comctl32.dll	InitCommonControls

Exports

Name	Ordinal	Address
Start	1	0x466e80

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-25T23:03:41.523769+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49704	58709	192.168.2.5	193.233.132.62
2024-07-25T23:03:57.680324+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49707	58709	192.168.2.5	193.233.132.62
2024-07-25T23:03:56.303473+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49708	20.12.23.50	192.168.2.5
2024-07-25T23:04:04.199047+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	62193	58709	192.168.2.5	193.233.132.62
2024-07-25T23:03:43.977143+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49706	58709	192.168.2.5	193.233.132.62
2024-07-25T23:04:36.902166+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	62194	20.12.23.50	192.168.2.5
2024-07-25T23:03:38.545862+0200	TCP	2049060	ET MALWARE RisePro TCP Heartbeat Packet	49704	58709	192.168.2.5	193.233.132.62
2024-07-25T23:03:43.886481+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49705	58709	192.168.2.5	193.233.132.62
2024-07-25T23:03:40.905756+0200	TCP	2049060	ET MALWARE RisePro TCP Heartbeat Packet	49705	58709	192.168.2.5	193.233.132.62

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 23:03:38.533134937 CEST	49704	58709	192.168.2.5	193.233.132.62
Jul 25, 2024 23:03:38.538742065 CEST	58709	49704	193.233.132.62	192.168.2.5
Jul 25, 2024 23:03:38.538855076 CEST	49704	58709	192.168.2.5	193.233.132.62
Jul 25, 2024 23:03:38.545861959 CEST	49704	58709	192.168.2.5	193.233.132.62
Jul 25, 2024 23:03:38.550720930 CEST	58709	49704	193.233.132.62	192.168.2.5
Jul 25, 2024 23:03:40.892617941 CEST	49705	58709	192.168.2.5	193.233.132.62
Jul 25, 2024 23:03:40.897387028 CEST	58709	49705	193.233.132.62	192.168.2.5
Jul 25, 2024 23:03:40.897532940 CEST	49705	58709	192.168.2.5	193.233.132.62
Jul 25, 2024 23:03:40.905755997 CEST	49705	58709	192.168.2.5	193.233.132.62
Jul 25, 2024 23:03:40.910553932 CEST	58709	49705	193.233.132.62	192.168.2.5
Jul 25, 2024 23:03:40.987210989 CEST	49706	58709	192.168.2.5	193.233.132.62
Jul 25, 2024 23:03:40.992033958 CEST	58709	49706	193.233.132.62	192.168.2.5
Jul 25, 2024 23:03:40.992141008 CEST	49706	58709	192.168.2.5	193.233.132.62
Jul 25, 2024 23:03:40.999912024 CEST	49706	58709	192.168.2.5	193.233.132.62
Jul 25, 2024 23:03:41.004807949 CEST	58709	49706	193.233.132.62	192.168.2.5
Jul 25, 2024 23:03:41.523768902 CEST	49704	58709	192.168.2.5	193.233.132.62
Jul 25, 2024 23:03:41.528976917 CEST	58709	49704	193.233.132.62	192.168.2.5
Jul 25, 2024 23:03:43.886481047 CEST	49705	58709	192.168.2.5	193.233.132.62
Jul 25, 2024 23:03:43.977143049 CEST	49706	58709	192.168.2.5	193.233.132.62
Jul 25, 2024 23:03:44.031444073 CEST	58709	49705	193.233.132.62	192.168.2.5
Jul 25, 2024 23:03:44.031873941 CEST	58709	49706	193.233.132.62	192.168.2.5
Jul 25, 2024 23:03:54.668327093 CEST	49707	58709	192.168.2.5	193.233.132.62
Jul 25, 2024 23:03:54.673356056 CEST	58709	49707	193.233.132.62	192.168.2.5
Jul 25, 2024 23:03:54.673453093 CEST	49707	58709	192.168.2.5	193.233.132.62
Jul 25, 2024 23:03:54.686794996 CEST	49707	58709	192.168.2.5	193.233.132.62
Jul 25, 2024 23:03:54.691967964 CEST	58709	49707	193.233.132.62	192.168.2.5
Jul 25, 2024 23:03:57.680324078 CEST	49707	58709	192.168.2.5	193.233.132.62
Jul 25, 2024 23:03:57.685266972 CEST	58709	49707	193.233.132.62	192.168.2.5
Jul 25, 2024 23:03:59.935286045 CEST	58709	49704	193.233.132.62	192.168.2.5
Jul 25, 2024 23:03:59.935421944 CEST	49704	58709	192.168.2.5	193.233.132.62
Jul 25, 2024 23:04:01.179078102 CEST	62193	58709	192.168.2.5	193.233.132.62
Jul 25, 2024 23:04:01.184530973 CEST	58709	62193	193.233.132.62	192.168.2.5
Jul 25, 2024 23:04:01.184637070 CEST	62193	58709	192.168.2.5	193.233.132.62
Jul 25, 2024 23:04:01.200978994 CEST	62193	58709	192.168.2.5	193.233.132.62
Jul 25, 2024 23:04:01.209337950 CEST	58709	62193	193.233.132.62	192.168.2.5
Jul 25, 2024 23:04:02.258812904 CEST	58709	49705	193.233.132.62	192.168.2.5
Jul 25, 2024 23:04:02.260868073 CEST	49705	58709	192.168.2.5	193.233.132.62
Jul 25, 2024 23:04:02.372454882 CEST	58709	49706	193.233.132.62	192.168.2.5
Jul 25, 2024 23:04:02.372580051 CEST	49706	58709	192.168.2.5	193.233.132.62
Jul 25, 2024 23:04:04.199047089 CEST	62193	58709	192.168.2.5	193.233.132.62
Jul 25, 2024 23:04:04.204018116 CEST	58709	62193	193.233.132.62	192.168.2.5
Jul 25, 2024 23:04:16.081759930 CEST	58709	49707	193.233.132.62	192.168.2.5
Jul 25, 2024 23:04:16.081835985 CEST	49707	58709	192.168.2.5	193.233.132.62
Jul 25, 2024 23:04:22.571975946 CEST	58709	62193	193.233.132.62	192.168.2.5
Jul 25, 2024 23:04:22.572083950 CEST	62193	58709	192.168.2.5	193.233.132.62

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 23:03:59.310553074 CEST	53	55854	1.1.1.1	192.168.2.5

Target ID:	0
Start time:	17:03:35
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\LisectAVT_2403002A_191.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LisectAVT_2403002A_191.exe"
Imagebase:	0x150000
File size:	3'159'050 bytes
MD5 hash:	96A48D844EA7BAAE454FE84845E1E581
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000003.2033248421.0000000004720000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	17:03:37
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0x60000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:03:37
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:03:37
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0x60000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:03:37
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:03:37
Start date:	25/07/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0xc80000
File size:	3'159'050 bytes
MD5 hash:	96A48D844EA7BAAE454FE84845E1E581
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000006.00000003.2061020285.0000000004640000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	17:03:37
Start date:	25/07/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0xc80000
File size:	3'159'050 bytes
MD5 hash:	96A48D844EA7BAAE454FE84845E1E581
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000003.2062288442.0000000004820000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	17:03:49
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x570000
File size:	3'159'050 bytes
MD5 hash:	96A48D844EA7BAAE454FE84845E1E581
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000008.00000003.2182605884.0000000004820000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	17:03:58
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x570000
File size:	3'159'050 bytes
MD5 hash:	96A48D844EA7BAAE454FE84845E1E581
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000000A.00000002.3274056165.0000000000571000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000000A.00000003.2264006131.0000000004450000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	37.8%
Total number of Nodes:	844
Total number of Limit Nodes:	96

Executed Functions

Function 00167DC0 Relevance: 61.8, APIs: 11, Strings: 23, Instructions: 2344registryfileCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,00000104,?,?,?), ref: 00168006
GetFileAttributesA.KERNELBASE(?,00000001,?,?,?,?), ref: 0016815D
__Mtx_unlock.LIBCPMT ref: 00168186
__Mtx_unlock.LIBCPMT ref: 00168195
CopyFileA.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,0000005D), ref: 00168442
RegOpenKeyExA.KERNELBASE(80000001,83909AA7,00000000,00020006,00000000), ref: 00168500
RegSetValueExA.KERNELBASE(00000000,?,00000000,00000001,?,?), ref: 00168537
GetFileAttributesA.KERNELBASE(?,00000001,?,?,?,?,?,?), ref: 00168751
__Mtx_unlock.LIBCPMT ref: 0016877A

Part of subcall function 001C06C0: Concurrency::cancel_current_task.LIBCPMT ref: 001C0807

__Mtx_unlock.LIBCPMT ref: 001687D7
CopyFileA.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00168AF9

Strings

\, xrefs: 00168896
rnql, xrefs: 0016846F
., xrefs: 00169355
'[_+., xrefs: 001697B9, 001697E9
e`vf, xrefs: 00168C28
+, xrefs: 00169B19
+wj', xrefs: 00168B30
OFMM, xrefs: 00169226
(ACL, xrefs: 0016923A
e`vf, xrefs: 00169337
DH][, xrefs: 00169244
$*tk, xrefs: 00169230
ec`v, xrefs: 00168497
{~RL, xrefs: 0016848D
$*`', xrefs: 00168C32
RM[#, xrefs: 00168B26
I^Z, xrefs: 001698C4, 001698F4
@@MC, xrefs: 00168B3A
$*`', xrefs: 00169341
131, xrefs: 00167E37, 00167E3E, 00167E44, 00167EB2, 00167EB9, 00167EBF, 00167F2A, 00167F31, 00167F37, 00169A45, 00169A4C, 00169A52
bqZP, xrefs: 00168479
agnd, xrefs: 00168483
'[_+, xrefs: 0016934B

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: FileMtx_unlock$AttributesCopy$Concurrency::cancel_current_taskNameOpenUserValue
String ID: $*`'$$*`'$$*tk$'[_+$'[_+.$(ACL$+$+wj'$.$131$@@MC$DH][$I^Z$OFMM$RM[#$\$agnd$bqZP$e`vf$e`vf$ec`v$rnql${~RL
API String ID: 816876003-939402308
Opcode ID: ee6c1e80e595a4afc3e54e326542825933d1a38f93a603feb971dd43360293de
Instruction ID: 274d58b1414f90afee34747ab6c6f423403c766815d596adabdb0d355324fd9a
Opcode Fuzzy Hash: ee6c1e80e595a4afc3e54e326542825933d1a38f93a603feb971dd43360293de
Instruction Fuzzy Hash: 6E238E70D002599FDB28CF68CC94BEEBBB5AF05304F1482EDD419AB282E7719A95CF51

Function 00165B90 Relevance: 56.7, APIs: 5, Strings: 26, Instructions: 2429processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,?,?,?,?), ref: 00165CBF

Strings

(ACL, xrefs: 00167431
I^Z, xrefs: 00167AFE, 00167B2E
'[_+, xrefs: 0016752B
rnql, xrefs: 00166642
'[_+, xrefs: 00166E1B
*, xrefs: 00167A17
bqZP, xrefs: 0016664C
s@, xrefs: 00165C1A
131, xrefs: 00166037, 0016603E, 00166044, 001660BA, 001660C1, 001660C7, 0016613A, 00166141, 00166147
., xrefs: 00166E25
$*`', xrefs: 00167521
\, xrefs: 001669E5
RM[#, xrefs: 00166CFA
., xrefs: 00167535
@@MC, xrefs: 00166D0E
D, xrefs: 00165BCD
{~RL, xrefs: 0016665A
ec`v, xrefs: 00166661
OFMM, xrefs: 00167423
+wj', xrefs: 00166D04
$*tk, xrefs: 0016742A
DH][, xrefs: 00167438
e`vf, xrefs: 00167517
agnd, xrefs: 00166653
$*`', xrefs: 00166E11
e`vf, xrefs: 00166E07

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: $*`'$$*`'$$*tk$'[_+$'[_+$(ACL$*$+wj'$.$.$131$@@MC$D$DH][$I^Z$OFMM$RM[#$\$agnd$bqZP$e`vf$e`vf$ec`v$rnql$s@${~RL
API String ID: 963392458-2482556880
Opcode ID: 6b5086e18f67452b56dded760336a7a574710db14a029cb107653943f2047021
Instruction ID: 38715173464d76e32ee256300a92c88d798d2d4294882f6ee55d9cb2c53b8d2d
Opcode Fuzzy Hash: 6b5086e18f67452b56dded760336a7a574710db14a029cb107653943f2047021
Instruction Fuzzy Hash: 2A237D709042589FDB28CF68CC94BEEBBB5BF09304F1441EDD449AB282E7719A95CF91

Function 0015B6A0 Relevance: 21.8, APIs: 4, Strings: 8, Instructions: 840
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,A3B0BAA7,00000000,00020019,00000000,999D9BA1,999D9BA2), ref: 0015B947

Strings

_, xrefs: 0015BB32
_, xrefs: 0015BAC6
`yk, xrefs: 0015BEE0, 0015BF0A
bqZD, xrefs: 0015B905
:, xrefs: 0015B443
_, xrefs: 0015BB25
cj|n, xrefs: 0015B913
rnql, xrefs: 0015B8FE

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: Open
String ID: :$_$_$_$`yk$bqZD$cj|n$rnql
API String ID: 71445658-3798079816
Opcode ID: 28fae63e9fd5e9bee6eb45a7d880bb48bcb52e09aae219b2855d0e8d7ce77e9d
Instruction ID: 9137141c0254eb69cbbae805ff4cf1aa5c0c98d550b8c50d0f834c6f566252c1
Opcode Fuzzy Hash: 28fae63e9fd5e9bee6eb45a7d880bb48bcb52e09aae219b2855d0e8d7ce77e9d
Instruction Fuzzy Hash: EF72C171D04258DFDB18CF68CC94BEEBBB5EF05304F1481A9E419AB282D7719A89CF90

Function 00168C58 Relevance: 16.1, Strings: 12, Instructions: 1132COMMON

Download Yara Rule

Strings

., xrefs: 00169355
'[_+., xrefs: 001697B9, 001697E9
I^Z, xrefs: 001698C4, 001698F4
+, xrefs: 00169B19
$*`', xrefs: 00169341
131, xrefs: 00169A45, 00169A4C, 00169A52
OFMM, xrefs: 00169226
(ACL, xrefs: 0016923A
e`vf, xrefs: 00169337
DH][, xrefs: 00169244
$*tk, xrefs: 00169230
'[_+, xrefs: 0016934B

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID: $*`'$$*tk$'[_+$'[_+.$(ACL$+$.$131$DH][$I^Z$OFMM$e`vf
API String ID: 0-1209388747
Opcode ID: cc435c68bd84bbb6ba14eaf6b3afeb53ffd1a8b83c79fa98e4e958201a406a41
Instruction ID: 5c5ab4a90e2e7fe4f624bf7ccf539da960edbff313b3e222a0937e9473a248e6
Opcode Fuzzy Hash: cc435c68bd84bbb6ba14eaf6b3afeb53ffd1a8b83c79fa98e4e958201a406a41
Instruction Fuzzy Hash: 70B27D709002598FDB28CF68CD987EDBBB5AF09304F1482EDD409AB782D7759A95CF90

Function 00169259 Relevance: 10.8, Strings: 8, Instructions: 787COMMON

Download Yara Rule

Strings

., xrefs: 00169355
'[_+., xrefs: 001697B9, 001697E9
I^Z, xrefs: 001698C4, 001698F4
+, xrefs: 00169B19
$*`', xrefs: 00169341
131, xrefs: 00169A45, 00169A4C, 00169A52
e`vf, xrefs: 00169337
'[_+, xrefs: 0016934B

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID: $*`'$'[_+$'[_+.$+$.$131$I^Z$e`vf
API String ID: 0-728311852
Opcode ID: 3eff37bf234a88ddd1eff68da2341dbc572989b4a9446f2cbea68f77888b332c
Instruction ID: 85dfc151f6de3812c2fc316faf21c2e270670fe13a0c527df4040196064529df
Opcode Fuzzy Hash: 3eff37bf234a88ddd1eff68da2341dbc572989b4a9446f2cbea68f77888b332c
Instruction Fuzzy Hash: 6F72AE709002588FDB18CF68DD98BEDBBB5AF45300F2482EDD019AB792D7349A95CF50

Function 0016E0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 0016E0CB
socket.WS2_32(?,?,?,?,?,?,00287320,?,?,?,?,?,?), ref: 0016E17F
connect.WS2_32(00000000,?,00000000,?,?,?,00287320,?,?,?,?,?,?), ref: 0016E193
closesocket.WS2_32(00000000), ref: 0016E19E

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: 4c75ac212ce97357e7c98078e86df2c37009bddafb53578411585979f815ff17
Instruction ID: 2997fd772c75da8a057923aa11382d3f3c7bff71278f943cf85c8c1d3586b7b8
Opcode Fuzzy Hash: 4c75ac212ce97357e7c98078e86df2c37009bddafb53578411585979f815ff17
Instruction Fuzzy Hash: 5031C175605301AFDB209F258C89B2BB7E4EB86734F015F1DF9A8972E0D33198189B92

Function 001CA520 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 234
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 001CA656

Strings

unexpected , xrefs: 001CA531
pected , xrefs: 001CA564

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: pected $unexpected
API String ID: 118556049-356062554
Opcode ID: 0e3f9443d5f46b16e1f34f53387d515e59a8d1ad700989359f8fd67a5b5501e7
Instruction ID: 3e84e632f30cd0e484ea2416581350ba76caff15530bc389d85880ae96755ce1
Opcode Fuzzy Hash: 0e3f9443d5f46b16e1f34f53387d515e59a8d1ad700989359f8fd67a5b5501e7
Instruction Fuzzy Hash: 115178725001149FD719EF28EC81B6EB7A5EF54304FA4426DF802CB645DB30ED518BD1

Function 0015A690 Relevance: 4.6, APIs: 3, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE ref: 0015A6BF
__Mtx_unlock.LIBCPMT ref: 0015A6EE
__Mtx_unlock.LIBCPMT ref: 0015A733

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$AttributesFile
String ID:
API String ID: 1886074773-0
Opcode ID: 56623f54fcf71438c4adbd401a2daaf74b7be9b25d099c98412ed60230b0491a
Instruction ID: 4eae987037ffc0b024cf9b0696cc5fb7e490a31218bc3bb6fbc424d3369ea6fb
Opcode Fuzzy Hash: 56623f54fcf71438c4adbd401a2daaf74b7be9b25d099c98412ed60230b0491a
Instruction Fuzzy Hash: 83016691AE51207A8C3431743C564BB65088C1332A7AD0B22FD75CE256F703DC28A6D3

Function 0015A090 Relevance: 3.3, APIs: 2, Instructions: 342
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 0015A1B6
__fread_nolock.LIBCMT ref: 0015A343

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 24c507cb5ce57e1ba12f096c1645ded9ee734cfdb333e40d78e99a1ad0f2b34d
Instruction ID: 247f9a553da6882b64247c8fb9b7ebdae2585617a5b5c01da726145aec099249
Opcode Fuzzy Hash: 24c507cb5ce57e1ba12f096c1645ded9ee734cfdb333e40d78e99a1ad0f2b34d
Instruction Fuzzy Hash: 4CB126B0910204EFDB18DF68CC45BAEBBE8EF41704F50866DF8199F682D7B49945CB92

Function 00244623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c900ffc51cd28a70b4fd4abea1118d63c124d67ece04b05c7c8e53c3c997a17
Instruction ID: 2cc9b8bbd9fbec88045bf61815f2a093168976042f37cae6e393a5338b2ac24b
Opcode Fuzzy Hash: 0c900ffc51cd28a70b4fd4abea1118d63c124d67ece04b05c7c8e53c3c997a17
Instruction Fuzzy Hash: C1B11874E24246AFDB19EFA8E844BAEBBB5AF45304F144159E844AB282C770DD61CF50

Function 0024549C Relevance: 1.7, APIs: 1, Instructions: 198
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000000,00239087,?,00000000,00000000,00000000,?,00000000,?,0022E5B1,00239087,00000000,0022E5B1,?,?), ref: 00245622

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: ff83b6f6a64a69dc74f4f79807fa6fe4e1e93a983a5e4bd566eeccf2771ab997
Instruction ID: 63bf414471c20d4ca58cf0e11037281e41f848f3054f16dc591b6f9fdf2b8534
Opcode Fuzzy Hash: ff83b6f6a64a69dc74f4f79807fa6fe4e1e93a983a5e4bd566eeccf2771ab997
Instruction Fuzzy Hash: AE61C671D2452AAFDF19DFA8C844EFEBBBAEF09304F550145E844A7246D371D921CBA0

Function 00234942 Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f639f0507ac4914966abf53ff329dcc99e50620f119ba91d0c0d26ec52794bfd
Instruction ID: 6b79af861b1b7702bfcdc34e5a1aae092a8c6f9270c835592cef5a1bb2f78b95
Opcode Fuzzy Hash: f639f0507ac4914966abf53ff329dcc99e50620f119ba91d0c0d26ec52794bfd
Instruction Fuzzy Hash: BC51F8B0A10108AFDF14EF58CC55AAABFB1EF45314F248199F8499B352D371EE61CB90

Function 001C0560 Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 001C06AE

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: af6713065366bd82e79030144ac7431e9b0eb4b0f2d5a994d3e08bb69875dc56
Instruction ID: 7416f9cda4d79f6f98a450abbf74aaa8061eace76bde9728d490e4bcfb72402e
Opcode Fuzzy Hash: af6713065366bd82e79030144ac7431e9b0eb4b0f2d5a994d3e08bb69875dc56
Instruction Fuzzy Hash: CC41E772A00124DBCB16DF68DD80A6E7BA5AF99350F15026DFC05DB341D730DD619BE1

Function 00244B12 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,002449F9,00000000,CF830579,00281140,0000000C,00244AB5,00238BBD,?), ref: 00244B69

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 3d8981baedd9976a097bb0c280cabdd524f639cd14b5df7332e3ceb727a115ca
Instruction ID: ec84823d04b65fa8c1b156cb1355f5784935bf908bc09738b799629363de61d2
Opcode Fuzzy Hash: 3d8981baedd9976a097bb0c280cabdd524f639cd14b5df7332e3ceb727a115ca
Instruction Fuzzy Hash: A3116B33F7412516CB2D7A356849BBE674DCB8277CF2A0609FC049F0C2EE61D8615245

Function 0023E05C Relevance: 1.6, APIs: 1, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00280DF8,0022E5B1,00000002,0022E5B1,00000000,?,?,?,0023E166,00000000,?,0022E5B1,00000002,00280DF8), ref: 0023E099

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 4005833f9e3455eda50963c67b6e3da2973c6e197b7ff9b1177793ca8b661abf
Instruction ID: 25972368966fbf4f2f107a78e089bbb7847e61d398a971be95eaae3a20818a59
Opcode Fuzzy Hash: 4005833f9e3455eda50963c67b6e3da2973c6e197b7ff9b1177793ca8b661abf
Instruction Fuzzy Hash: CA01267222411AABCF09CF19DC05D9F3B29DB85334F250248FC50AB1D1E6B2E9618BD0

Function 0022F290 Relevance: 1.6, APIs: 1, Instructions: 51
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0015220E

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: a16a0b60457cde5b7dbdbf4842bcaa9b738185594595c9e96495054b6de03d1d
Instruction ID: e91ce039f0f182e76b71a757d55849c176f562a1e839d7907e5ccc788f1168b2
Opcode Fuzzy Hash: a16a0b60457cde5b7dbdbf4842bcaa9b738185594595c9e96495054b6de03d1d
Instruction Fuzzy Hash: 30012B7652030DFBCB14AFA8F84295A77AC9A01320F508535FE18DB591E770E9748B94

Function 002463F3 Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,0022D6FA,00000004,?,00245D79,00000001,00000364,00000004,00000007,000000FF,?,0023067B,00000002,00000000,?,?), ref: 00246435

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9ca49e0b5c3324890463958f9e00f95d4394e967fa3496e0ff3528a61d8fbacd
Instruction ID: 4bb94d097a241c5fd248eda6a72f0a8cb2ca432687aff3d5300905d4f6bf4c34
Opcode Fuzzy Hash: 9ca49e0b5c3324890463958f9e00f95d4394e967fa3496e0ff3528a61d8fbacd
Instruction Fuzzy Hash: 12F08931575125669F396F629C0EB5B7B499F837A4F258011EC04AA581CB70D83146F3

Function 00246E2D Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000004,00000000,?,0023067B,00000002,00000000,?,?,?,0015303D,0022D6FA,00000004,00000000,0022D6FA), ref: 00246E60

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: af15f71a298d451be548b0025c99a7f475f3bede0e9bc38d4618d472d80f2a1c
Instruction ID: a2ccf6ede60a8c696ae244536fb63346b8b20bd3a6c9e7c0c8de8782395b08c9
Opcode Fuzzy Hash: af15f71a298d451be548b0025c99a7f475f3bede0e9bc38d4618d472d80f2a1c
Instruction Fuzzy Hash: 84E0ED39371622AAEB382AA5DD08F6B76C88F83BA0F550120EC04964D2CB60C83085A6

Non-executed Functions

Function 001648E0 Relevance: 146.4, APIs: 4, Strings: 79, Instructions: 1131registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(?,A3B0BAA7,00000000,00000000,00000000,00020006,00000000,?,00000000), ref: 00164A3A

Strings

v`, xrefs: 00164DC0
{be7, xrefs: 00164BA2
{, xrefs: 00164A78
GGYw, xrefs: 00164BD4
Gx|w, xrefs: 00164FE8
ibkf, xrefs: 00165157
inpN, xrefs: 0016524A
wYKn, xrefs: 00165161
mLdj, xrefs: 0016547B
rnvf, xrefs: 00165687
^BZJ, xrefs: 001651C5
g{ce, xrefs: 0016525E
k{ex, xrefs: 00164B84
\||~, xrefs: 00164BAC
|sGB, xrefs: 001651A7
ckzS, xrefs: 00164FDE
k{ex, xrefs: 00164FD4
Gx|w, xrefs: 00164B98
\||~, xrefs: 00164D48
ry{m, xrefs: 00164D4F
k{ex, xrefs: 001649C3
ckzS, xrefs: 00164B8E
SE[\, xrefs: 001651CF
csgf, xrefs: 0016506A
ilgN, xrefs: 00165577
Gx|w, xrefs: 00164D3A
Gx|w, xrefs: 0016517F
Z, xrefs: 001651D9
ibkf, xrefs: 00164D1E
erqS, xrefs: 00165357
|dZ@, xrefs: 00164BC0
HPUN, xrefs: 00164BCA
ZF, xrefs: 00164BF2
iugM, xrefs: 00165787
Pdmn, xrefs: 00164EB4
nSgb, xrefs: 00165467
^B[\, xrefs: 00164BE8
EL{, xrefs: 001651BB
xugm, xrefs: 00164A64
ndnz, xrefs: 00164EAA
xdaa, xrefs: 00164EC8
kkos, xrefs: 00165254
j, xrefs: 00165071
k, xrefs: 00165268
pxub, xrefs: 00164DB6
ckzS, xrefs: 00164D33
wYKn, xrefs: 00164FCA
nak, xrefs: 00165485
wlii, xrefs: 00164A6E
k{ex, xrefs: 00164D2C
hqoj, xrefs: 00165471
fnKh, xrefs: 00164EBE
{be7, xrefs: 00165189
wYKn, xrefs: 001649BC
ibkf, xrefs: 00164B70
ry{m, xrefs: 00164BB6
iUZJ, xrefs: 00164BDE
ckzS, xrefs: 00165175
{beK, xrefs: 00164FF2
ibkf, xrefs: 001649B5
wYKn, xrefs: 00164B7A
k{ex, xrefs: 0016516B
gqoh, xrefs: 00165691
g{ce, xrefs: 0016558B
ibkf, xrefs: 00164FC0
K`io, xrefs: 00164FFC
{be7, xrefs: 00164D41
wYKn, xrefs: 00164D25
\||~, xrefs: 00165193
yp, xrefs: 00165006
k, xrefs: 00165595
ry{m, xrefs: 0016519D
k}cd, xrefs: 0016536B
vjrb, xrefs: 00165361
eb`, xrefs: 001657A5
b, xrefs: 00165375
kqoa, xrefs: 00165791
kkos, xrefs: 00165581
f, xrefs: 0016569B

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: Create
String ID: EL{$GGYw$Gx|w$Gx|w$Gx|w$Gx|w$HPUN$K`io$Pdmn$SE[\$Z$ZF$\||~$\||~$\||~$^BZJ$^B[\$b$ckzS$ckzS$ckzS$ckzS$csgf$eb`$erqS$f$fnKh$gqoh$g{ce$g{ce$hqoj$iUZJ$ibkf$ibkf$ibkf$ibkf$ibkf$ilgN$inpN$iugM$j$k$k$kkos$kkos$kqoa$k{ex$k{ex$k{ex$k{ex$k{ex$k}cd$mLdj$nSgb$nak$ndnz$pxub$rnvf$ry{m$ry{m$ry{m$v`$vjrb$wYKn$wYKn$wYKn$wYKn$wYKn$wlii$xdaa$xugm$yp${${be7${be7${be7${beK$|dZ@$|sGB
API String ID: 2289755597-3742130022
Opcode ID: ca72c2763bcf31178c87331710892e1f93654f88e3d7645461a0d056ca74bb68
Instruction ID: 40cde9a6c219f90deb6cb82f6abb52c9638120a9ebcf544c8fd397e20d718d77
Opcode Fuzzy Hash: ca72c2763bcf31178c87331710892e1f93654f88e3d7645461a0d056ca74bb68
Instruction Fuzzy Hash: F9B28570A14269CFDB28CF48C8A0BAEBBB2FF45704F15808DD5496F292D771AE55CB90

Function 00166689 Relevance: 34.7, APIs: 1, Strings: 18, Instructions: 1432COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 001668D0

Strings

RM[#, xrefs: 00166CFA
., xrefs: 00167535
@@MC, xrefs: 00166D0E
(ACL, xrefs: 00167431
I^Z, xrefs: 00167AFE, 00167B2E
'[_+, xrefs: 0016752B
OFMM, xrefs: 00167423
+wj', xrefs: 00166D04
$*tk, xrefs: 0016742A
'[_+, xrefs: 00166E1B
DH][, xrefs: 00167438
e`vf, xrefs: 00167517
*, xrefs: 00167A17
$*`', xrefs: 00166E11
e`vf, xrefs: 00166E07
., xrefs: 00166E25
$*`', xrefs: 00167521
\, xrefs: 001669E5

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID: $*`'$$*`'$$*tk$'[_+$'[_+$(ACL$*$+wj'$.$.$@@MC$DH][$I^Z$OFMM$RM[#$\$e`vf$e`vf
API String ID: 1418687624-1120457843
Opcode ID: 1fe3182b30f9b3c49179eab06f3ca725b74aa9c156482842247108348d89750a
Instruction ID: cab98e79b091a6158f378f126962dd14505374873736759fb9ba2146a9bb5623
Opcode Fuzzy Hash: 1fe3182b30f9b3c49179eab06f3ca725b74aa9c156482842247108348d89750a
Instruction Fuzzy Hash: FED26A709042588FDB69CF68CC987EDBBB1BF09304F1482E9D449AB382D7719A95CF91

Function 00169F50 Relevance: 32.1, APIs: 2, Strings: 15, Instructions: 2331injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(00000000,00000000,?,00000218,00000000,00284D8C,0000000E,0000003A,?), ref: 0016A1BC
WriteProcessMemory.KERNEL32(00256605,00000218,00169E30,00000110,00000000), ref: 0016A1DB

Strings

,, xrefs: 0016A5D2
$, xrefs: 0016BD6D
:, xrefs: 0016A097
., xrefs: 0016AB30
arqt, xrefs: 0016A4C7
v|, xrefs: 0016A52E
,, xrefs: 0016A6AF
er, xrefs: 0016A659
., xrefs: 0016B0E2
%s|%s, xrefs: 0016A198
131, xrefs: 0016A178, 0016A17F, 0016A190
|N(, xrefs: 0016A321
|N(, xrefs: 0016A2D3
type must be boolean, but is , xrefs: 0016BF3C, 0016BF6D, 0016C02B
irvl, xrefs: 0016A527

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: MemoryProcessWrite
String ID: $$%s|%s$,$,$.$.$131$:$arqt$er$irvl$type must be boolean, but is $v|$|N($|N(
API String ID: 3559483778-1803285617
Opcode ID: 625893b1ace850b64b83fa6388c8808b014df653ce8c51424a8b3a4af482a9b4
Instruction ID: fa29122055b65e75841f174f69c1ed793287837b045ed6354fe89742c10742d1
Opcode Fuzzy Hash: 625893b1ace850b64b83fa6388c8808b014df653ce8c51424a8b3a4af482a9b4
Instruction Fuzzy Hash: 8723CF70D042588FDB28DF68CD98BEDBBB4EF15304F148199E449AB292DB319E94CF91

Function 0016C0A0 Relevance: 28.8, Strings: 22, Instructions: 1274COMMON

Download Yara Rule

Strings

yek<, xrefs: 0016D23A
mn-k, xrefs: 0016CE01
4N(, xrefs: 0016D693
ose,, xrefs: 0016C49E
f~aa, xrefs: 0016C4BC
x&|9, xrefs: 0016D226
c`in, xrefs: 0016D21C
"<!l, xrefs: 0016D230
yp, xrefs: 0016D244
eh~6, xrefs: 0016C4B2
+acj, xrefs: 0016CA7D
/, xrefs: 0016C210
Content-Type: application/x-www-form-urlencoded, xrefs: 0016C1B1, 0016C43F, 0016CDA2
;ciu, xrefs: 0016C4A8
cno,, xrefs: 0016D212
xaz4, xrefs: 0016CE15
g&, xrefs: 0016CA87
https://ipinfo.io/, xrefs: 0016CABC
dfgw, xrefs: 0016CA73
https://www.maxmind.com/en/locate-my-ip-address, xrefs: 0016D28A
khc), xrefs: 0016CE0B
C, xrefs: 0016DF64

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: AddressConcurrency::cancel_current_taskProc
String ID: "<!l$+acj$/$4N($;ciu$C$Content-Type: application/x-www-form-urlencoded$c`in$cno,$dfgw$eh~6$f~aa$g&$https://ipinfo.io/$https://www.maxmind.com/en/locate-my-ip-address$khc)$mn-k$ose,$x&|9$xaz4$yek<$yp
API String ID: 3114269349-2797373304
Opcode ID: aaab5af0d9d232860b87f31c38019dda9162ff34215ff305c9798568927f0e9a
Instruction ID: 57246e6a1942dd9ac7b36e614e08b2a68830ab9a23478cb1e06fe77af8a0665e
Opcode Fuzzy Hash: aaab5af0d9d232860b87f31c38019dda9162ff34215ff305c9798568927f0e9a
Instruction Fuzzy Hash: 57C28C70D00268DADF24EB64CC56BEDBBB5AF25304F4440D9E54A77282DB705B88CFA2

Function 001D3F80 Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 263libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,BF989CA3), ref: 001D40CC
GetProcAddress.KERNEL32(00000000,BF989CA3), ref: 001D4116
GetProcAddress.KERNEL32(00000000,BF989CA3), ref: 001D414E
GetProcAddress.KERNEL32(00000000,BF989CA3), ref: 001D4196
GetProcAddress.KERNEL32(00000000,BF989CA3), ref: 001D41E9

Strings

mdmv, xrefs: 001D4316
vdPf, xrefs: 001D4249
D`vb, xrefs: 001D41B4
pv, xrefs: 001D431D
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36, xrefs: 001D4037

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID: D`vb$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36$mdmv$pv$vdPf
API String ID: 190572456-2376812635
Opcode ID: e2e2860f9ff81168496686e46a97977b091c727437fd6d73363b2749563ed74b
Instruction ID: 4a22c1f183cdea8cdcd2edd499ee53a216c9ae33310459d0443c9c8da604e171
Opcode Fuzzy Hash: e2e2860f9ff81168496686e46a97977b091c727437fd6d73363b2749563ed74b
Instruction Fuzzy Hash: ABC116B08183889FDB44DFA8E4947EDBFF4EF19304F14406EE845AB642E3759509CBA9

Function 0022CE10 Relevance: 11.7, Strings: 9, Instructions: 461COMMON

Download Yara Rule

Strings

sqlite_rename_table, xrefs: 0022D138
no such vfs: %s, xrefs: 0022CFA2
RTRIM, xrefs: 0022D006
NOCASE, xrefs: 0022D045
BINARY, xrefs: 0022CFC3, 0022CFD2, 0022CFEC, 0022D02E
automatic extension loading failed: %s, xrefs: 0022D2A2
MATCH, xrefs: 0022D15C, 0022D16A, 0022D18A, 0022D18B, 0022D1A1
temp, xrefs: 0022D10C
main, xrefs: 0022D0FC

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID: BINARY$MATCH$NOCASE$RTRIM$automatic extension loading failed: %s$main$no such vfs: %s$sqlite_rename_table$temp
API String ID: 0-1230920970
Opcode ID: 355c7433bbf27b06dee39e297b712bd23693fec31709ceeb0a80e96d9909d1a5
Instruction ID: 8e7edfb6834514465a5e01a267edfd2c59c796df5bad2e6bc875f87d199fd995
Opcode Fuzzy Hash: 355c7433bbf27b06dee39e297b712bd23693fec31709ceeb0a80e96d9909d1a5
Instruction Fuzzy Hash: FAF1E6B0A20321ABEB109FA4FC8976A7754AF50714F2440A8ED09AF287D7B5DD64CBD1

Function 001591A0 Relevance: 9.9, APIs: 2, Strings: 3, Instructions: 1146COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32(00000000,00000128), ref: 001592B0

Strings

/\/, xrefs: 0015956A, 0015959C
\, xrefs: 00159528
/, xrefs: 001594E2

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: NextProcess32
String ID: /$/\/$\
API String ID: 1850201408-1523196992
Opcode ID: 9b6cc70262a63bf9407c86dad54f7151dd12f906c61e13fd4a646c665494be35
Instruction ID: 0b80606c0cc14b4092ac46353d43df2824a964a0993c72bddc101f14f2b0b9ae
Opcode Fuzzy Hash: 9b6cc70262a63bf9407c86dad54f7151dd12f906c61e13fd4a646c665494be35
Instruction Fuzzy Hash: DC92F471D00248CFDF19CFA8C894AEEFBB5EF05315F14426DD865AB281E7315A4ACB92

Function 001D9880 Relevance: 7.0, Strings: 5, Instructions: 748COMMON

Download Yara Rule

Strings

unknown compression method, xrefs: 001D9A3F, 001D9B22
unknown header flags set, xrefs: 001D9B39
header crc mismatch, xrefs: 001D9FE8
incorrect header check, xrefs: 001D9ADE
invalid window size, xrefs: 001D9ACF

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID: header crc mismatch$incorrect header check$invalid window size$unknown compression method$unknown header flags set
API String ID: 0-3633268661
Opcode ID: a112fdca51c9b46f277b97b934093a3e49c9a12ac6fea5a6fd481ad6b315dbbc
Instruction ID: a5901df56cdd32ced989fc2909feb4539da7ba708de084160644fce6a09e4910
Opcode Fuzzy Hash: a112fdca51c9b46f277b97b934093a3e49c9a12ac6fea5a6fd481ad6b315dbbc
Instruction Fuzzy Hash: F76282B1E002559FDF18CF59C5846ADBBF2AF88304F2885AED808AB346D735D946CF91

Function 002384A0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f97ce6278b5da815f6c389bae476adc5dc884afc24939f4c376b69ad4ad6edd
Instruction ID: 632debe1328f25a00d1ce2734d171acc75d4c2278060fdb6ea5ddca589e5c068
Opcode Fuzzy Hash: 3f97ce6278b5da815f6c389bae476adc5dc884afc24939f4c376b69ad4ad6edd
Instruction Fuzzy Hash: 56023CB1E1121A9BDF14CFA9C8807AEFBF5FF48314F248269E515EB340DB31A9518B90

Function 001D6C00 Relevance: 3.6, Strings: 2, Instructions: 1073COMMON

Download Yara Rule

Strings

stream error, xrefs: 001D7816
buffer error, xrefs: 001D6D3D

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID: buffer error$stream error
API String ID: 0-1018483818
Opcode ID: 1db56061ee44b7bb3318655b84aa025a144422da17fdfeae2b2b5172374f73d1
Instruction ID: e024878785c31529b8bea62b43e2f0a8c01b2134e189b9481df85908472b53a8
Opcode Fuzzy Hash: 1db56061ee44b7bb3318655b84aa025a144422da17fdfeae2b2b5172374f73d1
Instruction Fuzzy Hash: B2A25C74A04A02DFCB24CF68D18096AB7F1FF49304B14866ED8558BB81E734F956CFA1

Function 001524F0 Relevance: 2.7, Strings: 2, Instructions: 221COMMON

Download Yara Rule

Strings

L(, xrefs: 001525C7
L(, xrefs: 001526B7

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID: L($L(
API String ID: 0-1286290936
Opcode ID: 464c16cddcd519b1ab81fec7f056fcce7d371408ffa0747e468e7dad3a8c71a8
Instruction ID: 5d9c4cf4c7561d787722d6a5d6b061a74eaf158952c5bf49bab917690cfb8e6a
Opcode Fuzzy Hash: 464c16cddcd519b1ab81fec7f056fcce7d371408ffa0747e468e7dad3a8c71a8
Instruction Fuzzy Hash: FF71F4B6E01156CFDB14DF68D8E07FEBBB5AB2A301F040269DC659B742D734990AC7A0

Function 001E68C0 Relevance: 1.7, APIs: 1, Instructions: 234COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 001E6946

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: __allrem
String ID:
API String ID: 2933888876-0
Opcode ID: a87905cb6565a46ad7e4c9cb387ce8e340f7b6742791b946ee519f046e29c656
Instruction ID: e80ede1dd408d5ad90fd28a40fbf1d95c159296c194baa3859bab7f61dff01e7
Opcode Fuzzy Hash: a87905cb6565a46ad7e4c9cb387ce8e340f7b6742791b946ee519f046e29c656
Instruction Fuzzy Hash: 1F818171A001859FDB08CF9DCC80AAEBBB5AF99304F5480A9E914EB342D375EE45CB91

Function 001E63D0 Relevance: 1.7, APIs: 1, Instructions: 168COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 001E6449

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: __allrem
String ID:
API String ID: 2933888876-0
Opcode ID: 93d9116fef990718128c856b79d4cad9513420ac30789c370918fc53520b1e9c
Instruction ID: cf3ba6a16ba696613613a61b48f8e62d30cfa019fe0375d42b0ba9789a18d0fd
Opcode Fuzzy Hash: 93d9116fef990718128c856b79d4cad9513420ac30789c370918fc53520b1e9c
Instruction Fuzzy Hash: 9C617C71610B80CFCB18CF6DC88056AFBF5AFA4300B0489AEDC86DB752D630E955CB90

Function 0023BEAF Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

0, xrefs: 0023C01F

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: d5e76c8b4de114984b9a9763f9d09384808729d25c34dc2b385007ddf03f35b4
Instruction ID: 4dce5c06db1d93f46d092f431dc21d8721b5637e8224f8d3412a398d3d117b78
Opcode Fuzzy Hash: d5e76c8b4de114984b9a9763f9d09384808729d25c34dc2b385007ddf03f35b4
Instruction Fuzzy Hash: 32C102F452074BCFCB29CF68C98467AB7B1AF05300F241619EA96A7A52C331ED65DF50

Function 0023BB6D Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 0023BCF1

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 80fe08d0e465fc427e71dfbfce1812cfc046ea108b5dafc407713002743ef7ed
Instruction ID: 59eca991c695b445461842bc6b97f66c50c7c7d12763629cc51faadf0b29025b
Opcode Fuzzy Hash: 80fe08d0e465fc427e71dfbfce1812cfc046ea108b5dafc407713002743ef7ed
Instruction Fuzzy Hash: 2BB1E8F092060B8FCB36CE78C595ABEB7B1AF04704F140A1EDB92A7691CB359D25CB41

Function 0022F26A Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,0022EC78,?,?,?,?,001640EB,?,0016F5EB), ref: 0022F283

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 62d9d832d093168e1d38da98eba81fedfd3b12f38a17eb01bf2a0a469e35dcb5
Instruction ID: 132cc5b34e43100e5782ff99951d22326e163abcf3b289ec8866f0505f8086e8
Opcode Fuzzy Hash: 62d9d832d093168e1d38da98eba81fedfd3b12f38a17eb01bf2a0a469e35dcb5
Instruction Fuzzy Hash: 70D0223662223DB38A813FD0BC1886DBB28DE0ABD03800036ED09471248B612C204BE8

Function 001DF360 Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

-, xrefs: 001DF3DF

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: ffad52e287b60b8b48c8f6c01dcfbe838c716be90c45fb450b26370899277487
Instruction ID: 68d141b60457a35111f080c630ff81a6da6adce0196c7816e9e29d9537b7057d
Opcode Fuzzy Hash: ffad52e287b60b8b48c8f6c01dcfbe838c716be90c45fb450b26370899277487
Instruction Fuzzy Hash: 93818270951648AEEF219AB8C840BEDFFF0EF05201F1489E9E8D5E3B41D678D64AC761

Function 001D5B20 Relevance: .8, Instructions: 759COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c5316f1b48f63a7bb38c0e6b3ea4f58914c08cb1eb6d5d8162fff3f7cf674ca
Instruction ID: aafd978c153ece6b4d32413b7f7d12d20c0f93e2bc9b35e03a28dbc276a5f4a5
Opcode Fuzzy Hash: 0c5316f1b48f63a7bb38c0e6b3ea4f58914c08cb1eb6d5d8162fff3f7cf674ca
Instruction Fuzzy Hash: 993241B7F5161447DB0CCE5DDCA16EDB2E3AFD8224B1E803DA80AE3345EA79DD058684

Function 001DBD50 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b80b37ecb74186be8c734b10355c4c601250e8bd0ee9413014499d52b291190a
Instruction ID: 85afa2bc20f29ae9d4cebf086370f6c6c70b31393fcc82537b10f64a7f5a5924
Opcode Fuzzy Hash: b80b37ecb74186be8c734b10355c4c601250e8bd0ee9413014499d52b291190a
Instruction Fuzzy Hash: AE027275908215CFCB09CF58D4D48F9BBF1EF69310B1A86EED8899B362D3319980CB91

Function 001DE490 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b596a0d6a02d1d738e200e3e0335b53bfb7e2e4d36db8e46ea7a94c3df80fe09
Instruction ID: 04efe5d19d08133f3ccc1a66a1c287a7cd11dae05b85b2848db405c0fdf11314
Opcode Fuzzy Hash: b596a0d6a02d1d738e200e3e0335b53bfb7e2e4d36db8e46ea7a94c3df80fe09
Instruction Fuzzy Hash: 62D1AC746007018BE764DF39C490796BBE0FF58315F1486AED4EE8B781EB74A489CB91

Function 001DE140 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a2e03b90355dc0d59000aeef2c7e7f9d6bd4af588e3a47cd3e57602e03e1696
Instruction ID: 91a26b255b8a6c90fab6f3ec5539200d83b474d362ebd16f37b682a7074464fa
Opcode Fuzzy Hash: 2a2e03b90355dc0d59000aeef2c7e7f9d6bd4af588e3a47cd3e57602e03e1696
Instruction Fuzzy Hash: 43B1AF35A007059FEB20DAA4CC40ABFF7F5FF49311F104A1AE9A6D6790D371A946CB61

Function 001DF810 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef7c3bc278ec1be74c412d1d410004a4df5d21a6df1fc4201c5dbd1b215ea9a0
Instruction ID: f2b86bcbe140bba3ee21c50bbf481f5bab1dded5f7a76e32ae38c9a2a68c4ee1
Opcode Fuzzy Hash: ef7c3bc278ec1be74c412d1d410004a4df5d21a6df1fc4201c5dbd1b215ea9a0
Instruction Fuzzy Hash: E8B19F716047019FD724DE64C880A6BB7E4FF88314F144A3EF9AB83790D774EA4A8B52

Function 00249824 Relevance: .3, Instructions: 270COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63eea95e24a3720d94374b4d970a08d437c661f12c76227c6405adf9361e691c
Instruction ID: bd2f104ce6ae40645f11b66e02ae3e0baffc44272f8f866a462fb69778f2e6aa
Opcode Fuzzy Hash: 63eea95e24a3720d94374b4d970a08d437c661f12c76227c6405adf9361e691c
Instruction Fuzzy Hash: 76B12D316206099FD719CF28C48AB667BE0FF45364F25865CE8DACF2A1C375D9A1CB40

Function 001DF600 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41d31ba86242bfd7bd76f9ba221a1519e07e8bc4f3f0aa95c67da6b44e1bb030
Instruction ID: b3ffe5e6f1c2332fd07367e22b2818b23534884819207403ad16b4af420d01a7
Opcode Fuzzy Hash: 41d31ba86242bfd7bd76f9ba221a1519e07e8bc4f3f0aa95c67da6b44e1bb030
Instruction Fuzzy Hash: B161B731900605AFDB30CAA8C840BEEBBE5EF45310F108ABEE596D27A0D375E686C751

Function 001D6550 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b777f67c6d7ea970b66b9d81590923a800ab92748cc3d13ed8e535d199200f3
Instruction ID: ce3fd684c3d0bc10477c594837fb8f51af843425a3cc496bb471b67132e319e9
Opcode Fuzzy Hash: 1b777f67c6d7ea970b66b9d81590923a800ab92748cc3d13ed8e535d199200f3
Instruction Fuzzy Hash: 9A6151316101644FD718DF6EFCC44763361A78B3013A6822BEAC1DB3A6D775E966CBA0

Function 00164100 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1d1203016979e9777d3a15da65a119e378df346ef83abae71d57e2fdec6d4cb
Instruction ID: e51d42130d6b62b39a4fb2a2b39074922f3d9176bbbf8e450e05907909c1c174
Opcode Fuzzy Hash: a1d1203016979e9777d3a15da65a119e378df346ef83abae71d57e2fdec6d4cb
Instruction Fuzzy Hash: 25518BB1E002199FCB18DF98DC81AEEBBB5FB59310F14456DE819A7341D730AA94CBA0

Function 0023646A Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 920c44e739ca4d08db5b5969fbc7a5a158caad0a814d8dad7807257cb044add9
Instruction ID: 71454455f6c770bb669f8fec84a52862b92a18fba6fa3bf0bcb1648be2b889d8
Opcode Fuzzy Hash: 920c44e739ca4d08db5b5969fbc7a5a158caad0a814d8dad7807257cb044add9
Instruction Fuzzy Hash: 4C51A1B2D1011AEFDF14CF98C844AEEBBB6FF88304F598468E915AB201D7749A50DF90

Function 001DE910 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 854d7f0168f0dc93b040c5b83782ce3004fb363419dbd7899f20dfa3d1eb45b6
Instruction ID: 0610b613b91080cceaaea8747c6712f79cbcd44c12bd89350043bf733a4b72a5
Opcode Fuzzy Hash: 854d7f0168f0dc93b040c5b83782ce3004fb363419dbd7899f20dfa3d1eb45b6
Instruction Fuzzy Hash: 01318D31600B008FC365CEB9C8917A3B7E4FB49315F140A6ED6EAC7280C7B4B984CB60

Function 00232CE0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: b5c5aee61e5ba7342de1b3179951a0a37910503a075e3ffcc3f540db3a896840
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: AC112BF726019BC3D6148E2DD9B46B7B395EBC9320F2D437AD1414B75CD222E96D9600

Function 00164400 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ea9f7826d8edcdaa46f3b9fee4deacf86556a8192f2b9355d066aac2b91176a
Instruction ID: 3139214c41f0821e97038777a68c27265db49580359bf1b6fadcee16fc4606d3
Opcode Fuzzy Hash: 1ea9f7826d8edcdaa46f3b9fee4deacf86556a8192f2b9355d066aac2b91176a
Instruction Fuzzy Hash: C30180B1914208AFCB04DFA9C8856DEFBF8FF08310F408AAED458E7241E3715615CBA0

Function 00165498 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 441a51f5b10b454595e693b08969a736bc04aa29c4e083713c689d711331e6f1
Instruction ID: 887be78a25091153eb4a6f840a5435f7fa8c50d428b5cddc31a66f578ccb6d14
Opcode Fuzzy Hash: 441a51f5b10b454595e693b08969a736bc04aa29c4e083713c689d711331e6f1
Instruction Fuzzy Hash: 8B11BC30A14660CBCB29CF08C4A4BA9F7A2EF45744F6980CEC8861F712E731AD56CB80

Function 001657B8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a2871ff881b76c433494f73acef219e289aa9123ebe371a345c92605df81084
Instruction ID: 914a410450f01a01ac12e3e0fad42063c9b97a238bcd16585b0bdf8ca84bf37d
Opcode Fuzzy Hash: 5a2871ff881b76c433494f73acef219e289aa9123ebe371a345c92605df81084
Instruction Fuzzy Hash: E0118C34A146658FCB19CF19C4A0BA9FBA6EF45B44F69808EC8851FB22D731AD55CBC0

Function 00164DC9 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 909acaf0cd9eaded28342594710fe585bf5ca2d875c123a9b59f138863c25c4b
Instruction ID: fb03fe9a9e6b073224a16bb552ae1a9fbd2b633630f559c34db72d131acfc269
Opcode Fuzzy Hash: 909acaf0cd9eaded28342594710fe585bf5ca2d875c123a9b59f138863c25c4b
Instruction Fuzzy Hash: 75118F349141558BCB29CF18C4A0B69F7A1FF45B54F29408EC8951F616D776AD25CBC0

Function 001B7D40 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e21df9b3f294e0fc2e891459ff19a08484617196f5e4321e9cc5c82f3718a1
Instruction ID: bfdfc0a84d1809f8c2b0ac137aba7a645e6cf8221bf13e61cb9b83cfc32cd594
Opcode Fuzzy Hash: f7e21df9b3f294e0fc2e891459ff19a08484617196f5e4321e9cc5c82f3718a1
Instruction Fuzzy Hash: 2AD0A73142C690CEC33AC97490887E27FC44F46754F164DCDC0928B0A1D7A0D885C758

Function 001B7750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13543d78167cc02ffeb902e673b33838cf06af7b7335ca3cbe28f038fabd8404
Instruction ID: 76fd33599d2fbbef8bb13aa416cc5b3906012218166e28eba89d04bbfdac47a1
Opcode Fuzzy Hash: 13543d78167cc02ffeb902e673b33838cf06af7b7335ca3cbe28f038fabd8404
Instruction Fuzzy Hash: 82D0A73142C691CDC32AC564D08CBD2BFC54F42714F16CCCDD0A28B195DFA0D885C354

Function 001B7780 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8b6c227afc04ef9d8c1c36e39010bc766e3c3c0c70ba707f9d6f05cac1b7268
Instruction ID: 47fd55c63aa152f315e998ed3b36bea5e922b46b024c6cff6c88d5f62f73ba93
Opcode Fuzzy Hash: e8b6c227afc04ef9d8c1c36e39010bc766e3c3c0c70ba707f9d6f05cac1b7268
Instruction Fuzzy Hash: 49D05E32429A9159D32AC524944CBD3BBE94B86214F164D89C0828A091EBA094C9C258

Function 001B9610 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4a58f2acd26a6c84f23a47943215d251ee13493331cefdf2c4a931ee6dde283
Instruction ID: c56ff6e14a51bc155acfec79365b095ba28263bd1c08ff7457a313ef892b1166
Opcode Fuzzy Hash: f4a58f2acd26a6c84f23a47943215d251ee13493331cefdf2c4a931ee6dde283
Instruction Fuzzy Hash: C7C012705041104BC738DF1CE48089773D6AF58300325896DE08B93700E771ED0187C0

Function 00158D70 Relevance: 28.3, APIs: 7, Strings: 9, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(9B92819A,?,?,002856BC), ref: 00158E0E
GetProcAddress.KERNEL32(00000000,82B281BA), ref: 00158E1B
GetModuleHandleA.KERNEL32(9B92819A), ref: 00158E85
GetProcAddress.KERNEL32(00000000,82A781BA), ref: 00158E8C
CloseHandle.KERNEL32(00000000), ref: 00159092
CloseHandle.KERNEL32(00000000), ref: 001590F4
CloseHandle.KERNEL32(00000000), ref: 00159121

Strings

p, xrefs: 00158DBE
bkg`, xrefs: 00158DB7
lwcf, xrefs: 00158FA9
l, xrefs: 00158FB0
}V%, xrefs: 00158EC8, 00158EC5
}V%, xrefs: 001590F6
t, xrefs: 00158E37
eHlW, xrefs: 00158FA2
File, xrefs: 00158F73

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: Handle$Close$AddressModuleProc
String ID: File$bkg`$eHlW$l$lwcf$p$t$}V%$}V%
API String ID: 4110381430-3416113713
Opcode ID: db5bb198eb8666d1b2da3de770eb3835e14e88f95e58400e0f44668c36da7638
Instruction ID: f04f17a9a07310467bdaba53ab7f2027afd1f7abc8b05beb0809512293d82a6a
Opcode Fuzzy Hash: db5bb198eb8666d1b2da3de770eb3835e14e88f95e58400e0f44668c36da7638
Instruction Fuzzy Hash: 25C1AB70D10259DAEF20DFA4DC85BEEBBB9FF05300F104469E914BB291DB71A948CB66

Function 0015D8B9 Relevance: 24.9, APIs: 2, Strings: 12, Instructions: 377COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32(00000000,00000128), ref: 0015DAB0
Process32Next.KERNEL32(00000000,?), ref: 0015DAF8

Strings

ec`v, xrefs: 0015DBA7
{~RL, xrefs: 0015DB9D
jjst, xrefs: 0015DBBB
agnd, xrefs: 0015DB93
IOQW, xrefs: 0015DBCF
d;"&, xrefs: 0015D957
?, xrefs: 0015DCB9
oo, xrefs: 0015DD34
bqZP, xrefs: 0015DB89
rnql, xrefs: 0015DB7F
rAKq, xrefs: 0015DBC5
za@r, xrefs: 0015DBB1

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: NextProcess32
String ID: ?$IOQW$agnd$bqZP$d;"&$ec`v$jjst$oo$rAKq$rnql$za@r${~RL
API String ID: 1850201408-807315893
Opcode ID: 7cfd89b7b34ba38cfa3e1b57904ec85696bc7000d7888816013e19017fced5eb
Instruction ID: 5d0da7d1f4baa3439192866f832edb16fd3e6e88e0a50ca28ea399683a4401f6
Opcode Fuzzy Hash: 7cfd89b7b34ba38cfa3e1b57904ec85696bc7000d7888816013e19017fced5eb
Instruction Fuzzy Hash: 51F12EB1D1122CDADB25EB90CC55BEEB7B8EF15305F4004D9E909BA242EB705B89CF61

Function 001BF810 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 001BF833
std::_Lockit::_Lockit.LIBCPMT ref: 001BF855
std::_Lockit::~_Lockit.LIBCPMT ref: 001BF875
std::_Lockit::~_Lockit.LIBCPMT ref: 001BF89F
std::_Lockit::_Lockit.LIBCPMT ref: 001BF90D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 001BF959
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 001BF973
std::_Lockit::~_Lockit.LIBCPMT ref: 001BFA08
std::_Facet_Register.LIBCPMT ref: 001BFA15

Strings

bad locale name, xrefs: 001BFA2F
"', xrefs: 001BF96B, 001BF972

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$"'
API String ID: 3375549084-1208716225
Opcode ID: 7c508b8f78b260da42df1fc33ad4c43212528a97274899548c1c8455fbe6bab4
Instruction ID: a0061e3b592b41612895cca1755bf3d14e02fd0589896e0de6356b57c0a7be3e
Opcode Fuzzy Hash: 7c508b8f78b260da42df1fc33ad4c43212528a97274899548c1c8455fbe6bab4
Instruction Fuzzy Hash: 7A619DB5D10218EBEF20DFA4EC45BDEBBB4AF14710F144069E805AB381E774E916CBA1

Function 00164490 Relevance: 17.7, APIs: 2, Strings: 8, Instructions: 225registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,A3A5ACA7,00000000,00020019,?), ref: 0016452C
RegOpenKeyExA.ADVAPI32(80000002,A3A5ACA7,00000000,00020019,?), ref: 001645AA

Strings

P^k}, xrefs: 0016455E
ynj, xrefs: 0016457A
jqth, xrefs: 001644D1
gI@U, xrefs: 0016456C
wa]n, xrefs: 00164573
nuAl, xrefs: 00164549
jqth, xrefs: 00164550
fxqv, xrefs: 00164565

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: Open
String ID: P^k}$fxqv$gI@U$jqth$jqth$nuAl$wa]n$ynj
API String ID: 71445658-2554975206
Opcode ID: 9a845783a54baaea2577c6afd4cf54e252ac0a3968f06ee6c98e4d1cdfe97613
Instruction ID: 74baf980da787b1fad78e4e2e0f40efd965afa581bb895598321165be86c6fde
Opcode Fuzzy Hash: 9a845783a54baaea2577c6afd4cf54e252ac0a3968f06ee6c98e4d1cdfe97613
Instruction Fuzzy Hash: D781E270D102589FDF18CFA8D894BEEFBBAEF0A304F14415DE441AB681E7719916CBA4

Function 00232E10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00232E47
___except_validate_context_record.LIBVCRUNTIME ref: 00232E4F
_ValidateLocalCookies.LIBCMT ref: 00232ED8
__IsNonwritableInCurrentImage.LIBCMT ref: 00232F03
_ValidateLocalCookies.LIBCMT ref: 00232F58

Strings

i(, xrefs: 00232F78
csm, xrefs: 00232EED

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: i($csm
API String ID: 1170836740-3223001819
Opcode ID: 5bf5ce8075692457514a2ba9340a7eb0ecb041318b4bad5fc85153ac63447e73
Instruction ID: b639ceccd11510b74348ed0a69a217860295e18053c2b06c34eb734d76feb81d
Opcode Fuzzy Hash: 5bf5ce8075692457514a2ba9340a7eb0ecb041318b4bad5fc85153ac63447e73
Instruction Fuzzy Hash: B141EBB4A20209DBCF10DF68D885A9EBBB5FF45324F148055E8149B392D771EE69CF90

Function 001539F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00153A58
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00153AA4
__Getctype.LIBCPMT ref: 00153ABA
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00153AE6
std::_Lockit::~_Lockit.LIBCPMT ref: 00153B7B

Strings

bad locale name, xrefs: 00153B96

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: 26bb842de6b6e9435f5c282ccda9bf83f9770185e0256d597682992e784b6d4f
Instruction ID: 669a2ce2abde106c57e6245b0deaf6828a1cb7ef26ae13181ce3e48dd54e69df
Opcode Fuzzy Hash: 26bb842de6b6e9435f5c282ccda9bf83f9770185e0256d597682992e784b6d4f
Instruction Fuzzy Hash: 73513EB1D10258EBEF10DFE4D945B9EBBB8AF14350F144069EC19AB381E774DA18CB61

Function 0015B1A0 Relevance: 10.6, APIs: 7, Instructions: 133memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000001C), ref: 0015B1F0
LocalAlloc.KERNEL32(00000040,0000001C,?,00000000,00000000), ref: 0015B239
SetupDiGetDeviceInterfaceDetailA.SETUPAPI(?,00000000,00000000,00000000,?,00000000), ref: 0015B26D
SetupDiGetDeviceInterfaceDetailA.SETUPAPI(?,?,00000000,?,00000000,00000000), ref: 0015B28F
LocalFree.KERNEL32(?,?,?,?,?,00000000,?,00000000,00000000), ref: 0015B2C0
LocalFree.KERNEL32(?,?,?,00000000,?,00000000,00000000), ref: 0015B2C5
LocalFree.KERNEL32(?,?,?,00000000,?,00000000,00000000), ref: 0015B2C8

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocDetailDeviceInterfaceSetup
String ID:
API String ID: 4232148138-0
Opcode ID: d773d655152fe6c29b79d70e264981153814c96f029aded2bd2f5df11d78c366
Instruction ID: 9e0a1b8c07205a79cee12ebed2dd9267f902fbdda5fdf913bfb5ff602fb8a6c3
Opcode Fuzzy Hash: d773d655152fe6c29b79d70e264981153814c96f029aded2bd2f5df11d78c366
Instruction Fuzzy Hash: 07414EB1940309EFDB60DFA9DD41B9EBBF4EB48700F10452AE959E7690E774A9008B60

Function 0023D513 Relevance: 9.3, APIs: 6, Instructions: 285COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 0023D69B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0023D6B7
__allrem.LIBCMT ref: 0023D6CE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0023D6EC
__allrem.LIBCMT ref: 0023D703
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0023D721

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 7222d4fbd83bf911f66e88245ad854337fd27cd591c1530f5d5dc897f2461532
Instruction ID: ec904e43231c58d0abc72d9193d7fd52374365158c7fab6d3fda91941732f4a4
Opcode Fuzzy Hash: 7222d4fbd83bf911f66e88245ad854337fd27cd591c1530f5d5dc897f2461532
Instruction Fuzzy Hash: 86811CF2A207129BE724AE68EC42B6BB3F9AF45724F144629F415D72C1E770D9508F90

Function 001BDE70 Relevance: 9.1, APIs: 6, Instructions: 104COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 001BDE93
std::_Lockit::_Lockit.LIBCPMT ref: 001BDEB6
std::_Lockit::~_Lockit.LIBCPMT ref: 001BDED6
std::_Facet_Register.LIBCPMT ref: 001BDF4B
std::_Lockit::~_Lockit.LIBCPMT ref: 001BDF63
Concurrency::cancel_current_task.LIBCPMT ref: 001BDF7B

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: e35c6801d94224af52146973554ebc44128e0633a86bf114bb2680f12e10491e
Instruction ID: 8aa9ee12393e6dd9c47c4f489c855de24991117140790e866685dba2a5a8c894
Opcode Fuzzy Hash: e35c6801d94224af52146973554ebc44128e0633a86bf114bb2680f12e10491e
Instruction Fuzzy Hash: F631E175804226DFCB18DF54E888BAEBBB4FB14720F15426DE8166B351E730AD01CBD0

Function 0015A750 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

\*.*, xrefs: 0015A7E7

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID: \*.*
API String ID: 0-1173974218
Opcode ID: 491c3892e3f1efec05d7dca8345eb20c32cca14ccaf5252bc638480a29fe1684
Instruction ID: 6f4a5a41b0801402d076bbcc58de6230b1e448023fb42ee2eff902d9a415058e
Opcode Fuzzy Hash: 491c3892e3f1efec05d7dca8345eb20c32cca14ccaf5252bc638480a29fe1684
Instruction Fuzzy Hash: 30A1E470D40209DFDB18DFA8C994BEEFBB5FF09311F504619E825AB281D7709988CB62

Function 00163AA0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 383COMMON

Download Yara Rule

Strings

\, xrefs: 00163BF8
abcdefghijklmnopqrstuvwxyz0123456789_ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 00163BBB
hr(, xrefs: 00163E26

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID:
String ID: \$abcdefghijklmnopqrstuvwxyz0123456789_ABCDEFGHIJKLMNOPQRSTUVWXYZ$hr(
API String ID: 0-61382527
Opcode ID: 12e2b34572ee7d51e0313b06bceee07698368b7dd9898fc97cb68ee51a6520d8
Instruction ID: f68e35b84fb9f04462e550dc75deecfb841bad8400532e11c69ff47210562e53
Opcode Fuzzy Hash: 12e2b34572ee7d51e0313b06bceee07698368b7dd9898fc97cb68ee51a6520d8
Instruction Fuzzy Hash: B1E1D371D002089FDB08DFA8DC94BADBBB5FF05300F24826DE415AB382D7359A55CBA1

Function 00154C50 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 345COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00154F72
___std_exception_destroy.LIBVCRUNTIME ref: 00154FFF

Strings

", ", xrefs: 00154DCB
: ", xrefs: 00154DA1

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: ", "$: "
API String ID: 4194217158-747220369
Opcode ID: ff53f8853de2ed8b42eb16e76b693d3c530599723032b16f44f8d2da711d1e24
Instruction ID: 82c442f804f5a4fc97ed50b6a23f37b385fd47319fe03f2eef9662825aee5725
Opcode Fuzzy Hash: ff53f8853de2ed8b42eb16e76b693d3c530599723032b16f44f8d2da711d1e24
Instruction Fuzzy Hash: E6C14370900204DFDB28DF68D895BAEB7F5FF44304F10492DE8669B781E774A988CBA1

Function 00157820 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0015799A
___std_exception_copy.LIBVCRUNTIME ref: 00157B75

Strings

type_error, xrefs: 0015784A
out_of_range, xrefs: 00157A27

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: out_of_range$type_error
API String ID: 2659868963-3702451861
Opcode ID: 5d59f4423c083221bbb9c38847953b856cfb8a579fd3a395b77d55cf4e9d88ea
Instruction ID: a4230d04be5fb9b01e62ba65b3af302c21a8ae8c8e3ae5c12f2ce00bef63de9d
Opcode Fuzzy Hash: 5d59f4423c083221bbb9c38847953b856cfb8a579fd3a395b77d55cf4e9d88ea
Instruction Fuzzy Hash: 1DC168B1900208DFDB08CFA8E98579DBBF5FF48310F148269E819EB791E77499848B60

Function 001573B0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 001575BE
___std_exception_destroy.LIBVCRUNTIME ref: 001575CD

Strings

, column , xrefs: 00157434, 0015744A
at line , xrefs: 001573F7

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column
API String ID: 4194217158-191570568
Opcode ID: fb3d83a36ad6eaf94114e2fde15c7373cc65f27e7c5afbbe279867476487cb1a
Instruction ID: 3b3510afe61bad061e5dc110f90daa1c735d0506a7697fa6be408d31b05bd420
Opcode Fuzzy Hash: fb3d83a36ad6eaf94114e2fde15c7373cc65f27e7c5afbbe279867476487cb1a
Instruction Fuzzy Hash: 7361F770A14204DFDB08DF68EC95BADBBB5FF45300F24462CE825AB781E774A954CB91

Function 0015AF30 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000001), ref: 0015AF8A
GetSystemMetrics.USER32(00000000), ref: 0015AF90

Strings

image/png, xrefs: 0015B063
d, xrefs: 0015AF4B

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID: d$image/png
API String ID: 4116985748-2616758285
Opcode ID: d33d9031bfca150a5883ef34c3e75a7490b53adb6b6924cfd5b0dac784ce6e02
Instruction ID: 9846a3dfe84cc67ef95bcfd02bbb627e922d7109e5b37660634eb17ae5120379
Opcode Fuzzy Hash: d33d9031bfca150a5883ef34c3e75a7490b53adb6b6924cfd5b0dac784ce6e02
Instruction Fuzzy Hash: 01518CB1108301AFE710DF24C894B6BBBE8EF95744F104D2DF99497290E771E808CB96

Function 00153D10 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00153E7F

Strings

ios_base::failbit set, xrefs: 00153D32
ios_base::badbit set, xrefs: 00153E17
ios_base::eofbit set, xrefs: 00153E41, 00153E63

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: e6c467c8ceb854884e605dfa5e12c32c7838f3235c970b5a2b3e36a04dcf8509
Instruction ID: 343cd8d753c97fe3611fe89af4c97fa8e988e5df0d50a7c36dfa9272f63f7f8a
Opcode Fuzzy Hash: e6c467c8ceb854884e605dfa5e12c32c7838f3235c970b5a2b3e36a04dcf8509
Instruction Fuzzy Hash: 4241B7B2910204AFC704DF68C845B9EB7F8EF49351F14852AFD25DB741E770AA158BA4

Function 00153DE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00153E7F

Strings

ios_base::failbit set, xrefs: 00153D32, 00153E1E
ios_base::badbit set, xrefs: 00153E17
ios_base::eofbit set, xrefs: 00153E28, 00153E41, 00153E63

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: e255b04bec400c28ed0463e070ab3f896cc0f1c47d23db09d656de767af1ccf3
Instruction ID: 4fe78c6997086547d4b4123e36b60c2bf7ec1a6c01ec5e0439ec3e6b3d6daca9
Opcode Fuzzy Hash: e255b04bec400c28ed0463e070ab3f896cc0f1c47d23db09d656de767af1ccf3
Instruction Fuzzy Hash: EA21EEB2510704AFC714DF58D806B96B7ECEB04351F14882AFE788B641E770E928CBA5

Function 00156F40 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 349COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00157340

Strings

parse_error, xrefs: 00156F8B
parse error, xrefs: 00156FFF, 00157018

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: parse error$parse_error
API String ID: 2659868963-1820534363
Opcode ID: 26864dba413a171726f42d32d42a1cd5a9c3384cf2beea6ef690a1a31fbdaf91
Instruction ID: b470b4e6d5aa151b17bea0bf3af84c997700d597175a47ffee504f074507a8b8
Opcode Fuzzy Hash: 26864dba413a171726f42d32d42a1cd5a9c3384cf2beea6ef690a1a31fbdaf91
Instruction Fuzzy Hash: 9BE17070904208DFDB18CF68D8957ADBBB1FF49300F248169E818EB792D7749A95CF91

Function 00156C60 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00156F11
___std_exception_destroy.LIBVCRUNTIME ref: 00156F20

Strings

[json.exception., xrefs: 00156CB8

Memory Dump Source

Source File: 00000000.00000002.3273994420.0000000000151000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3273948841.0000000000150000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273994420.0000000000283000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274236818.0000000000288000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274283719.000000000028B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274323160.000000000028C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274361597.0000000000296000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274396915.0000000000297000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274429639.0000000000298000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274675470.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274714524.00000000003F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274752677.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274786613.000000000040E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274823337.0000000000418000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274907968.000000000041C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274944074.0000000000424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274985761.000000000042B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275023903.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275059740.0000000000434000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275097223.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275128687.0000000000445000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275162930.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275200437.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275231050.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275285733.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275313294.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275457739.00000000004E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275495333.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275529663.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275599620.00000000004F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3275637680.00000000004FA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_LisectAVT_2403002A_191.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.
API String ID: 4194217158-791563284
Opcode ID: f9870d02cf307d1320dc5d9f9af2c61b69ee6dff222a6aa896615528e9ad6238
Instruction ID: 1059703b553224ad3e962f0a549922df8e02d6cac72041f0fc6442182516ce14
Opcode Fuzzy Hash: f9870d02cf307d1320dc5d9f9af2c61b69ee6dff222a6aa896615528e9ad6238
Instruction Fuzzy Hash: FE91E370A01204DFDB18CF68D995BAEFBF2EF45300F60866CE465AB792D770A945CB90

Analysis Process: MPGPH131.exePID: 3448, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	753
Total number of Limit Nodes:	97

Executed Functions

Function 00C97E3E Relevance: 65.3, APIs: 7, Strings: 29, Instructions: 2282COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,00000104,?,?,?), ref: 00C98006
GetFileAttributesA.KERNELBASE(?,00000001,?,?,?,?), ref: 00C9815D
__Mtx_unlock.LIBCPMT ref: 00C98186
__Mtx_unlock.LIBCPMT ref: 00C98195
GetFileAttributesA.KERNELBASE(?,?,0000005C,00000000,00000001), ref: 00C98751
__Mtx_unlock.LIBCPMT ref: 00C9877A

Strings

'[_+, xrefs: 00C98C3C
$*`', xrefs: 00C98C32
OFMM, xrefs: 00C99226
\, xrefs: 00C98896
131, xrefs: 00C97E3E, 00C97E44, 00C97EB2, 00C97EB9, 00C97EBF, 00C97F2A, 00C97F31, 00C97F37, 00C99A45, 00C99A4C, 00C99A52
P?Y, xrefs: 00C985DC
Q>5, xrefs: 00C99C24
e`vf, xrefs: 00C99337
(ACL, xrefs: 00C9923A
., xrefs: 00C98C46
bqZP, xrefs: 00C98479
@@MC, xrefs: 00C98B3A
*, xrefs: 00C9980E
DH][, xrefs: 00C99244
rnql, xrefs: 00C9846F
$*`', xrefs: 00C99341
ec`v, xrefs: 00C98497
RM[#, xrefs: 00C98B26
+, xrefs: 00C99B19
\, xrefs: 00C98684
., xrefs: 00C99355
IMG, xrefs: 00C98601
'[_+, xrefs: 00C9934B
{~RL, xrefs: 00C9848D
agnd, xrefs: 00C98483
$*tk, xrefs: 00C99230
e`vf, xrefs: 00C98C28
I^Z, xrefs: 00C98B44
+wj', xrefs: 00C98B30

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$AttributesFile$NameUser
String ID: $*`'$$*`'$$*tk$'[_+$'[_+$(ACL$*$+$+wj'$.$.$131$@@MC$DH][$IMG$I^Z$OFMM$P?Y$Q>5$RM[#$\$\$agnd$bqZP$e`vf$e`vf$ec`v$rnql${~RL
API String ID: 1275484822-1183361679
Opcode ID: 674d3b62e2bc2bad7dd2ea7e4da102fe8d71afda61e0f38433e275c26bc76ace
Instruction ID: dc5d52815c1f56777e5ae0d8543f0228f5880d93e85acb6f69642506a5ed3ddd
Opcode Fuzzy Hash: 674d3b62e2bc2bad7dd2ea7e4da102fe8d71afda61e0f38433e275c26bc76ace
Instruction Fuzzy Hash: D6235B709002598FDF28CF68C898BEDBBB5EF45304F1481EDD419AB282E7759A85CF61

Function 00C8B6A0 Relevance: 21.8, APIs: 4, Strings: 8, Instructions: 840
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,A3B0BAA7,00000000,00020019,00000000,999D9BA1,999D9BA2), ref: 00C8B947

Strings

`yk, xrefs: 00C8BEE0, 00C8BF0A
:, xrefs: 00C8B443
_, xrefs: 00C8BB32
_, xrefs: 00C8BB25
bqZD, xrefs: 00C8B905
rnql, xrefs: 00C8B8FE
cj|n, xrefs: 00C8B913
_, xrefs: 00C8BAC6

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Open
String ID: :$_$_$_$`yk$bqZD$cj|n$rnql
API String ID: 71445658-3798079816
Opcode ID: 359b8c0e3a2dee1716f3e49c4354f3a7f0470a8283328f5ef6bee0bbd0faf870
Instruction ID: 7092774ec5ef9f5af39a22e93606da422082d207bc54ee4bc9b5e3e6852ffb3e
Opcode Fuzzy Hash: 359b8c0e3a2dee1716f3e49c4354f3a7f0470a8283328f5ef6bee0bbd0faf870
Instruction Fuzzy Hash: 2572C170D002599FDB18DF68CC84BEEBBB5EF05304F1481ADE419AB282E7759A85CF64

Function 00C9E0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00C9E0CB
socket.WS2_32(?,?,?,?,?,?,00DB7320,?,?,?,?,?,?), ref: 00C9E17F
connect.WS2_32(00000000,?,00000000,?,?,?,00DB7320,?,?,?,?,?,?), ref: 00C9E193
closesocket.WS2_32(00000000), ref: 00C9E19E

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: 09500071b46c38ba84df7744c0710e12904fe07718646696b4cacc084e012d31
Instruction ID: e4d46504de4359328365c42ee96d990829165e44489f5756bedc2c9f11439db1
Opcode Fuzzy Hash: 09500071b46c38ba84df7744c0710e12904fe07718646696b4cacc084e012d31
Instruction Fuzzy Hash: 5B31B071604301ABDB20DF29CC89B2FB7E4EB85728F055F1DF9B8962E1D33199048B92

Function 00C8A690 Relevance: 4.6, APIs: 3, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE ref: 00C8A6BF
__Mtx_unlock.LIBCPMT ref: 00C8A6EE
__Mtx_unlock.LIBCPMT ref: 00C8A733

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$AttributesFile
String ID:
API String ID: 1886074773-0
Opcode ID: 2ecc5c89a1039dedb13cd57fc0dd2b214ece9a12aa83555921f993490db8c6a3
Instruction ID: a8bbe8384f531e7cc673e4b1d7a207f19a941a940096da92d8b16abf19290714
Opcode Fuzzy Hash: 2ecc5c89a1039dedb13cd57fc0dd2b214ece9a12aa83555921f993490db8c6a3
Instruction Fuzzy Hash: FC01C491A45121276D3831742C565FB2A08C99236E72C4923FC26C624AF543DF5953F7

Function 00C8A090 Relevance: 3.3, APIs: 2, Instructions: 342
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 00C8A1B6
__fread_nolock.LIBCMT ref: 00C8A343

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: d93b8a568f0d902c7579028841f9226c1c9d4c47f30e711a99ed992e4ac7910f
Instruction ID: 357f43838dbe4ff4e8df23a315acf07f7d003f018380900886b5de7a9b99c537
Opcode Fuzzy Hash: d93b8a568f0d902c7579028841f9226c1c9d4c47f30e711a99ed992e4ac7910f
Instruction Fuzzy Hash: D3B13870900204AFEB18EF68CC49B9EBBE8EF41704F10856EF4159B682D7B5DA41C7B6

Function 00D74623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 504525e84e11b37361db5a06691853825d85a9a145642f7e6b4e2a5bdef05f9f
Instruction ID: f718eeb3373f33a64ff500eb1515fd1b8f82967b8db6d075dcd7c7abc0d46b5f
Opcode Fuzzy Hash: 504525e84e11b37361db5a06691853825d85a9a145642f7e6b4e2a5bdef05f9f
Instruction Fuzzy Hash: 19B1F370E042499FDB12DFA8D850BBEBBB5EF4A310F188259E5489B386E770D941CB71

Function 00D7549C Relevance: 1.7, APIs: 1, Instructions: 198
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000000,00D69087,?,00000000,00000000,00000000,?,00000000,?,00D5E5B1,00D69087,00000000,00D5E5B1,?,?), ref: 00D75622

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: eeaf799d3d2d470bf4b92d67812f719ceed6ff32afecb3bebbca388263abf25c
Instruction ID: 756c76e5492da6ea3a663e24d9fcc72df9bcd72e379b140dedbbc76cb0b83e68
Opcode Fuzzy Hash: eeaf799d3d2d470bf4b92d67812f719ceed6ff32afecb3bebbca388263abf25c
Instruction Fuzzy Hash: 8761B471D04519AFDF11DFA8D844EAEBFBAEF09304F588149E808A7249E3B1D911CBB1

Function 00D64942 Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60a601dee669c779e4ae3485be377ebd20708f620ee71672446dfd1c57c25fe9
Instruction ID: e6e4706b9181af81373053f14856c5beacf54a2098d9cc7f34cf042d9c9029f8
Opcode Fuzzy Hash: 60a601dee669c779e4ae3485be377ebd20708f620ee71672446dfd1c57c25fe9
Instruction Fuzzy Hash: 8F519570A40208FFDB14CF98CC85AAABFA5EF45358F288159F8499B252D371DE41CBB4

Function 00CF0560 Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00CF06AE

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 704878a6fb962aec51445f9c7907984ce5d7d965d91800b1a8fb89f3cbd27ced
Instruction ID: 24996bce6b0c376f712f9fd696192d67e59c53d909396b112f32447166f5b2da
Opcode Fuzzy Hash: 704878a6fb962aec51445f9c7907984ce5d7d965d91800b1a8fb89f3cbd27ced
Instruction Fuzzy Hash: 974103B2A001189FCB05EF68DD806AE7BA5EF88710F240169FD15DB302D770DE618BE6

Function 00D74B12 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,00D749F9,00000000,CF830579,00DB1140,0000000C,00D74AB5,00D68BBD,?), ref: 00D74B69

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 4b0c4aee87baa356cc433ab46a6e218f0bcf95e010a2a98846fbec89aa2b4a1c
Instruction ID: ad6e07fc678897603022a7b2b8f5fafa5bcaed3622625d5698b4e0b702f567fd
Opcode Fuzzy Hash: 4b0c4aee87baa356cc433ab46a6e218f0bcf95e010a2a98846fbec89aa2b4a1c
Instruction Fuzzy Hash: C4112B3374512496CB2762386851B7E6B4ACBC2774F2D8649F91C8B1C2FF61DC415175

Function 00D6E05C Relevance: 1.6, APIs: 1, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00DB0DF8,00D5E5B1,00000002,00D5E5B1,00000000,?,?,?,00D6E166,00000000,?,00D5E5B1,00000002,00DB0DF8), ref: 00D6E099

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: c836ad457f19a93433b81109490f4d8cb0e451b680b341689c2257422c1c4abd
Instruction ID: ab4bd61add9e1f0ad53d0e52cedbe4f01f02c16f6121d74443dc82eae8d7a8b1
Opcode Fuzzy Hash: c836ad457f19a93433b81109490f4d8cb0e451b680b341689c2257422c1c4abd
Instruction Fuzzy Hash: C4012636614119ABCF05CF18CC05D9F3B29DB85334B280248F8509B2D1E6B2E9418BE0

Function 00D5F290 Relevance: 1.6, APIs: 1, Instructions: 51
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00C8220E

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: bd7e0067bb086f80b45c316382e84229741abfaa6cebb2a58e32a7dd70dcbfa1
Instruction ID: 49382ebe8555f9d9a28bb771575809a44b212f4de84fc74aac5abd35b1fc817d
Opcode Fuzzy Hash: bd7e0067bb086f80b45c316382e84229741abfaa6cebb2a58e32a7dd70dcbfa1
Instruction Fuzzy Hash: 62012B7550030DABCF14AF98E80689A7BECDE00310F548439FE58DB651EB70E95887B4

Function 00D763F3 Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,00D5D6FA,00000004,?,00D75D79,00000001,00000364,00000004,00000007,000000FF,?,00D6067B,00000002,00000000,?,?), ref: 00D76435

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 661dc90baa2b4d4cf212762d72955450e5625bbffe3dbfea14ebb7e7313a7326
Instruction ID: 35a9104accdea12d11846daad00bf4471e56c992a9785763268bb574d9fa4a03
Opcode Fuzzy Hash: 661dc90baa2b4d4cf212762d72955450e5625bbffe3dbfea14ebb7e7313a7326
Instruction Fuzzy Hash: EBF08931509A24AA9B216F669C06B5B7F59EF857A8F19C151EC0CD6180FA30DC1146F1

Function 00D76E2D Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000004,00000000,?,00D6067B,00000002,00000000,?,?,?,00C8303D,00D5D6FA,00000004,00000000,00D5D6FA), ref: 00D76E60

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a6edab15feecfbe3c71950329d55e6ca3e00e202441c8cc23d1798afd2431108
Instruction ID: a02d04c490be3df7b24a8319bb64dd5532941e8202eb1eb86c978aa3d66ed7b0
Opcode Fuzzy Hash: a6edab15feecfbe3c71950329d55e6ca3e00e202441c8cc23d1798afd2431108
Instruction Fuzzy Hash: B6E06D39541E25AADB312665DD02B6B7A59DF827A0F19C621FD8DA61D1FB20C81081B8

Non-executed Functions

Function 00D03F80 Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 263libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,BF989CA3), ref: 00D040CC
GetProcAddress.KERNEL32(00000000,BF989CA3), ref: 00D04116
GetProcAddress.KERNEL32(00000000,BF989CA3), ref: 00D0414E
GetProcAddress.KERNEL32(00000000,BF989CA3), ref: 00D04196
GetProcAddress.KERNEL32(00000000,BF989CA3), ref: 00D041E9

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36, xrefs: 00D04037
pv, xrefs: 00D0431D
D`vb, xrefs: 00D041B4
mdmv, xrefs: 00D04316
vdPf, xrefs: 00D04249

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID: D`vb$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36$mdmv$pv$vdPf
API String ID: 190572456-2376812635
Opcode ID: af02dd27d7e203fba13a79666ec35e18d1c8db0af66695087ce20416ecb70d23
Instruction ID: e1c8aa4ae9ab6b238eaa613089e194f1041ce010eb3657215c034ea974c785b7
Opcode Fuzzy Hash: af02dd27d7e203fba13a79666ec35e18d1c8db0af66695087ce20416ecb70d23
Instruction Fuzzy Hash: FCC109B0818388DEDB44DFA8E484BEDBFF4EF19704F50406ED845AB682D3755509CBA9

Function 00C8D8B9 Relevance: 26.6, APIs: 2, Strings: 13, Instructions: 377COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32(00000000,00000128), ref: 00C8DAB0
Process32Next.KERNEL32(00000000,?), ref: 00C8DAF8

Strings

EIJ, xrefs: 00C8DBD9
rAKq, xrefs: 00C8DBC5
za@r, xrefs: 00C8DBB1
?, xrefs: 00C8DCB9
oo, xrefs: 00C8DD34
IOQW, xrefs: 00C8DBCF
{~RL, xrefs: 00C8DB9D
rnql, xrefs: 00C8DB7F
jjst, xrefs: 00C8DBBB
ec`v, xrefs: 00C8DBA7
agnd, xrefs: 00C8DB93
d;"&, xrefs: 00C8D957
bqZP, xrefs: 00C8DB89

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: NextProcess32
String ID: ?$EIJ$IOQW$agnd$bqZP$d;"&$ec`v$jjst$oo$rAKq$rnql$za@r${~RL
API String ID: 1850201408-2823651170
Opcode ID: 3acc94521c997f9f65eafd7b6aab4ec47b31df97a76cb3a5a9c5d31b6a6df8b9
Instruction ID: ab1f8e914c948c29fd2af99689fad170486cbf06328e714452afce3204da85f4
Opcode Fuzzy Hash: 3acc94521c997f9f65eafd7b6aab4ec47b31df97a76cb3a5a9c5d31b6a6df8b9
Instruction Fuzzy Hash: C1F14CB1D1122C9AEF24EB90CC45BEEB7B8EF15304F4005D9E509A7282EB705B89DF65

Function 00C88D70 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(9B92819A,?,?,00DB56BC), ref: 00C88E0E
GetProcAddress.KERNEL32(00000000,82B281BA), ref: 00C88E1B
GetModuleHandleA.KERNEL32(9B92819A), ref: 00C88E85
GetProcAddress.KERNEL32(00000000,82A781BA), ref: 00C88E8C
CloseHandle.KERNEL32(00000000), ref: 00C89092
CloseHandle.KERNEL32(00000000), ref: 00C890F4
CloseHandle.KERNEL32(00000000), ref: 00C89121

Strings

File, xrefs: 00C88F73
p, xrefs: 00C88DBE
t, xrefs: 00C88E37
bkg`, xrefs: 00C88DB7
lwcf, xrefs: 00C88FA9
eHlW, xrefs: 00C88FA2
l, xrefs: 00C88FB0

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Handle$Close$AddressModuleProc
String ID: File$bkg`$eHlW$l$lwcf$p$t
API String ID: 4110381430-3184506882
Opcode ID: ec45aee28fcdd1506a55c9f23b8c1789f1320bca57fb1fdb60323ba7527438df
Instruction ID: f109a43b7b14b6dc59dddac9582e982d6cff1f72613107c735a149bb22b1c563
Opcode Fuzzy Hash: ec45aee28fcdd1506a55c9f23b8c1789f1320bca57fb1fdb60323ba7527438df
Instruction Fuzzy Hash: 61C1AD70E002599BDF20DFA4CC85BAEBBB9FF05304F144069E505BB281DB71AA49CB69

Function 00CEF810 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00CEF833
std::_Lockit::_Lockit.LIBCPMT ref: 00CEF855
std::_Lockit::~_Lockit.LIBCPMT ref: 00CEF875
std::_Lockit::~_Lockit.LIBCPMT ref: 00CEF89F
std::_Lockit::_Lockit.LIBCPMT ref: 00CEF90D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00CEF959
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00CEF973
std::_Lockit::~_Lockit.LIBCPMT ref: 00CEFA08
std::_Facet_Register.LIBCPMT ref: 00CEFA15

Strings

Ps, xrefs: 00CEF96B, 00CEF972
bad locale name, xrefs: 00CEFA2F

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$Ps
API String ID: 3375549084-1174896957
Opcode ID: 50aca5d8e0a943cccc04af196e5ea57104342bf54a07a5969f30efec043334dc
Instruction ID: 3ef994cfa2c6a89a20ca09bb098b2fe5953d2dd52ffe90dd0ece775fabd7e98c
Opcode Fuzzy Hash: 50aca5d8e0a943cccc04af196e5ea57104342bf54a07a5969f30efec043334dc
Instruction Fuzzy Hash: 9461B071E00248DBEF20DFA5D845B9EBBB4EF15310F140168E855A7381E775EA0ACBB2

Function 00C94490 Relevance: 17.7, APIs: 2, Strings: 8, Instructions: 225registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,A3A5ACA7,00000000,00020019,?), ref: 00C9452C
RegOpenKeyExA.ADVAPI32(80000002,A3A5ACA7,00000000,00020019,?), ref: 00C945AA

Strings

P^k}, xrefs: 00C9455E
jqth, xrefs: 00C944D1
jqth, xrefs: 00C94550
fxqv, xrefs: 00C94565
ynj, xrefs: 00C9457A
gI@U, xrefs: 00C9456C
wa]n, xrefs: 00C94573
nuAl, xrefs: 00C94549

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Open
String ID: P^k}$fxqv$gI@U$jqth$jqth$nuAl$wa]n$ynj
API String ID: 71445658-2554975206
Opcode ID: cf1f443227e82393ad9a490f4176eb8aab5f4bfb7230ea7248184110c543aacb
Instruction ID: 5727bae72f6cd684954155a53d50ba81d335556f73a2a692cab5d92c893c3ad1
Opcode Fuzzy Hash: cf1f443227e82393ad9a490f4176eb8aab5f4bfb7230ea7248184110c543aacb
Instruction Fuzzy Hash: 1A81D470D102489FDF18CFA8D888FEEBBB9EF0A304F14415DE451AB681E7719A06CB64

Function 00C839F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00C83A58
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00C83AA4
__Getctype.LIBCPMT ref: 00C83ABA
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00C83AE6
std::_Lockit::~_Lockit.LIBCPMT ref: 00C83B7B

Strings

bad locale name, xrefs: 00C83B96

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: 7b887546de465cc568effb5b9177bfc5ca704f881109cc57926d7ece8d7ceecf
Instruction ID: df710dc5247b410c007d8e4bbfe0da864faa8ad9e9d8753ed5c579dd4429e5d6
Opcode Fuzzy Hash: 7b887546de465cc568effb5b9177bfc5ca704f881109cc57926d7ece8d7ceecf
Instruction Fuzzy Hash: 04513EB1D002489BEF14EFA4D845B9EBBB8EF14714F144069EC19AB341E774DA08CBB6

Function 00C8B1A0 Relevance: 10.6, APIs: 7, Instructions: 133memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000001C), ref: 00C8B1F0
LocalAlloc.KERNEL32(00000040,0000001C,?,00000000,00000000), ref: 00C8B239
SetupDiGetDeviceInterfaceDetailA.SETUPAPI(?,00000000,00000000,00000000,?,00000000), ref: 00C8B26D
SetupDiGetDeviceInterfaceDetailA.SETUPAPI(?,?,00000000,?,00000000,00000000), ref: 00C8B28F
LocalFree.KERNEL32(?,?,?,?,?,00000000,?,00000000,00000000), ref: 00C8B2C0
LocalFree.KERNEL32(?,?,?,00000000,?,00000000,00000000), ref: 00C8B2C5
LocalFree.KERNEL32(?,?,?,00000000,?,00000000,00000000), ref: 00C8B2C8

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocDetailDeviceInterfaceSetup
String ID:
API String ID: 4232148138-0
Opcode ID: 1be4266767768ee3bde3f48abe87f71dd9d08b9e5258d04ae6162f8e0dd70064
Instruction ID: a6b79f666188690259766fbbe7db5af8d5ba5af3b921f1b21c6628749930d96b
Opcode Fuzzy Hash: 1be4266767768ee3bde3f48abe87f71dd9d08b9e5258d04ae6162f8e0dd70064
Instruction Fuzzy Hash: E0411CB1A40309AFDB20DFA9DC41BAEBBF8FB48700F10452AE559E7650E775A9008B60

Function 00D62E10 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00D62E47
___except_validate_context_record.LIBVCRUNTIME ref: 00D62E4F
_ValidateLocalCookies.LIBCMT ref: 00D62ED8
__IsNonwritableInCurrentImage.LIBCMT ref: 00D62F03
_ValidateLocalCookies.LIBCMT ref: 00D62F58

Strings

csm, xrefs: 00D62EED

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 4b6b57949ad549cf962e2a9d1f675ec8f00b14963bcfff0aa26b157b6d63c89a
Instruction ID: 85a90fbc94eaa3c380140dce98f43f06f1d894cc7c7fc7dd8c919735bcd24611
Opcode Fuzzy Hash: 4b6b57949ad549cf962e2a9d1f675ec8f00b14963bcfff0aa26b157b6d63c89a
Instruction Fuzzy Hash: 6541B530A00609AFCF10DF68C885AAEBBB5EF45324F188565F8149B352D732EE55CBB1

Function 00D6D513 Relevance: 9.3, APIs: 6, Instructions: 285COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00D6D69B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D6D6B7
__allrem.LIBCMT ref: 00D6D6CE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D6D6EC
__allrem.LIBCMT ref: 00D6D703
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D6D721

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 7222d4fbd83bf911f66e88245ad854337fd27cd591c1530f5d5dc897f2461532
Instruction ID: 186418f007775c9316ac0e4880f1ddd155ce762789001fdff7986d980427f0b0
Opcode Fuzzy Hash: 7222d4fbd83bf911f66e88245ad854337fd27cd591c1530f5d5dc897f2461532
Instruction Fuzzy Hash: 9A810B72F007169BD720AF68EC41B6A73EAEF55724F24462AF416DB6C1E770D90087B1

Function 00CEDE70 Relevance: 9.1, APIs: 6, Instructions: 104COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00CEDE93
std::_Lockit::_Lockit.LIBCPMT ref: 00CEDEB6
std::_Lockit::~_Lockit.LIBCPMT ref: 00CEDED6
std::_Facet_Register.LIBCPMT ref: 00CEDF4B
std::_Lockit::~_Lockit.LIBCPMT ref: 00CEDF63
Concurrency::cancel_current_task.LIBCPMT ref: 00CEDF7B

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: c7447da03327ee711e092243aa561e863a30a13acc69f50bf80ac5d4bc9807b0
Instruction ID: d565af55f19fa30ae6b357d1b28e64941ef2a54262dc4f3bcd13a758f90e15c5
Opcode Fuzzy Hash: c7447da03327ee711e092243aa561e863a30a13acc69f50bf80ac5d4bc9807b0
Instruction Fuzzy Hash: 2631A072900256DFCB24DF95D881AAEBBB4FB14720F184259E816AB351D730AE05CBF1

Function 00C8A750 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

\*.*, xrefs: 00C8A7E7

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID: \*.*
API String ID: 0-1173974218
Opcode ID: fdc42279b3d1eaa943a4849d233e9260e250a2d779c7e1007bb0273806ff31b7
Instruction ID: be83d613ecd9ed70cec412e6a1bed68b06d0ba23c8334bddbf6d51074f5ff674
Opcode Fuzzy Hash: fdc42279b3d1eaa943a4849d233e9260e250a2d779c7e1007bb0273806ff31b7
Instruction Fuzzy Hash: 91A1C470D002099FEF18EFA8C984BEEBBB5FF09314F14451AE415E7681E7709A85CB66

Function 00C84C50 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 345COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00C84F72
___std_exception_destroy.LIBVCRUNTIME ref: 00C84FFF

Strings

", ", xrefs: 00C84DCB
: ", xrefs: 00C84DA1

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: ", "$: "
API String ID: 4194217158-747220369
Opcode ID: 6b3b04dcb7efcd47760d1483b508eadea6d44ee3750bb771f6769cf9cba69c13
Instruction ID: 9bc3570b2e8fffce1121ac6e8f86a1c4fcb5800a254a033a28f1744fb4757335
Opcode Fuzzy Hash: 6b3b04dcb7efcd47760d1483b508eadea6d44ee3750bb771f6769cf9cba69c13
Instruction Fuzzy Hash: DCC111719002058FDB28EF68D885BAEFBF5FF48304F10492DE45297B81E774AA45CBA5

Function 00C87820 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00C8799A
___std_exception_copy.LIBVCRUNTIME ref: 00C87B75

Strings

out_of_range, xrefs: 00C87A27
type_error, xrefs: 00C8784A

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: out_of_range$type_error
API String ID: 2659868963-3702451861
Opcode ID: 9ef53ad06c950443b9773adc69d6bf222e3317c4f7b7c05e5f558f1877b9dc2e
Instruction ID: 69d8bbbece3f3a6a2991f0c25081958c9167f0d105b496b0d28e337f1100d483
Opcode Fuzzy Hash: 9ef53ad06c950443b9773adc69d6bf222e3317c4f7b7c05e5f558f1877b9dc2e
Instruction Fuzzy Hash: 7AC169B1D002088FDB08DFA8D984B9DBBF1FF49304F248669E459EB781E7749981CB64

Function 00C873B0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00C875BE
___std_exception_destroy.LIBVCRUNTIME ref: 00C875CD

Strings

, column , xrefs: 00C87434, 00C8744A
at line , xrefs: 00C873F7

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column
API String ID: 4194217158-191570568
Opcode ID: 4ef3a0dfe37e650ff0c3f2c380665328503e5deb84b62fb2a9b3569885f49dc9
Instruction ID: 230b43a06a08241ddc561d39c9651f1b4c463e482dd165e3d3715dad0a3ca613
Opcode Fuzzy Hash: 4ef3a0dfe37e650ff0c3f2c380665328503e5deb84b62fb2a9b3569885f49dc9
Instruction Fuzzy Hash: A0610671A042049FDB08DF68DC84BADBBB6FF45304F24862CE415A7781E774EA45CBA5

Function 00C8AF30 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000001), ref: 00C8AF8A
GetSystemMetrics.USER32(00000000), ref: 00C8AF90

Strings

d, xrefs: 00C8AF4B
image/png, xrefs: 00C8B063

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID: d$image/png
API String ID: 4116985748-2616758285
Opcode ID: 090adcca66f888eb0d91d82aeaf254aa99c286df7142aa781f0b2b07ceaca4c5
Instruction ID: 223b2b42d97762ea957c17bbb7758c8f029674552bf6618c2e0e9d5e11df6d95
Opcode Fuzzy Hash: 090adcca66f888eb0d91d82aeaf254aa99c286df7142aa781f0b2b07ceaca4c5
Instruction Fuzzy Hash: 8E516AB1508301AFE710EF24C894B6BBBE8EF99758F004D2DF99496250E771ED048BA6

Function 00C83D10 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00C83E7F

Strings

ios_base::failbit set, xrefs: 00C83D32
ios_base::badbit set, xrefs: 00C83E17
ios_base::eofbit set, xrefs: 00C83E41, 00C83E63

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: a8c073f073d36d16ae3b21695f44aa8104ac79891f212ac1e36af602db4d9581
Instruction ID: 73da7404add71a7da6ecee64fa33ffa6c5a37a5591358b9ade23284bb3c00b24
Opcode Fuzzy Hash: a8c073f073d36d16ae3b21695f44aa8104ac79891f212ac1e36af602db4d9581
Instruction Fuzzy Hash: 9641B3B6900244AFCB04EF68C845BAEBBF8EF49710F14852AF915D7741E774AA058BB4

Function 00C83DE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00C83E7F

Strings

ios_base::failbit set, xrefs: 00C83D32, 00C83E1E
ios_base::badbit set, xrefs: 00C83E17
ios_base::eofbit set, xrefs: 00C83E28, 00C83E41, 00C83E63

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: 139cfc809a133d20e7b44b70d25987a80059bab29badf2c88ef08798dac47611
Instruction ID: 55d58fc835d0cce220c2b6462432b68da281407da244dc47de25480e214243e0
Opcode Fuzzy Hash: 139cfc809a133d20e7b44b70d25987a80059bab29badf2c88ef08798dac47611
Instruction Fuzzy Hash: 75210AB29003446FC714EF58D805B9AB7DCAB05710F18882EFA68CB741E774EA14CBB5

Function 00C86F40 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 349COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00C87340

Strings

parse error, xrefs: 00C86FFF, 00C87018
parse_error, xrefs: 00C86F8B

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: parse error$parse_error
API String ID: 2659868963-1820534363
Opcode ID: 747a3af68da61219ee04f08d983e080f81004126f039f9830e2247d7a1f17a04
Instruction ID: 63f71cdbc3fd2beefa786148d0386b5140d7351fb3f3bcf85a2e71c3c7c35049
Opcode Fuzzy Hash: 747a3af68da61219ee04f08d983e080f81004126f039f9830e2247d7a1f17a04
Instruction Fuzzy Hash: 0AE171719042089FDB18DF68C884B9DBBB1FF49304F24826DE418EB792E7749A85CF65

Function 00C86C60 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00C86F11
___std_exception_destroy.LIBVCRUNTIME ref: 00C86F20

Strings

[json.exception., xrefs: 00C86CB8

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.
API String ID: 4194217158-791563284
Opcode ID: 4ea2b813ef483c65fba35cc990d17222b27c2ba4384303260d97183c20f4848b
Instruction ID: b919c22a329b21339da1b15ab17e8454e278dc35490913ca1fc68df2218ff393
Opcode Fuzzy Hash: 4ea2b813ef483c65fba35cc990d17222b27c2ba4384303260d97183c20f4848b
Instruction Fuzzy Hash: 8A91E570A002089FDB18DF68D884B9EFBF2FF45304F20856DE455AB792D771A945CB64

Function 00CFA520 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 234COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00CFA656

Strings

unexpected , xrefs: 00CFA531
pected , xrefs: 00CFA564

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: pected $unexpected
API String ID: 118556049-356062554
Opcode ID: a488096d346ddb20ad401a233e08d86b5c368dbbab1f4f7ebdf35b9828553d39
Instruction ID: 1ceb8bf5441611bbe01fac5b96c64f3fe8856f61cab15076f87b3d81bdb5f8ad
Opcode Fuzzy Hash: a488096d346ddb20ad401a233e08d86b5c368dbbab1f4f7ebdf35b9828553d39
Instruction Fuzzy Hash: 7D5138B25001049FDB18EF28D884A6EF7A5EF45310F244629F95ACB685EB30ED4587E2

Function 00CF8F90 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00CF9753
___std_exception_destroy.LIBVCRUNTIME ref: 00CF976C
___std_exception_destroy.LIBVCRUNTIME ref: 00CFA374
___std_exception_destroy.LIBVCRUNTIME ref: 00CFA38D

Strings

value, xrefs: 00CFA2A1

Memory Dump Source

Source File: 00000006.00000002.3274459385.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000006.00000002.3274421235.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274459385.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274747118.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274787908.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274824954.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274870934.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274908865.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3274949610.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275167205.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275202639.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275252484.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275289755.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275315588.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275396064.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275440170.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275477222.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275518793.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275558947.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275597466.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275635918.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275673753.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275712354.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275744131.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275796289.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275822077.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275960354.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3275995343.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276033619.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276123612.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3276162633.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: value
API String ID: 4194217158-494360628
Opcode ID: 8d77fc14e33f24f56b2e6da112be02ee6d332f1162637975d1e3335071f6a931
Instruction ID: c8449a5f97534e189af6baa8db876fd081fa7f7be96d1479ba0ec7e93def0638
Opcode Fuzzy Hash: 8d77fc14e33f24f56b2e6da112be02ee6d332f1162637975d1e3335071f6a931
Instruction Fuzzy Hash: 02519EB0D0025C9FDB14DFA8DC88BEEBBB8AF05300F144169E549A7792D7749A48DB62

Analysis Process: MPGPH131.exePID: 7120, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	867
Total number of Limit Nodes:	110

Executed Functions

Function 00C95B90 Relevance: 58.4, APIs: 5, Strings: 27, Instructions: 2429COMMON

Download Yara Rule

Strings

*, xrefs: 00C97A17
e`vf, xrefs: 00C96E07
\, xrefs: 00C969E5
$*`', xrefs: 00C97521
RM[#, xrefs: 00C96CFA
'[_+, xrefs: 00C9752B
s@, xrefs: 00C95C1A
OFMM, xrefs: 00C97423
ec`v, xrefs: 00C96661
131, xrefs: 00C96037, 00C9603E, 00C96044, 00C960BA, 00C960C1, 00C960C7, 00C9613A, 00C96141, 00C96147
$*`', xrefs: 00C96E11
DH][, xrefs: 00C97438
+wj', xrefs: 00C96D04
bqZP, xrefs: 00C9664C
., xrefs: 00C96E25
., xrefs: 00C97535
(ACL, xrefs: 00C97431
@@MC, xrefs: 00C96D0E
agnd, xrefs: 00C96653
rnql, xrefs: 00C96642
e`vf, xrefs: 00C97517
{~RL, xrefs: 00C9665A
'[_+, xrefs: 00C96E1B
IMG, xrefs: 00C96789
I^Z, xrefs: 00C97AFE, 00C97B2E
D, xrefs: 00C95BCD
$*tk, xrefs: 00C9742A

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID: $*`'$$*`'$$*tk$'[_+$'[_+$(ACL$*$+wj'$.$.$131$@@MC$D$DH][$IMG$I^Z$OFMM$RM[#$\$agnd$bqZP$e`vf$e`vf$ec`v$rnql$s@${~RL
API String ID: 0-2086103761
Opcode ID: 797bab5bcf4449d6a80da5ff613a7ae359b6872d6c7f627d2ebfd14d4f60b2e0
Instruction ID: 6074abde83fad7582ab42fbcff4ce11b0dea10bd177146974dccc9b2c12728b0
Opcode Fuzzy Hash: 797bab5bcf4449d6a80da5ff613a7ae359b6872d6c7f627d2ebfd14d4f60b2e0
Instruction Fuzzy Hash: 54238E709042588FDF19CF68C888BEDBBB5FF49304F1442D9D449AB282E7759A85CFA1

Function 00C97DC0 Relevance: 56.6, APIs: 7, Strings: 24, Instructions: 2344COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,00000104,?,?,?), ref: 00C98006
GetFileAttributesA.KERNELBASE(?,00000001,?,?,?,?), ref: 00C9815D
__Mtx_unlock.LIBCPMT ref: 00C98186
__Mtx_unlock.LIBCPMT ref: 00C98195
GetFileAttributesA.KERNELBASE(?,00000001,?,?,?,?,?,?), ref: 00C98751
__Mtx_unlock.LIBCPMT ref: 00C9877A

Part of subcall function 00CF06C0: Concurrency::cancel_current_task.LIBCPMT ref: 00CF0807

__Mtx_unlock.LIBCPMT ref: 00C987D7

Strings

'[_+., xrefs: 00C997B9, 00C997E9
e`vf, xrefs: 00C99337
e`vf, xrefs: 00C98C28
$*`', xrefs: 00C99341
rnql, xrefs: 00C9846F
(ACL, xrefs: 00C9923A
\, xrefs: 00C98896
bqZP, xrefs: 00C98479
ec`v, xrefs: 00C98497
{~RL, xrefs: 00C9848D
$*`', xrefs: 00C98C32
+wj', xrefs: 00C98B30
DH][, xrefs: 00C99244
@@MC, xrefs: 00C98B3A
$*tk, xrefs: 00C99230
OFMM, xrefs: 00C99226
RM[#, xrefs: 00C98B26
., xrefs: 00C99355
'[_+, xrefs: 00C9934B
agnd, xrefs: 00C98483
131, xrefs: 00C97E37, 00C97E3E, 00C97E44, 00C97EB2, 00C97EB9, 00C97EBF, 00C97F2A, 00C97F31, 00C97F37, 00C99A45, 00C99A4C, 00C99A52
I^Z, xrefs: 00C998C4, 00C998F4
+, xrefs: 00C99B19
IMG, xrefs: 00C98601

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$AttributesFile$Concurrency::cancel_current_taskNameUser
String ID: $*`'$$*`'$$*tk$'[_+$'[_+.$(ACL$+$+wj'$.$131$@@MC$DH][$IMG$I^Z$OFMM$RM[#$\$agnd$bqZP$e`vf$e`vf$ec`v$rnql${~RL
API String ID: 2365767635-4150374978
Opcode ID: bad78ee63fdd2dae872a82d9d1b9b9a2dc053144d1bb35f2754b1d393654d616
Instruction ID: 5a6b712cf549e1edfbb1d9d06426f20c286af3ace608c483757efb8bb35a57e1
Opcode Fuzzy Hash: bad78ee63fdd2dae872a82d9d1b9b9a2dc053144d1bb35f2754b1d393654d616
Instruction Fuzzy Hash: FC235C709002598FDF28CF68C898BEDBBB5EF45304F1481EDD419AB282E7759A85CF61

Function 00C8B6A0 Relevance: 23.6, APIs: 5, Strings: 8, Instructions: 840
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,A3B0BAA7,00000000,00020019,00000000,999D9BA1,999D9BA2), ref: 00C8B947

Strings

bqZD, xrefs: 00C8B905
_, xrefs: 00C8BAC6
cj|n, xrefs: 00C8B913
`yk, xrefs: 00C8BEE0, 00C8BF0A
:, xrefs: 00C8B443
_, xrefs: 00C8BB25
rnql, xrefs: 00C8B8FE
_, xrefs: 00C8BB32

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Open
String ID: :$_$_$_$`yk$bqZD$cj|n$rnql
API String ID: 71445658-3798079816
Opcode ID: 359b8c0e3a2dee1716f3e49c4354f3a7f0470a8283328f5ef6bee0bbd0faf870
Instruction ID: 7092774ec5ef9f5af39a22e93606da422082d207bc54ee4bc9b5e3e6852ffb3e
Opcode Fuzzy Hash: 359b8c0e3a2dee1716f3e49c4354f3a7f0470a8283328f5ef6bee0bbd0faf870
Instruction Fuzzy Hash: 2572C170D002599FDB18DF68CC84BEEBBB5EF05304F1481ADE419AB282E7759A85CF64

Function 00C9E0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00C9E0CB
socket.WS2_32(?,?,?,?,?,?,00DB7320,?,?,?,?,?,?), ref: 00C9E17F
connect.WS2_32(00000000,?,00000000,?,?,?,00DB7320,?,?,?,?,?,?), ref: 00C9E193
closesocket.WS2_32(00000000), ref: 00C9E19E

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: 09500071b46c38ba84df7744c0710e12904fe07718646696b4cacc084e012d31
Instruction ID: e4d46504de4359328365c42ee96d990829165e44489f5756bedc2c9f11439db1
Opcode Fuzzy Hash: 09500071b46c38ba84df7744c0710e12904fe07718646696b4cacc084e012d31
Instruction Fuzzy Hash: 5B31B071604301ABDB20DF29CC89B2FB7E4EB85728F055F1DF9B8962E1D33199048B92

Function 00C8A690 Relevance: 4.6, APIs: 3, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE ref: 00C8A6BF
__Mtx_unlock.LIBCPMT ref: 00C8A6EE
__Mtx_unlock.LIBCPMT ref: 00C8A733

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$AttributesFile
String ID:
API String ID: 1886074773-0
Opcode ID: 2ecc5c89a1039dedb13cd57fc0dd2b214ece9a12aa83555921f993490db8c6a3
Instruction ID: a8bbe8384f531e7cc673e4b1d7a207f19a941a940096da92d8b16abf19290714
Opcode Fuzzy Hash: 2ecc5c89a1039dedb13cd57fc0dd2b214ece9a12aa83555921f993490db8c6a3
Instruction Fuzzy Hash: FC01C491A45121276D3831742C565FB2A08C99236E72C4923FC26C624AF543DF5953F7

Function 00C8A090 Relevance: 3.3, APIs: 2, Instructions: 342
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 00C8A1B6
__fread_nolock.LIBCMT ref: 00C8A343

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: d93b8a568f0d902c7579028841f9226c1c9d4c47f30e711a99ed992e4ac7910f
Instruction ID: 357f43838dbe4ff4e8df23a315acf07f7d003f018380900886b5de7a9b99c537
Opcode Fuzzy Hash: d93b8a568f0d902c7579028841f9226c1c9d4c47f30e711a99ed992e4ac7910f
Instruction Fuzzy Hash: D3B13870900204AFEB18EF68CC49B9EBBE8EF41704F10856EF4159B682D7B5DA41C7B6

Function 00D74623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 504525e84e11b37361db5a06691853825d85a9a145642f7e6b4e2a5bdef05f9f
Instruction ID: f718eeb3373f33a64ff500eb1515fd1b8f82967b8db6d075dcd7c7abc0d46b5f
Opcode Fuzzy Hash: 504525e84e11b37361db5a06691853825d85a9a145642f7e6b4e2a5bdef05f9f
Instruction Fuzzy Hash: 19B1F370E042499FDB12DFA8D850BBEBBB5EF4A310F188259E5489B386E770D941CB71

Function 00D7549C Relevance: 1.7, APIs: 1, Instructions: 198
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000000,00D69087,?,00000000,00000000,00000000,?,00000000,?,00D5E5B1,00D69087,00000000,00D5E5B1,?,?), ref: 00D75622

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: eeaf799d3d2d470bf4b92d67812f719ceed6ff32afecb3bebbca388263abf25c
Instruction ID: 756c76e5492da6ea3a663e24d9fcc72df9bcd72e379b140dedbbc76cb0b83e68
Opcode Fuzzy Hash: eeaf799d3d2d470bf4b92d67812f719ceed6ff32afecb3bebbca388263abf25c
Instruction Fuzzy Hash: 8761B471D04519AFDF11DFA8D844EAEBFBAEF09304F588149E808A7249E3B1D911CBB1

Function 00D64942 Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60a601dee669c779e4ae3485be377ebd20708f620ee71672446dfd1c57c25fe9
Instruction ID: e6e4706b9181af81373053f14856c5beacf54a2098d9cc7f34cf042d9c9029f8
Opcode Fuzzy Hash: 60a601dee669c779e4ae3485be377ebd20708f620ee71672446dfd1c57c25fe9
Instruction Fuzzy Hash: 8F519570A40208FFDB14CF98CC85AAABFA5EF45358F288159F8499B252D371DE41CBB4

Function 00CF0560 Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00CF06AE

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 704878a6fb962aec51445f9c7907984ce5d7d965d91800b1a8fb89f3cbd27ced
Instruction ID: 24996bce6b0c376f712f9fd696192d67e59c53d909396b112f32447166f5b2da
Opcode Fuzzy Hash: 704878a6fb962aec51445f9c7907984ce5d7d965d91800b1a8fb89f3cbd27ced
Instruction Fuzzy Hash: 974103B2A001189FCB05EF68DD806AE7BA5EF88710F240169FD15DB302D770DE618BE6

Function 00D74B12 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,00D749F9,00000000,CF830579,00DB1140,0000000C,00D74AB5,00D68BBD,?), ref: 00D74B69

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 4b0c4aee87baa356cc433ab46a6e218f0bcf95e010a2a98846fbec89aa2b4a1c
Instruction ID: ad6e07fc678897603022a7b2b8f5fafa5bcaed3622625d5698b4e0b702f567fd
Opcode Fuzzy Hash: 4b0c4aee87baa356cc433ab46a6e218f0bcf95e010a2a98846fbec89aa2b4a1c
Instruction Fuzzy Hash: C4112B3374512496CB2762386851B7E6B4ACBC2774F2D8649F91C8B1C2FF61DC415175

Function 00D6E05C Relevance: 1.6, APIs: 1, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00DB0DF8,00D5E5B1,00000002,00D5E5B1,00000000,?,?,?,00D6E166,00000000,?,00D5E5B1,00000002,00DB0DF8), ref: 00D6E099

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: c836ad457f19a93433b81109490f4d8cb0e451b680b341689c2257422c1c4abd
Instruction ID: ab4bd61add9e1f0ad53d0e52cedbe4f01f02c16f6121d74443dc82eae8d7a8b1
Opcode Fuzzy Hash: c836ad457f19a93433b81109490f4d8cb0e451b680b341689c2257422c1c4abd
Instruction Fuzzy Hash: C4012636614119ABCF05CF18CC05D9F3B29DB85334B280248F8509B2D1E6B2E9418BE0

Function 00D5F290 Relevance: 1.6, APIs: 1, Instructions: 51
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00C8220E

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: bd7e0067bb086f80b45c316382e84229741abfaa6cebb2a58e32a7dd70dcbfa1
Instruction ID: 49382ebe8555f9d9a28bb771575809a44b212f4de84fc74aac5abd35b1fc817d
Opcode Fuzzy Hash: bd7e0067bb086f80b45c316382e84229741abfaa6cebb2a58e32a7dd70dcbfa1
Instruction Fuzzy Hash: 62012B7550030DABCF14AF98E80689A7BECDE00310F548439FE58DB651EB70E95887B4

Function 00D763F3 Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,00D5D6FA,00000004,?,00D75D79,00000001,00000364,00000004,00000007,000000FF,?,00D6067B,00000002,00000000,?,?), ref: 00D76435

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 661dc90baa2b4d4cf212762d72955450e5625bbffe3dbfea14ebb7e7313a7326
Instruction ID: 35a9104accdea12d11846daad00bf4471e56c992a9785763268bb574d9fa4a03
Opcode Fuzzy Hash: 661dc90baa2b4d4cf212762d72955450e5625bbffe3dbfea14ebb7e7313a7326
Instruction Fuzzy Hash: EBF08931509A24AA9B216F669C06B5B7F59EF857A8F19C151EC0CD6180FA30DC1146F1

Function 00D76E2D Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000004,00000000,?,00D6067B,00000002,00000000,?,?,?,00C8303D,00D5D6FA,00000004,00000000,00D5D6FA), ref: 00D76E60

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a6edab15feecfbe3c71950329d55e6ca3e00e202441c8cc23d1798afd2431108
Instruction ID: a02d04c490be3df7b24a8319bb64dd5532941e8202eb1eb86c978aa3d66ed7b0
Opcode Fuzzy Hash: a6edab15feecfbe3c71950329d55e6ca3e00e202441c8cc23d1798afd2431108
Instruction Fuzzy Hash: B6E06D39541E25AADB312665DD02B6B7A59DF827A0F19C621FD8DA61D1FB20C81081B8

Non-executed Functions

Function 00D03F80 Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 263libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,BF989CA3), ref: 00D040CC
GetProcAddress.KERNEL32(00000000,BF989CA3), ref: 00D04116
GetProcAddress.KERNEL32(00000000,BF989CA3), ref: 00D0414E
GetProcAddress.KERNEL32(00000000,BF989CA3), ref: 00D04196
GetProcAddress.KERNEL32(00000000,BF989CA3), ref: 00D041E9

Strings

vdPf, xrefs: 00D04249
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36, xrefs: 00D04037
D`vb, xrefs: 00D041B4
pv, xrefs: 00D0431D
mdmv, xrefs: 00D04316

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID: D`vb$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36$mdmv$pv$vdPf
API String ID: 190572456-2376812635
Opcode ID: af02dd27d7e203fba13a79666ec35e18d1c8db0af66695087ce20416ecb70d23
Instruction ID: e1c8aa4ae9ab6b238eaa613089e194f1041ce010eb3657215c034ea974c785b7
Opcode Fuzzy Hash: af02dd27d7e203fba13a79666ec35e18d1c8db0af66695087ce20416ecb70d23
Instruction Fuzzy Hash: FCC109B0818388DEDB44DFA8E484BEDBFF4EF19704F50406ED845AB682D3755509CBA9

Function 00C8D8B9 Relevance: 26.6, APIs: 2, Strings: 13, Instructions: 377COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32(00000000,00000128), ref: 00C8DAB0
Process32Next.KERNEL32(00000000,?), ref: 00C8DAF8

Strings

?, xrefs: 00C8DCB9
EIJ, xrefs: 00C8DBD9
rnql, xrefs: 00C8DB7F
{~RL, xrefs: 00C8DB9D
rAKq, xrefs: 00C8DBC5
jjst, xrefs: 00C8DBBB
agnd, xrefs: 00C8DB93
IOQW, xrefs: 00C8DBCF
za@r, xrefs: 00C8DBB1
oo, xrefs: 00C8DD34
bqZP, xrefs: 00C8DB89
d;"&, xrefs: 00C8D957
ec`v, xrefs: 00C8DBA7

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: NextProcess32
String ID: ?$EIJ$IOQW$agnd$bqZP$d;"&$ec`v$jjst$oo$rAKq$rnql$za@r${~RL
API String ID: 1850201408-2823651170
Opcode ID: 3acc94521c997f9f65eafd7b6aab4ec47b31df97a76cb3a5a9c5d31b6a6df8b9
Instruction ID: ab1f8e914c948c29fd2af99689fad170486cbf06328e714452afce3204da85f4
Opcode Fuzzy Hash: 3acc94521c997f9f65eafd7b6aab4ec47b31df97a76cb3a5a9c5d31b6a6df8b9
Instruction Fuzzy Hash: C1F14CB1D1122C9AEF24EB90CC45BEEB7B8EF15304F4005D9E509A7282EB705B89DF65

Function 00C88D70 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(9B92819A,?,?,00DB56BC), ref: 00C88E0E
GetProcAddress.KERNEL32(00000000,82B281BA), ref: 00C88E1B
GetModuleHandleA.KERNEL32(9B92819A), ref: 00C88E85
GetProcAddress.KERNEL32(00000000,82A781BA), ref: 00C88E8C
CloseHandle.KERNEL32(00000000), ref: 00C89092
CloseHandle.KERNEL32(00000000), ref: 00C890F4
CloseHandle.KERNEL32(00000000), ref: 00C89121

Strings

l, xrefs: 00C88FB0
lwcf, xrefs: 00C88FA9
File, xrefs: 00C88F73
bkg`, xrefs: 00C88DB7
t, xrefs: 00C88E37
p, xrefs: 00C88DBE
eHlW, xrefs: 00C88FA2

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Handle$Close$AddressModuleProc
String ID: File$bkg`$eHlW$l$lwcf$p$t
API String ID: 4110381430-3184506882
Opcode ID: ec45aee28fcdd1506a55c9f23b8c1789f1320bca57fb1fdb60323ba7527438df
Instruction ID: f109a43b7b14b6dc59dddac9582e982d6cff1f72613107c735a149bb22b1c563
Opcode Fuzzy Hash: ec45aee28fcdd1506a55c9f23b8c1789f1320bca57fb1fdb60323ba7527438df
Instruction Fuzzy Hash: 61C1AD70E002599BDF20DFA4CC85BAEBBB9FF05304F144069E505BB281DB71AA49CB69

Function 00CEF810 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00CEF833
std::_Lockit::_Lockit.LIBCPMT ref: 00CEF855
std::_Lockit::~_Lockit.LIBCPMT ref: 00CEF875
std::_Lockit::~_Lockit.LIBCPMT ref: 00CEF89F
std::_Lockit::_Lockit.LIBCPMT ref: 00CEF90D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00CEF959
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00CEF973
std::_Lockit::~_Lockit.LIBCPMT ref: 00CEFA08
std::_Facet_Register.LIBCPMT ref: 00CEFA15

Strings

bad locale name, xrefs: 00CEFA2F
Ps, xrefs: 00CEF96B, 00CEF972

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$Ps
API String ID: 3375549084-1174896957
Opcode ID: 50aca5d8e0a943cccc04af196e5ea57104342bf54a07a5969f30efec043334dc
Instruction ID: 3ef994cfa2c6a89a20ca09bb098b2fe5953d2dd52ffe90dd0ece775fabd7e98c
Opcode Fuzzy Hash: 50aca5d8e0a943cccc04af196e5ea57104342bf54a07a5969f30efec043334dc
Instruction Fuzzy Hash: 9461B071E00248DBEF20DFA5D845B9EBBB4EF15310F140168E855A7381E775EA0ACBB2

Function 00C94490 Relevance: 17.7, APIs: 2, Strings: 8, Instructions: 225registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,A3A5ACA7,00000000,00020019,?), ref: 00C9452C
RegOpenKeyExA.ADVAPI32(80000002,A3A5ACA7,00000000,00020019,?), ref: 00C945AA

Strings

P^k}, xrefs: 00C9455E
jqth, xrefs: 00C94550
jqth, xrefs: 00C944D1
ynj, xrefs: 00C9457A
fxqv, xrefs: 00C94565
gI@U, xrefs: 00C9456C
nuAl, xrefs: 00C94549
wa]n, xrefs: 00C94573

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Open
String ID: P^k}$fxqv$gI@U$jqth$jqth$nuAl$wa]n$ynj
API String ID: 71445658-2554975206
Opcode ID: cf1f443227e82393ad9a490f4176eb8aab5f4bfb7230ea7248184110c543aacb
Instruction ID: 5727bae72f6cd684954155a53d50ba81d335556f73a2a692cab5d92c893c3ad1
Opcode Fuzzy Hash: cf1f443227e82393ad9a490f4176eb8aab5f4bfb7230ea7248184110c543aacb
Instruction Fuzzy Hash: 1A81D470D102489FDF18CFA8D888FEEBBB9EF0A304F14415DE451AB681E7719A06CB64

Function 00C839F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00C83A58
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00C83AA4
__Getctype.LIBCPMT ref: 00C83ABA
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00C83AE6
std::_Lockit::~_Lockit.LIBCPMT ref: 00C83B7B

Strings

bad locale name, xrefs: 00C83B96

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: 7b887546de465cc568effb5b9177bfc5ca704f881109cc57926d7ece8d7ceecf
Instruction ID: df710dc5247b410c007d8e4bbfe0da864faa8ad9e9d8753ed5c579dd4429e5d6
Opcode Fuzzy Hash: 7b887546de465cc568effb5b9177bfc5ca704f881109cc57926d7ece8d7ceecf
Instruction Fuzzy Hash: 04513EB1D002489BEF14EFA4D845B9EBBB8EF14714F144069EC19AB341E774DA08CBB6

Function 00C8B1A0 Relevance: 10.6, APIs: 7, Instructions: 133memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000001C), ref: 00C8B1F0
LocalAlloc.KERNEL32(00000040,0000001C,?,00000000,00000000), ref: 00C8B239
SetupDiGetDeviceInterfaceDetailA.SETUPAPI(?,00000000,00000000,00000000,?,00000000), ref: 00C8B26D
SetupDiGetDeviceInterfaceDetailA.SETUPAPI(?,?,00000000,?,00000000,00000000), ref: 00C8B28F
LocalFree.KERNEL32(?,?,?,?,?,00000000,?,00000000,00000000), ref: 00C8B2C0
LocalFree.KERNEL32(?,?,?,00000000,?,00000000,00000000), ref: 00C8B2C5
LocalFree.KERNEL32(?,?,?,00000000,?,00000000,00000000), ref: 00C8B2C8

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocDetailDeviceInterfaceSetup
String ID:
API String ID: 4232148138-0
Opcode ID: 1be4266767768ee3bde3f48abe87f71dd9d08b9e5258d04ae6162f8e0dd70064
Instruction ID: a6b79f666188690259766fbbe7db5af8d5ba5af3b921f1b21c6628749930d96b
Opcode Fuzzy Hash: 1be4266767768ee3bde3f48abe87f71dd9d08b9e5258d04ae6162f8e0dd70064
Instruction Fuzzy Hash: E0411CB1A40309AFDB20DFA9DC41BAEBBF8FB48700F10452AE559E7650E775A9008B60

Function 00D62E10 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00D62E47
___except_validate_context_record.LIBVCRUNTIME ref: 00D62E4F
_ValidateLocalCookies.LIBCMT ref: 00D62ED8
__IsNonwritableInCurrentImage.LIBCMT ref: 00D62F03
_ValidateLocalCookies.LIBCMT ref: 00D62F58

Strings

csm, xrefs: 00D62EED

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 4b6b57949ad549cf962e2a9d1f675ec8f00b14963bcfff0aa26b157b6d63c89a
Instruction ID: 85a90fbc94eaa3c380140dce98f43f06f1d894cc7c7fc7dd8c919735bcd24611
Opcode Fuzzy Hash: 4b6b57949ad549cf962e2a9d1f675ec8f00b14963bcfff0aa26b157b6d63c89a
Instruction Fuzzy Hash: 6541B530A00609AFCF10DF68C885AAEBBB5EF45324F188565F8149B352D732EE55CBB1

Function 00D6D513 Relevance: 9.3, APIs: 6, Instructions: 285COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00D6D69B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D6D6B7
__allrem.LIBCMT ref: 00D6D6CE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D6D6EC
__allrem.LIBCMT ref: 00D6D703
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D6D721

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 7222d4fbd83bf911f66e88245ad854337fd27cd591c1530f5d5dc897f2461532
Instruction ID: 186418f007775c9316ac0e4880f1ddd155ce762789001fdff7986d980427f0b0
Opcode Fuzzy Hash: 7222d4fbd83bf911f66e88245ad854337fd27cd591c1530f5d5dc897f2461532
Instruction Fuzzy Hash: 9A810B72F007169BD720AF68EC41B6A73EAEF55724F24462AF416DB6C1E770D90087B1

Function 00CEDE70 Relevance: 9.1, APIs: 6, Instructions: 104COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00CEDE93
std::_Lockit::_Lockit.LIBCPMT ref: 00CEDEB6
std::_Lockit::~_Lockit.LIBCPMT ref: 00CEDED6
std::_Facet_Register.LIBCPMT ref: 00CEDF4B
std::_Lockit::~_Lockit.LIBCPMT ref: 00CEDF63
Concurrency::cancel_current_task.LIBCPMT ref: 00CEDF7B

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: c7447da03327ee711e092243aa561e863a30a13acc69f50bf80ac5d4bc9807b0
Instruction ID: d565af55f19fa30ae6b357d1b28e64941ef2a54262dc4f3bcd13a758f90e15c5
Opcode Fuzzy Hash: c7447da03327ee711e092243aa561e863a30a13acc69f50bf80ac5d4bc9807b0
Instruction Fuzzy Hash: 2631A072900256DFCB24DF95D881AAEBBB4FB14720F184259E816AB351D730AE05CBF1

Function 00C8A750 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

\*.*, xrefs: 00C8A7E7

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID: \*.*
API String ID: 0-1173974218
Opcode ID: fdc42279b3d1eaa943a4849d233e9260e250a2d779c7e1007bb0273806ff31b7
Instruction ID: be83d613ecd9ed70cec412e6a1bed68b06d0ba23c8334bddbf6d51074f5ff674
Opcode Fuzzy Hash: fdc42279b3d1eaa943a4849d233e9260e250a2d779c7e1007bb0273806ff31b7
Instruction Fuzzy Hash: 91A1C470D002099FEF18EFA8C984BEEBBB5FF09314F14451AE415E7681E7709A85CB66

Function 00C84C50 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 345COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00C84F72
___std_exception_destroy.LIBVCRUNTIME ref: 00C84FFF

Strings

: ", xrefs: 00C84DA1
", ", xrefs: 00C84DCB

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: ", "$: "
API String ID: 4194217158-747220369
Opcode ID: 6b3b04dcb7efcd47760d1483b508eadea6d44ee3750bb771f6769cf9cba69c13
Instruction ID: 9bc3570b2e8fffce1121ac6e8f86a1c4fcb5800a254a033a28f1744fb4757335
Opcode Fuzzy Hash: 6b3b04dcb7efcd47760d1483b508eadea6d44ee3750bb771f6769cf9cba69c13
Instruction Fuzzy Hash: DCC111719002058FDB28EF68D885BAEFBF5FF48304F10492DE45297B81E774AA45CBA5

Function 00C87820 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00C8799A
___std_exception_copy.LIBVCRUNTIME ref: 00C87B75

Strings

type_error, xrefs: 00C8784A
out_of_range, xrefs: 00C87A27

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: out_of_range$type_error
API String ID: 2659868963-3702451861
Opcode ID: 9ef53ad06c950443b9773adc69d6bf222e3317c4f7b7c05e5f558f1877b9dc2e
Instruction ID: 69d8bbbece3f3a6a2991f0c25081958c9167f0d105b496b0d28e337f1100d483
Opcode Fuzzy Hash: 9ef53ad06c950443b9773adc69d6bf222e3317c4f7b7c05e5f558f1877b9dc2e
Instruction Fuzzy Hash: 7AC169B1D002088FDB08DFA8D984B9DBBF1FF49304F248669E459EB781E7749981CB64

Function 00C873B0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00C875BE
___std_exception_destroy.LIBVCRUNTIME ref: 00C875CD

Strings

, column , xrefs: 00C87434, 00C8744A
at line , xrefs: 00C873F7

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column
API String ID: 4194217158-191570568
Opcode ID: 4ef3a0dfe37e650ff0c3f2c380665328503e5deb84b62fb2a9b3569885f49dc9
Instruction ID: 230b43a06a08241ddc561d39c9651f1b4c463e482dd165e3d3715dad0a3ca613
Opcode Fuzzy Hash: 4ef3a0dfe37e650ff0c3f2c380665328503e5deb84b62fb2a9b3569885f49dc9
Instruction Fuzzy Hash: A0610671A042049FDB08DF68DC84BADBBB6FF45304F24862CE415A7781E774EA45CBA5

Function 00C8AF30 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000001), ref: 00C8AF8A
GetSystemMetrics.USER32(00000000), ref: 00C8AF90

Strings

image/png, xrefs: 00C8B063
d, xrefs: 00C8AF4B

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID: d$image/png
API String ID: 4116985748-2616758285
Opcode ID: 090adcca66f888eb0d91d82aeaf254aa99c286df7142aa781f0b2b07ceaca4c5
Instruction ID: 223b2b42d97762ea957c17bbb7758c8f029674552bf6618c2e0e9d5e11df6d95
Opcode Fuzzy Hash: 090adcca66f888eb0d91d82aeaf254aa99c286df7142aa781f0b2b07ceaca4c5
Instruction Fuzzy Hash: 8E516AB1508301AFE710EF24C894B6BBBE8EF99758F004D2DF99496250E771ED048BA6

Function 00C83D10 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00C83E7F

Strings

ios_base::badbit set, xrefs: 00C83E17
ios_base::eofbit set, xrefs: 00C83E41, 00C83E63
ios_base::failbit set, xrefs: 00C83D32

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: a8c073f073d36d16ae3b21695f44aa8104ac79891f212ac1e36af602db4d9581
Instruction ID: 73da7404add71a7da6ecee64fa33ffa6c5a37a5591358b9ade23284bb3c00b24
Opcode Fuzzy Hash: a8c073f073d36d16ae3b21695f44aa8104ac79891f212ac1e36af602db4d9581
Instruction Fuzzy Hash: 9641B3B6900244AFCB04EF68C845BAEBBF8EF49710F14852AF915D7741E774AA058BB4

Function 00C83DE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00C83E7F

Strings

ios_base::badbit set, xrefs: 00C83E17
ios_base::eofbit set, xrefs: 00C83E28, 00C83E41, 00C83E63
ios_base::failbit set, xrefs: 00C83D32, 00C83E1E

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: 139cfc809a133d20e7b44b70d25987a80059bab29badf2c88ef08798dac47611
Instruction ID: 55d58fc835d0cce220c2b6462432b68da281407da244dc47de25480e214243e0
Opcode Fuzzy Hash: 139cfc809a133d20e7b44b70d25987a80059bab29badf2c88ef08798dac47611
Instruction Fuzzy Hash: 75210AB29003446FC714EF58D805B9AB7DCAB05710F18882EFA68CB741E774EA14CBB5

Function 00C93AA0 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 383COMMON

Download Yara Rule

Strings

\, xrefs: 00C93BF8
abcdefghijklmnopqrstuvwxyz0123456789_ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 00C93BBB

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID: \$abcdefghijklmnopqrstuvwxyz0123456789_ABCDEFGHIJKLMNOPQRSTUVWXYZ
API String ID: 0-680898115
Opcode ID: 2dde0162759cbcaebeea7395cb898d1dc15527e01660b482e34d6073b638d185
Instruction ID: d3751cc6264176087d5420862b242bccb0903f2bb31e5c15e05fc7c28b3d327c
Opcode Fuzzy Hash: 2dde0162759cbcaebeea7395cb898d1dc15527e01660b482e34d6073b638d185
Instruction Fuzzy Hash: ADE19171D00248CFDF08DFA8C899BAEBBB5FF45300F148269E415AB782D7759A45CBA1

Function 00C86F40 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 349COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00C87340

Strings

parse_error, xrefs: 00C86F8B
parse error, xrefs: 00C86FFF, 00C87018

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: parse error$parse_error
API String ID: 2659868963-1820534363
Opcode ID: 747a3af68da61219ee04f08d983e080f81004126f039f9830e2247d7a1f17a04
Instruction ID: 63f71cdbc3fd2beefa786148d0386b5140d7351fb3f3bcf85a2e71c3c7c35049
Opcode Fuzzy Hash: 747a3af68da61219ee04f08d983e080f81004126f039f9830e2247d7a1f17a04
Instruction Fuzzy Hash: 0AE171719042089FDB18DF68C884B9DBBB1FF49304F24826DE418EB792E7749A85CF65

Function 00C86C60 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00C86F11
___std_exception_destroy.LIBVCRUNTIME ref: 00C86F20

Strings

[json.exception., xrefs: 00C86CB8

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.
API String ID: 4194217158-791563284
Opcode ID: 4ea2b813ef483c65fba35cc990d17222b27c2ba4384303260d97183c20f4848b
Instruction ID: b919c22a329b21339da1b15ab17e8454e278dc35490913ca1fc68df2218ff393
Opcode Fuzzy Hash: 4ea2b813ef483c65fba35cc990d17222b27c2ba4384303260d97183c20f4848b
Instruction Fuzzy Hash: 8A91E570A002089FDB18DF68D884B9EFBF2FF45304F20856DE455AB792D771A945CB64

Function 00CFA520 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 234COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00CFA656

Strings

pected , xrefs: 00CFA564
unexpected , xrefs: 00CFA531

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: pected $unexpected
API String ID: 118556049-356062554
Opcode ID: a488096d346ddb20ad401a233e08d86b5c368dbbab1f4f7ebdf35b9828553d39
Instruction ID: 1ceb8bf5441611bbe01fac5b96c64f3fe8856f61cab15076f87b3d81bdb5f8ad
Opcode Fuzzy Hash: a488096d346ddb20ad401a233e08d86b5c368dbbab1f4f7ebdf35b9828553d39
Instruction Fuzzy Hash: 7D5138B25001049FDB18EF28D884A6EF7A5EF45310F244629F95ACB685EB30ED4587E2

Function 00CF8F90 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00CF9753
___std_exception_destroy.LIBVCRUNTIME ref: 00CF976C
___std_exception_destroy.LIBVCRUNTIME ref: 00CFA374
___std_exception_destroy.LIBVCRUNTIME ref: 00CFA38D

Strings

value, xrefs: 00CFA2A1

Memory Dump Source

Source File: 00000007.00000002.3274575639.0000000000C81000.00000040.00000001.01000000.00000004.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000007.00000002.3274540215.0000000000C80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274575639.0000000000DB3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274824705.0000000000DB8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274869359.0000000000DBB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274905099.0000000000DBC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274942387.0000000000DC6000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3274981034.0000000000DC7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275022694.0000000000DC8000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275229943.0000000000F20000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275270401.0000000000F22000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275312396.0000000000F3C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275348956.0000000000F3E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F3F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275382671.0000000000F48000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275461478.0000000000F4C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275497870.0000000000F54000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275536505.0000000000F5B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275572590.0000000000F5C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275607149.0000000000F64000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275639410.0000000000F66000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275681645.0000000000F75000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275722413.0000000000F76000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275753265.0000000000F7E000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275795445.0000000000F8A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275848326.0000000000FAA000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3275876900.0000000000FE5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276040552.0000000001012000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276079753.0000000001013000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.0000000001014000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276121343.000000000101A000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276200291.0000000001029000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.3276239394.000000000102A000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_c80000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: value
API String ID: 4194217158-494360628
Opcode ID: 8d77fc14e33f24f56b2e6da112be02ee6d332f1162637975d1e3335071f6a931
Instruction ID: c8449a5f97534e189af6baa8db876fd081fa7f7be96d1479ba0ec7e93def0638
Opcode Fuzzy Hash: 8d77fc14e33f24f56b2e6da112be02ee6d332f1162637975d1e3335071f6a931
Instruction Fuzzy Hash: 02519EB0D0025C9FDB14DFA8DC88BEEBBB8AF05300F144169E549A7792D7749A48DB62

Analysis Process: RageMP131.exePID: 1876, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	3.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	661
Total number of Limit Nodes:	82

Executed Functions

Function 00587E3E Relevance: 63.5, APIs: 7, Strings: 28, Instructions: 2282COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,00000104,?,?,?), ref: 00588006
GetFileAttributesA.KERNELBASE(?,00000001,?,?,?,?), ref: 0058815D
__Mtx_unlock.LIBCPMT ref: 00588186
__Mtx_unlock.LIBCPMT ref: 00588195
GetFileAttributesA.KERNELBASE(?,?,0000005C,00000000,00000001), ref: 00588751
__Mtx_unlock.LIBCPMT ref: 0058877A

Strings

+wj', xrefs: 00588B30
131, xrefs: 00587E3E, 00587E44, 00587EB2, 00587EB9, 00587EBF, 00587F2A, 00587F31, 00587F37, 00589A45, 00589A4C, 00589A52
+, xrefs: 00589B19
e`vf, xrefs: 00588C28
bqZP, xrefs: 00588479
IMG, xrefs: 00588601
e`vf, xrefs: 00589337
'[_+, xrefs: 0058934B
'[_+, xrefs: 00588C3C
\, xrefs: 00588896
\, xrefs: 00588684
DH][, xrefs: 00589244
., xrefs: 00589355
{~RL, xrefs: 0058848D
rnql, xrefs: 0058846F
RM[#, xrefs: 00588B26
agnd, xrefs: 00588483
(ACL, xrefs: 0058923A
@@MC, xrefs: 00588B3A
$*`', xrefs: 00589341
OFMM, xrefs: 00589226
$*tk, xrefs: 00589230
ec`v, xrefs: 00588497
Q>5, xrefs: 00589C24
$*`', xrefs: 00588C32
P?Y, xrefs: 005885DC
., xrefs: 00588C46
*, xrefs: 0058980E

Memory Dump Source

Source File: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, Offset: 00570000, based on PE: true

Associated: 00000008.00000002.3273933375.0000000000570000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274002949.00000000006A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274200285.00000000006A8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274233621.00000000006AB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274263488.00000000006AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274295748.00000000006B6000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274325253.00000000006B7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274363388.00000000006B8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274595752.0000000000810000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274651675.0000000000812000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274697776.000000000082C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274727274.000000000082E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.000000000082F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.0000000000838000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274831437.000000000083C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274871919.0000000000844000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274914274.000000000084B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274955028.000000000084C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275002848.0000000000854000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275039466.0000000000856000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275070774.0000000000865000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275107825.0000000000866000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275139356.000000000086E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275173148.000000000087A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275223517.000000000089A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.000000000089B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275404756.0000000000902000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275448792.0000000000903000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.0000000000904000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.000000000090A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275561073.0000000000919000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275599085.000000000091A000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_570000_RageMP131.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$AttributesFile$NameUser
String ID: $*`'$$*`'$$*tk$'[_+$'[_+$(ACL$*$+$+wj'$.$.$131$@@MC$DH][$IMG$OFMM$P?Y$Q>5$RM[#$\$\$agnd$bqZP$e`vf$e`vf$ec`v$rnql${~RL
API String ID: 1275484822-2283491884
Opcode ID: 8583292f6d5933e6260071c9a1539fab81e25ba2feda32e9d92ae74e9d442bef
Instruction ID: 95d2103b8ffcb225db9f035027d027de0789bfc52ee2d8d1ee881b726b8cbb8e
Opcode Fuzzy Hash: 8583292f6d5933e6260071c9a1539fab81e25ba2feda32e9d92ae74e9d442bef
Instruction Fuzzy Hash: 62235B709002598FDB28DF68C888BEDBBB5FF45304F5481EDD809AB282E7719A85CF55

Function 0057B6A0 Relevance: 21.8, APIs: 4, Strings: 8, Instructions: 840
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,A3B0BAA7,00000000,00020019,00000000,999D9BA1,999D9BA2), ref: 0057B947

Strings

:, xrefs: 0057B443
bqZD, xrefs: 0057B905
`yk, xrefs: 0057BEE0, 0057BF0A
rnql, xrefs: 0057B8FE
_, xrefs: 0057BB25
_, xrefs: 0057BAC6
_, xrefs: 0057BB32
cj|n, xrefs: 0057B913

Memory Dump Source

Source File: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, Offset: 00570000, based on PE: true

Associated: 00000008.00000002.3273933375.0000000000570000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274002949.00000000006A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274200285.00000000006A8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274233621.00000000006AB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274263488.00000000006AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274295748.00000000006B6000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274325253.00000000006B7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274363388.00000000006B8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274595752.0000000000810000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274651675.0000000000812000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274697776.000000000082C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274727274.000000000082E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.000000000082F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.0000000000838000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274831437.000000000083C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274871919.0000000000844000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274914274.000000000084B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274955028.000000000084C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275002848.0000000000854000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275039466.0000000000856000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275070774.0000000000865000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275107825.0000000000866000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275139356.000000000086E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275173148.000000000087A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275223517.000000000089A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.000000000089B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275404756.0000000000902000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275448792.0000000000903000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.0000000000904000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.000000000090A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275561073.0000000000919000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275599085.000000000091A000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_570000_RageMP131.jbxd

Yara matches

Similarity

API ID: Open
String ID: :$_$_$_$`yk$bqZD$cj|n$rnql
API String ID: 71445658-3798079816
Opcode ID: 7fcbc96d0020277a09ec60512c0c9c5874136dd226c36916e357707874f1cc21
Instruction ID: 5b83f16a9fde6f14a4c7bcf0027ff57c121dfac028a3902a9a3e58c0f7c22bcc
Opcode Fuzzy Hash: 7fcbc96d0020277a09ec60512c0c9c5874136dd226c36916e357707874f1cc21
Instruction Fuzzy Hash: 91729E70D002599FEB18CF68DC84BEEBFB6BF45304F1481ADE409A7282D7759A85CB51

Function 0058E0A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 0058E0CB
socket.WS2_32(?,?,?,?,?,?,`},?,?,?,?,?,?), ref: 0058E17F
connect.WS2_32(00000000,?,00000000,?,?,?,`},?,?,?,?,?,?), ref: 0058E193
closesocket.WS2_32(00000000), ref: 0058E19E

Strings

`}, xrefs: 0058E128

Memory Dump Source

Source File: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, Offset: 00570000, based on PE: true

Associated: 00000008.00000002.3273933375.0000000000570000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274002949.00000000006A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274200285.00000000006A8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274233621.00000000006AB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274263488.00000000006AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274295748.00000000006B6000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274325253.00000000006B7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274363388.00000000006B8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274595752.0000000000810000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274651675.0000000000812000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274697776.000000000082C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274727274.000000000082E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.000000000082F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.0000000000838000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274831437.000000000083C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274871919.0000000000844000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274914274.000000000084B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274955028.000000000084C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275002848.0000000000854000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275039466.0000000000856000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275070774.0000000000865000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275107825.0000000000866000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275139356.000000000086E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275173148.000000000087A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275223517.000000000089A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.000000000089B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275404756.0000000000902000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275448792.0000000000903000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.0000000000904000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.000000000090A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275561073.0000000000919000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275599085.000000000091A000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_570000_RageMP131.jbxd

Yara matches

Similarity

API ID: Startupclosesocketconnectsocket
String ID: `}
API String ID: 3098855095-2994082506
Opcode ID: 22060e4916f58de1e10587e461ded564ed503448b627f1ca8e26c938f7d6f618
Instruction ID: bff100cc3badc5ec4ecc58a476e4b6ede7645b2044d56535c9777a9c32897fbf
Opcode Fuzzy Hash: 22060e4916f58de1e10587e461ded564ed503448b627f1ca8e26c938f7d6f618
Instruction Fuzzy Hash: 743181716043116BD721AF259C8AB2BBBE4FBC5724F015F1DFDA8A62E0D37598048B92

Function 0064F290 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0057220E

Strings

`!W, xrefs: 00572216
`!W, xrefs: 005721FC

Memory Dump Source

Source File: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, Offset: 00570000, based on PE: true

Associated: 00000008.00000002.3273933375.0000000000570000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274002949.00000000006A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274200285.00000000006A8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274233621.00000000006AB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274263488.00000000006AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274295748.00000000006B6000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274325253.00000000006B7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274363388.00000000006B8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274595752.0000000000810000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274651675.0000000000812000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274697776.000000000082C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274727274.000000000082E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.000000000082F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.0000000000838000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274831437.000000000083C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274871919.0000000000844000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274914274.000000000084B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274955028.000000000084C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275002848.0000000000854000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275039466.0000000000856000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275070774.0000000000865000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275107825.0000000000866000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275139356.000000000086E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275173148.000000000087A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275223517.000000000089A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.000000000089B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275404756.0000000000902000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275448792.0000000000903000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.0000000000904000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.000000000090A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275561073.0000000000919000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275599085.000000000091A000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_570000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!W$`!W
API String ID: 2659868963-1309570094
Opcode ID: 71a4381bf4a94cb23807b68b7fced65b72febeef5bd6e0e83da91903183b439d
Instruction ID: 239c4bd74814bc276a4c5e9f19642c852de1349d89f76b5ba3a139b91909232f
Opcode Fuzzy Hash: 71a4381bf4a94cb23807b68b7fced65b72febeef5bd6e0e83da91903183b439d
Instruction Fuzzy Hash: C1012B3550430DABCB14AF98EC0289A7BEEEA01310F548439FE1CDB691EB70E954C794

Function 0057A690 Relevance: 4.6, APIs: 3, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE ref: 0057A6BF
__Mtx_unlock.LIBCPMT ref: 0057A6EE
__Mtx_unlock.LIBCPMT ref: 0057A733

Memory Dump Source

Source File: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, Offset: 00570000, based on PE: true

Associated: 00000008.00000002.3273933375.0000000000570000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274002949.00000000006A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274200285.00000000006A8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274233621.00000000006AB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274263488.00000000006AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274295748.00000000006B6000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274325253.00000000006B7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274363388.00000000006B8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274595752.0000000000810000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274651675.0000000000812000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274697776.000000000082C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274727274.000000000082E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.000000000082F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.0000000000838000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274831437.000000000083C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274871919.0000000000844000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274914274.000000000084B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274955028.000000000084C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275002848.0000000000854000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275039466.0000000000856000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275070774.0000000000865000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275107825.0000000000866000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275139356.000000000086E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275173148.000000000087A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275223517.000000000089A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.000000000089B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275404756.0000000000902000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275448792.0000000000903000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.0000000000904000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.000000000090A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275561073.0000000000919000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275599085.000000000091A000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_570000_RageMP131.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$AttributesFile
String ID:
API String ID: 1886074773-0
Opcode ID: 8a10280f15d237c511ffb552f9ad795afe609a3afbb440fe105feabaa00ecc3a
Instruction ID: 3c0ee3c0a6b85f00b0364e2a114d3f4430df31e3274e5f988b9b44dabc7aadeb
Opcode Fuzzy Hash: 8a10280f15d237c511ffb552f9ad795afe609a3afbb440fe105feabaa00ecc3a
Instruction Fuzzy Hash: AB01D6A2E491212A5E7821B43C564BF6D4AFA93768B2D8936FC09C6247F503DD0165D3

Function 005E0560 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 005E06AE

Strings

5X, xrefs: 005E0560

Memory Dump Source

Source File: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, Offset: 00570000, based on PE: true

Associated: 00000008.00000002.3273933375.0000000000570000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274002949.00000000006A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274200285.00000000006A8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274233621.00000000006AB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274263488.00000000006AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274295748.00000000006B6000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274325253.00000000006B7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274363388.00000000006B8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274595752.0000000000810000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274651675.0000000000812000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274697776.000000000082C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274727274.000000000082E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.000000000082F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.0000000000838000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274831437.000000000083C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274871919.0000000000844000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274914274.000000000084B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274955028.000000000084C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275002848.0000000000854000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275039466.0000000000856000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275070774.0000000000865000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275107825.0000000000866000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275139356.000000000086E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275173148.000000000087A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275223517.000000000089A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.000000000089B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275404756.0000000000902000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275448792.0000000000903000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.0000000000904000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.000000000090A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275561073.0000000000919000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275599085.000000000091A000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_570000_RageMP131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: 5X
API String ID: 118556049-3676709275
Opcode ID: 704878a6fb962aec51445f9c7907984ce5d7d965d91800b1a8fb89f3cbd27ced
Instruction ID: 22d6fdfd7eb2f3b5125fd676be289f3654354ece26c276f972b326d39730b22b
Opcode Fuzzy Hash: 704878a6fb962aec51445f9c7907984ce5d7d965d91800b1a8fb89f3cbd27ced
Instruction Fuzzy Hash: E041E572A001549BCB19EF69D88066E7FA6BF89310F14056AFC45DB382D770DEA08BE1

Function 0057A090 Relevance: 3.3, APIs: 2, Instructions: 342
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 0057A1B6
__fread_nolock.LIBCMT ref: 0057A343

Memory Dump Source

Source File: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, Offset: 00570000, based on PE: true

Associated: 00000008.00000002.3273933375.0000000000570000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274002949.00000000006A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274200285.00000000006A8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274233621.00000000006AB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274263488.00000000006AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274295748.00000000006B6000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274325253.00000000006B7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274363388.00000000006B8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274595752.0000000000810000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274651675.0000000000812000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274697776.000000000082C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274727274.000000000082E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.000000000082F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.0000000000838000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274831437.000000000083C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274871919.0000000000844000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274914274.000000000084B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274955028.000000000084C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275002848.0000000000854000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275039466.0000000000856000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275070774.0000000000865000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275107825.0000000000866000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275139356.000000000086E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275173148.000000000087A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275223517.000000000089A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.000000000089B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275404756.0000000000902000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275448792.0000000000903000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.0000000000904000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.000000000090A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275561073.0000000000919000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275599085.000000000091A000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_570000_RageMP131.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 50572929f7ddcad43e8e4ed890fd7e4b86808fc17b9dc722014a59671a1501f2
Instruction ID: 3190474fed5c2db0b4832a97588897d772f07a00b503be8c225ce70479c44108
Opcode Fuzzy Hash: 50572929f7ddcad43e8e4ed890fd7e4b86808fc17b9dc722014a59671a1501f2
Instruction Fuzzy Hash: A8B14970900205AFDB18DF68DC4AB9EBFE9FF81700F10856DF8099B682D7B59A45C792

Function 00664623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, Offset: 00570000, based on PE: true

Associated: 00000008.00000002.3273933375.0000000000570000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274002949.00000000006A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274200285.00000000006A8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274233621.00000000006AB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274263488.00000000006AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274295748.00000000006B6000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274325253.00000000006B7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274363388.00000000006B8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274595752.0000000000810000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274651675.0000000000812000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274697776.000000000082C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274727274.000000000082E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.000000000082F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.0000000000838000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274831437.000000000083C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274871919.0000000000844000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274914274.000000000084B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274955028.000000000084C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275002848.0000000000854000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275039466.0000000000856000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275070774.0000000000865000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275107825.0000000000866000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275139356.000000000086E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275173148.000000000087A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275223517.000000000089A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.000000000089B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275404756.0000000000902000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275448792.0000000000903000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.0000000000904000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.000000000090A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275561073.0000000000919000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275599085.000000000091A000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_570000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 405a5c54fb466bb4ee78030aa7a0b97c5c61180746e087f2056883dda29f0d85
Instruction ID: 468ab25ee595f5458323cdc51065150e18d7f0e9580fabd6268519601bc223aa
Opcode Fuzzy Hash: 405a5c54fb466bb4ee78030aa7a0b97c5c61180746e087f2056883dda29f0d85
Instruction Fuzzy Hash: A1B1F670A04245AFDB11DFA9D840BAEBBB3AF46314F14425CF95597382CB70ED42CB54

Function 0066549C Relevance: 1.7, APIs: 1, Instructions: 198
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000000,00659087,?,00000000,00000000,00000000,?,00000000,?,0064E5B1,00659087,00000000,0064E5B1,?,?), ref: 00665622

Memory Dump Source

Source File: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, Offset: 00570000, based on PE: true

Associated: 00000008.00000002.3273933375.0000000000570000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274002949.00000000006A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274200285.00000000006A8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274233621.00000000006AB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274263488.00000000006AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274295748.00000000006B6000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274325253.00000000006B7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274363388.00000000006B8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274595752.0000000000810000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274651675.0000000000812000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274697776.000000000082C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274727274.000000000082E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.000000000082F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.0000000000838000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274831437.000000000083C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274871919.0000000000844000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274914274.000000000084B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274955028.000000000084C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275002848.0000000000854000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275039466.0000000000856000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275070774.0000000000865000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275107825.0000000000866000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275139356.000000000086E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275173148.000000000087A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275223517.000000000089A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.000000000089B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275404756.0000000000902000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275448792.0000000000903000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.0000000000904000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.000000000090A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275561073.0000000000919000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275599085.000000000091A000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_570000_RageMP131.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 28537a665087d259a599291005749cc5e0563718b5dbc6d44496297306013eb6
Instruction ID: ef7a65605c5206ac514d1be2eab598a6c4d4de977ead6d9374d2dbf2aea2ba1c
Opcode Fuzzy Hash: 28537a665087d259a599291005749cc5e0563718b5dbc6d44496297306013eb6
Instruction Fuzzy Hash: 6C61B371D04519AFDF11DFA8C886EEEBBBBAF49308F140189F806A7215D731D911CBA0

Function 00654942 Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, Offset: 00570000, based on PE: true

Associated: 00000008.00000002.3273933375.0000000000570000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274002949.00000000006A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274200285.00000000006A8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274233621.00000000006AB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274263488.00000000006AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274295748.00000000006B6000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274325253.00000000006B7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274363388.00000000006B8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274595752.0000000000810000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274651675.0000000000812000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274697776.000000000082C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274727274.000000000082E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.000000000082F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.0000000000838000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274831437.000000000083C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274871919.0000000000844000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274914274.000000000084B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274955028.000000000084C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275002848.0000000000854000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275039466.0000000000856000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275070774.0000000000865000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275107825.0000000000866000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275139356.000000000086E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275173148.000000000087A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275223517.000000000089A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.000000000089B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275404756.0000000000902000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275448792.0000000000903000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.0000000000904000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.000000000090A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275561073.0000000000919000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275599085.000000000091A000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_570000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cbd9bb83d194dc881bf088fdfa375ac6c4b581206a08da0f38900821e9669df
Instruction ID: 1911504db033caa0b016e1854b838425889933a687a5423ed9ba120d93cea9f8
Opcode Fuzzy Hash: 7cbd9bb83d194dc881bf088fdfa375ac6c4b581206a08da0f38900821e9669df
Instruction Fuzzy Hash: 8F51E970A00108AFDF54CF58CC81AAA7FB2EF45369F248198FC495B356D7319E85CB94

Function 00664B12 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,006649F9,00000000,CF830579,006A1140,0000000C,00664AB5,00658BBD,?), ref: 00664B69

Memory Dump Source

Source File: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, Offset: 00570000, based on PE: true

Associated: 00000008.00000002.3273933375.0000000000570000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274002949.00000000006A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274200285.00000000006A8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274233621.00000000006AB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274263488.00000000006AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274295748.00000000006B6000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274325253.00000000006B7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274363388.00000000006B8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274595752.0000000000810000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274651675.0000000000812000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274697776.000000000082C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274727274.000000000082E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.000000000082F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.0000000000838000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274831437.000000000083C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274871919.0000000000844000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274914274.000000000084B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274955028.000000000084C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275002848.0000000000854000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275039466.0000000000856000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275070774.0000000000865000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275107825.0000000000866000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275139356.000000000086E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275173148.000000000087A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275223517.000000000089A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.000000000089B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275404756.0000000000902000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275448792.0000000000903000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.0000000000904000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.000000000090A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275561073.0000000000919000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275599085.000000000091A000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_570000_RageMP131.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 050309f98e629900331700137353dee280c3339fcdffe5d9e06b8b75480468af
Instruction ID: e9322ac82e1afd50a417a3180c29043da5e044f78c1919c684bdef14e82b4b92
Opcode Fuzzy Hash: 050309f98e629900331700137353dee280c3339fcdffe5d9e06b8b75480468af
Instruction Fuzzy Hash: 0111483360412417C7647274E841BBEA74BCB837B4F39060DF9149B2C2EE21E8819549

Function 0065E05C Relevance: 1.6, APIs: 1, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,006A0DF8,0064E5B1,00000002,0064E5B1,00000000,?,?,?,0065E166,00000000,?,0064E5B1,00000002,006A0DF8), ref: 0065E099

Memory Dump Source

Source File: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, Offset: 00570000, based on PE: true

Associated: 00000008.00000002.3273933375.0000000000570000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274002949.00000000006A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274200285.00000000006A8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274233621.00000000006AB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274263488.00000000006AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274295748.00000000006B6000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274325253.00000000006B7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274363388.00000000006B8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274595752.0000000000810000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274651675.0000000000812000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274697776.000000000082C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274727274.000000000082E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.000000000082F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.0000000000838000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274831437.000000000083C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274871919.0000000000844000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274914274.000000000084B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274955028.000000000084C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275002848.0000000000854000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275039466.0000000000856000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275070774.0000000000865000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275107825.0000000000866000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275139356.000000000086E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275173148.000000000087A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275223517.000000000089A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.000000000089B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275404756.0000000000902000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275448792.0000000000903000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.0000000000904000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.000000000090A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275561073.0000000000919000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275599085.000000000091A000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_570000_RageMP131.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 6a84d22214f6e81f5c526728809ce82731d5989bdf3f7a0226ae09562de4d25d
Instruction ID: b98fb2a196d26059a1159c5bcdea863c26eccc353e460ea753c3c1f7efca0ef8
Opcode Fuzzy Hash: 6a84d22214f6e81f5c526728809ce82731d5989bdf3f7a0226ae09562de4d25d
Instruction Fuzzy Hash: 26012632614119ABCF09DF58CC05C9E3B2BDB86335F240248FC519B2D1E6B2EA518BD0

Function 006663F3 Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,0064D6FA,00000004,?,00665D79,00000001,00000364,00000004,00000007,000000FF,?,0065067B,00000002,00000000,?,?), ref: 00666435

Memory Dump Source

Source File: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, Offset: 00570000, based on PE: true

Associated: 00000008.00000002.3273933375.0000000000570000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274002949.00000000006A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274200285.00000000006A8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274233621.00000000006AB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274263488.00000000006AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274295748.00000000006B6000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274325253.00000000006B7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274363388.00000000006B8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274595752.0000000000810000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274651675.0000000000812000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274697776.000000000082C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274727274.000000000082E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.000000000082F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.0000000000838000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274831437.000000000083C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274871919.0000000000844000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274914274.000000000084B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274955028.000000000084C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275002848.0000000000854000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275039466.0000000000856000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275070774.0000000000865000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275107825.0000000000866000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275139356.000000000086E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275173148.000000000087A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275223517.000000000089A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.000000000089B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275404756.0000000000902000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275448792.0000000000903000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.0000000000904000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.000000000090A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275561073.0000000000919000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275599085.000000000091A000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_570000_RageMP131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 735d98e4503f0a17abf93d301044afeace504524b6dfa5106edd8df2d54a73a5
Instruction ID: f24e8e8186cb92b849aac94835a2fa54214ad58ababc755a49e4338a65bd0022
Opcode Fuzzy Hash: 735d98e4503f0a17abf93d301044afeace504524b6dfa5106edd8df2d54a73a5
Instruction Fuzzy Hash: CAF08931505124669B616F62FC06BAB7BCFDF51764F15C055FC08D6280CE70E81146F5

Function 00666E2D Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000004,00000000,?,0065067B,00000002,00000000,?,?,?,0057303D,0064D6FA,00000004,00000000,0064D6FA), ref: 00666E60

Memory Dump Source

Source File: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, Offset: 00570000, based on PE: true

Associated: 00000008.00000002.3273933375.0000000000570000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274002949.00000000006A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274200285.00000000006A8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274233621.00000000006AB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274263488.00000000006AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274295748.00000000006B6000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274325253.00000000006B7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274363388.00000000006B8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274595752.0000000000810000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274651675.0000000000812000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274697776.000000000082C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274727274.000000000082E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.000000000082F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.0000000000838000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274831437.000000000083C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274871919.0000000000844000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274914274.000000000084B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274955028.000000000084C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275002848.0000000000854000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275039466.0000000000856000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275070774.0000000000865000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275107825.0000000000866000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275139356.000000000086E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275173148.000000000087A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275223517.000000000089A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.000000000089B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275404756.0000000000902000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275448792.0000000000903000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.0000000000904000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.000000000090A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275561073.0000000000919000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275599085.000000000091A000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_570000_RageMP131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 18f11145dff118bcc9e47149f3ebe90261319a212eb6a4f36f91d61bfc62c966
Instruction ID: 361bd5db6fa3c6d9aa41d6b2dc3066818b83b988352fbbc7a70540c378b9a274
Opcode Fuzzy Hash: 18f11145dff118bcc9e47149f3ebe90261319a212eb6a4f36f91d61bfc62c966
Instruction Fuzzy Hash: 09E0ED399086216ADB302666ED00BAB7A4B8B823A1F050120FE04D62D0CB22D80081A8

Non-executed Functions

Function 0057D8B9 Relevance: 26.6, APIs: 2, Strings: 13, Instructions: 377COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32(00000000,00000128), ref: 0057DAB0
Process32Next.KERNEL32(00000000,?), ref: 0057DAF8

Strings

?, xrefs: 0057DCB9
jjst, xrefs: 0057DBBB
d;"&, xrefs: 0057D957
bqZP, xrefs: 0057DB89
IOQW, xrefs: 0057DBCF
rnql, xrefs: 0057DB7F
{~RL, xrefs: 0057DB9D
agnd, xrefs: 0057DB93
EIJ, xrefs: 0057DBD9
za@r, xrefs: 0057DBB1
oo, xrefs: 0057DD34
rAKq, xrefs: 0057DBC5
ec`v, xrefs: 0057DBA7

Memory Dump Source

Source File: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, Offset: 00570000, based on PE: true

Associated: 00000008.00000002.3273933375.0000000000570000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274002949.00000000006A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274200285.00000000006A8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274233621.00000000006AB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274263488.00000000006AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274295748.00000000006B6000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274325253.00000000006B7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274363388.00000000006B8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274595752.0000000000810000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274651675.0000000000812000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274697776.000000000082C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274727274.000000000082E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.000000000082F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.0000000000838000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274831437.000000000083C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274871919.0000000000844000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274914274.000000000084B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274955028.000000000084C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275002848.0000000000854000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275039466.0000000000856000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275070774.0000000000865000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275107825.0000000000866000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275139356.000000000086E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275173148.000000000087A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275223517.000000000089A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.000000000089B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275404756.0000000000902000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275448792.0000000000903000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.0000000000904000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.000000000090A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275561073.0000000000919000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275599085.000000000091A000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_570000_RageMP131.jbxd

Yara matches

Similarity

API ID: NextProcess32
String ID: ?$EIJ$IOQW$agnd$bqZP$d;"&$ec`v$jjst$oo$rAKq$rnql$za@r${~RL
API String ID: 1850201408-2823651170
Opcode ID: c45aad5a9169ac3740635b699f5bb512dc52f29ff9305413297050765ca9215d
Instruction ID: 9f845af1988a6020f2e478151d3423690ede808db59ef60d47a9efd409a2a69e
Opcode Fuzzy Hash: c45aad5a9169ac3740635b699f5bb512dc52f29ff9305413297050765ca9215d
Instruction Fuzzy Hash: 0CF15DB191122D9AEB20EB94DC45BEEBBB8FF55300F4044D9E54DB6242EB705B88CF61

Function 005DF810 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 005DF833
std::_Lockit::_Lockit.LIBCPMT ref: 005DF855
std::_Lockit::~_Lockit.LIBCPMT ref: 005DF875
std::_Lockit::~_Lockit.LIBCPMT ref: 005DF89F
std::_Lockit::_Lockit.LIBCPMT ref: 005DF90D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 005DF959
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 005DF973
std::_Lockit::~_Lockit.LIBCPMT ref: 005DFA08
std::_Facet_Register.LIBCPMT ref: 005DFA15

Strings

"i, xrefs: 005DF96B, 005DF972
bad locale name, xrefs: 005DFA2F

Memory Dump Source

Source File: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, Offset: 00570000, based on PE: true

Associated: 00000008.00000002.3273933375.0000000000570000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274002949.00000000006A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274200285.00000000006A8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274233621.00000000006AB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274263488.00000000006AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274295748.00000000006B6000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274325253.00000000006B7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274363388.00000000006B8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274595752.0000000000810000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274651675.0000000000812000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274697776.000000000082C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274727274.000000000082E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.000000000082F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.0000000000838000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274831437.000000000083C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274871919.0000000000844000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274914274.000000000084B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274955028.000000000084C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275002848.0000000000854000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275039466.0000000000856000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275070774.0000000000865000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275107825.0000000000866000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275139356.000000000086E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275173148.000000000087A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275223517.000000000089A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.000000000089B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275404756.0000000000902000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275448792.0000000000903000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.0000000000904000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.000000000090A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275561073.0000000000919000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275599085.000000000091A000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_570000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$"i
API String ID: 3375549084-3647989590
Opcode ID: 801012308083716df16281b48e833d7758b8e76275ec47528103a7afb432c447
Instruction ID: 4432a753b094d25085412e8577f1b4ae9b62cb0a33d66d3dcdc2edc9743f9d1b
Opcode Fuzzy Hash: 801012308083716df16281b48e833d7758b8e76275ec47528103a7afb432c447
Instruction Fuzzy Hash: 1A619F71D00248DBDF20EFA8D845B9EBFB5BF04310F18446AE805A7381D775E905CB96

Function 00577820 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0057799A
___std_exception_copy.LIBVCRUNTIME ref: 00577B75

Strings

out_of_range, xrefs: 00577A27
`!W, xrefs: 005779A5, 00577B80
`!W, xrefs: 00577985, 00577B60
type_error, xrefs: 0057784A

Memory Dump Source

Source File: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, Offset: 00570000, based on PE: true

Associated: 00000008.00000002.3273933375.0000000000570000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274002949.00000000006A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274200285.00000000006A8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274233621.00000000006AB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274263488.00000000006AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274295748.00000000006B6000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274325253.00000000006B7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274363388.00000000006B8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274595752.0000000000810000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274651675.0000000000812000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274697776.000000000082C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274727274.000000000082E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.000000000082F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.0000000000838000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274831437.000000000083C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274871919.0000000000844000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274914274.000000000084B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274955028.000000000084C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275002848.0000000000854000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275039466.0000000000856000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275070774.0000000000865000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275107825.0000000000866000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275139356.000000000086E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275173148.000000000087A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275223517.000000000089A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.000000000089B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275404756.0000000000902000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275448792.0000000000903000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.0000000000904000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.000000000090A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275561073.0000000000919000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275599085.000000000091A000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_570000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!W$`!W$out_of_range$type_error
API String ID: 2659868963-3966042102
Opcode ID: c3f394b604a6400d670fb2c1541377d725f11dbbd0b3b3c0172f246a584f23fb
Instruction ID: 1c36af2bdfb6674e7721e5e4850c4593e512c767effb9a7533273ffff2de5b4b
Opcode Fuzzy Hash: c3f394b604a6400d670fb2c1541377d725f11dbbd0b3b3c0172f246a584f23fb
Instruction Fuzzy Hash: 82C14AB19002089FDB58DFA8E98479DBFF6FF48300F14866AE419EB752E77499808B54

Function 005773B0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 184COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 005775BE
___std_exception_destroy.LIBVCRUNTIME ref: 005775CD

Strings

yoW, xrefs: 00577455
at line , xrefs: 005773F7
`!W, xrefs: 005775B6, 005775C6
, column , xrefs: 00577434, 0057744A

Memory Dump Source

Source File: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, Offset: 00570000, based on PE: true

Associated: 00000008.00000002.3273933375.0000000000570000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274002949.00000000006A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274200285.00000000006A8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274233621.00000000006AB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274263488.00000000006AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274295748.00000000006B6000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274325253.00000000006B7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274363388.00000000006B8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274595752.0000000000810000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274651675.0000000000812000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274697776.000000000082C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274727274.000000000082E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.000000000082F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.0000000000838000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274831437.000000000083C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274871919.0000000000844000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274914274.000000000084B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274955028.000000000084C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275002848.0000000000854000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275039466.0000000000856000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275070774.0000000000865000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275107825.0000000000866000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275139356.000000000086E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275173148.000000000087A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275223517.000000000089A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.000000000089B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275404756.0000000000902000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275448792.0000000000903000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.0000000000904000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.000000000090A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275561073.0000000000919000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275599085.000000000091A000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_570000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column $`!W$yoW
API String ID: 4194217158-2070846131
Opcode ID: 04ebfc116621a802f40cb6bf2b21422d5854d261a085ce556847a0f1a0c8f29e
Instruction ID: dceb183647ac194e536b23ea3c8d450fe62e244821905abe742a264cf26e6752
Opcode Fuzzy Hash: 04ebfc116621a802f40cb6bf2b21422d5854d261a085ce556847a0f1a0c8f29e
Instruction Fuzzy Hash: 4961C771A042099FDB08DF68EC85B9DBFB6FF48300F14862CE41997782D774AA449B95

Function 005739F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00573A58
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00573AA4
__Getctype.LIBCPMT ref: 00573ABA
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00573AE6
std::_Lockit::~_Lockit.LIBCPMT ref: 00573B7B

Strings

bad locale name, xrefs: 00573B96

Memory Dump Source

Source File: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, Offset: 00570000, based on PE: true

Associated: 00000008.00000002.3273933375.0000000000570000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274002949.00000000006A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274200285.00000000006A8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274233621.00000000006AB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274263488.00000000006AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274295748.00000000006B6000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274325253.00000000006B7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274363388.00000000006B8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274595752.0000000000810000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274651675.0000000000812000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274697776.000000000082C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274727274.000000000082E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.000000000082F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.0000000000838000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274831437.000000000083C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274871919.0000000000844000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274914274.000000000084B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274955028.000000000084C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275002848.0000000000854000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275039466.0000000000856000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275070774.0000000000865000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275107825.0000000000866000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275139356.000000000086E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275173148.000000000087A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275223517.000000000089A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.000000000089B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275404756.0000000000902000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275448792.0000000000903000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.0000000000904000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.000000000090A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275561073.0000000000919000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275599085.000000000091A000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_570000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: 418af4c57e355c11785d541a465628ce06f37d14a40fd6016a71fe133b31c8f5
Instruction ID: 26c6f7926450587899462a5dc032e12f4ec210f9ad65cb22c28f64c35285e2fd
Opcode Fuzzy Hash: 418af4c57e355c11785d541a465628ce06f37d14a40fd6016a71fe133b31c8f5
Instruction Fuzzy Hash: 675132B1D002489FDF50DFA4D945B9EBBB9BF14310F148069EC09AB381E775DA08DB95

Function 0057B1A0 Relevance: 10.6, APIs: 7, Instructions: 133memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000001C), ref: 0057B1F0
LocalAlloc.KERNEL32(00000040,0000001C,?,00000000,00000000), ref: 0057B239
SetupDiGetDeviceInterfaceDetailA.SETUPAPI(?,00000000,00000000,00000000,?,00000000), ref: 0057B26D
SetupDiGetDeviceInterfaceDetailA.SETUPAPI(?,?,00000000,?,00000000,00000000), ref: 0057B28F
LocalFree.KERNEL32(?,?,?,?,?,00000000,?,00000000,00000000), ref: 0057B2C0
LocalFree.KERNEL32(?,?,?,00000000,?,00000000,00000000), ref: 0057B2C5
LocalFree.KERNEL32(?,?,?,00000000,?,00000000,00000000), ref: 0057B2C8

Memory Dump Source

Source File: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, Offset: 00570000, based on PE: true

Associated: 00000008.00000002.3273933375.0000000000570000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274002949.00000000006A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274200285.00000000006A8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274233621.00000000006AB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274263488.00000000006AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274295748.00000000006B6000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274325253.00000000006B7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274363388.00000000006B8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274595752.0000000000810000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274651675.0000000000812000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274697776.000000000082C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274727274.000000000082E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.000000000082F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.0000000000838000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274831437.000000000083C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274871919.0000000000844000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274914274.000000000084B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274955028.000000000084C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275002848.0000000000854000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275039466.0000000000856000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275070774.0000000000865000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275107825.0000000000866000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275139356.000000000086E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275173148.000000000087A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275223517.000000000089A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.000000000089B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275404756.0000000000902000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275448792.0000000000903000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.0000000000904000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.000000000090A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275561073.0000000000919000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275599085.000000000091A000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_570000_RageMP131.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocDetailDeviceInterfaceSetup
String ID:
API String ID: 4232148138-0
Opcode ID: 4a61beaf0884658d463213450f9db647f8e9cfacf6b6255967c8f485f32b6a30
Instruction ID: 5c19e79ddefa64afa2ab762e266da89052a8b468d11f640d21e410e47f063255
Opcode Fuzzy Hash: 4a61beaf0884658d463213450f9db647f8e9cfacf6b6255967c8f485f32b6a30
Instruction Fuzzy Hash: 14414EB1941309AFDB60DFA9DC41BAEBBF5FB48700F10452AE519E3251E77499008B50

Function 00574C50 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 345COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00574F72
___std_exception_destroy.LIBVCRUNTIME ref: 00574FFF

Strings

: ", xrefs: 00574DA1
`!W, xrefs: 00574F6B, 00574FF8
", ", xrefs: 00574DCB

Memory Dump Source

Source File: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, Offset: 00570000, based on PE: true

Associated: 00000008.00000002.3273933375.0000000000570000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274002949.00000000006A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274200285.00000000006A8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274233621.00000000006AB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274263488.00000000006AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274295748.00000000006B6000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274325253.00000000006B7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274363388.00000000006B8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274595752.0000000000810000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274651675.0000000000812000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274697776.000000000082C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274727274.000000000082E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.000000000082F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.0000000000838000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274831437.000000000083C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274871919.0000000000844000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274914274.000000000084B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274955028.000000000084C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275002848.0000000000854000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275039466.0000000000856000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275070774.0000000000865000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275107825.0000000000866000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275139356.000000000086E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275173148.000000000087A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275223517.000000000089A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.000000000089B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275404756.0000000000902000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275448792.0000000000903000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.0000000000904000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.000000000090A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275561073.0000000000919000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275599085.000000000091A000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_570000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: ", "$: "$`!W
API String ID: 4194217158-865532658
Opcode ID: 5e9e06aa24b5b4b97bf37eafb235e5d202e81d584032ab294a481369df221830
Instruction ID: ce7125582c36f31b5045869a68db7bae7a15c8ee6ce7eece0f275ffdacc786e0
Opcode Fuzzy Hash: 5e9e06aa24b5b4b97bf37eafb235e5d202e81d584032ab294a481369df221830
Instruction Fuzzy Hash: 45C1F4709002058FDB28DF68D849B6EBBFAFF44300F14892DE45A97782E774A944CBA5

Function 00573190 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 170COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005732C6
___std_exception_destroy.LIBVCRUNTIME ref: 00573350

Strings

`!W, xrefs: 005732D1
`!W, xrefs: 005732AD, 00573349
@3W, xrefs: 00573316

Memory Dump Source

Source File: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, Offset: 00570000, based on PE: true

Associated: 00000008.00000002.3273933375.0000000000570000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274002949.00000000006A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274200285.00000000006A8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274233621.00000000006AB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274263488.00000000006AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274295748.00000000006B6000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274325253.00000000006B7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274363388.00000000006B8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274595752.0000000000810000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274651675.0000000000812000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274697776.000000000082C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274727274.000000000082E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.000000000082F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.0000000000838000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274831437.000000000083C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274871919.0000000000844000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274914274.000000000084B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274955028.000000000084C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275002848.0000000000854000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275039466.0000000000856000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275070774.0000000000865000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275107825.0000000000866000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275139356.000000000086E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275173148.000000000087A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275223517.000000000089A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.000000000089B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275404756.0000000000902000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275448792.0000000000903000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.0000000000904000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.000000000090A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275561073.0000000000919000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275599085.000000000091A000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_570000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: @3W$`!W$`!W
API String ID: 2970364248-2254862971
Opcode ID: 073f5f322dfeec1c76671ec605106b207f02555883281553bf0b9de61f8cc980
Instruction ID: 9ca9d5c49881c98053fdeab6731ce3c3b1bfb9768a6f4ef50342b8e76cffc6cc
Opcode Fuzzy Hash: 073f5f322dfeec1c76671ec605106b207f02555883281553bf0b9de61f8cc980
Instruction Fuzzy Hash: 0A519B759002089FDB18CF98D885BDEBFB6FF48310F14812EE819A7382D7749A41DB90

Function 00573370 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

APIs

Part of subcall function 00573190: ___std_exception_copy.LIBVCRUNTIME ref: 005732C6

___std_exception_copy.LIBVCRUNTIME ref: 0057345F

Strings

+4W, xrefs: 005733B3, 00573410
@3W, xrefs: 005733F3, 0057347B
`!W, xrefs: 00573450
@3W, xrefs: 00573464

Memory Dump Source

Source File: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, Offset: 00570000, based on PE: true

Associated: 00000008.00000002.3273933375.0000000000570000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274002949.00000000006A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274200285.00000000006A8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274233621.00000000006AB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274263488.00000000006AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274295748.00000000006B6000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274325253.00000000006B7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274363388.00000000006B8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274595752.0000000000810000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274651675.0000000000812000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274697776.000000000082C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274727274.000000000082E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.000000000082F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.0000000000838000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274831437.000000000083C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274871919.0000000000844000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274914274.000000000084B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274955028.000000000084C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275002848.0000000000854000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275039466.0000000000856000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275070774.0000000000865000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275107825.0000000000866000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275139356.000000000086E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275173148.000000000087A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275223517.000000000089A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.000000000089B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275404756.0000000000902000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275448792.0000000000903000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.0000000000904000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.000000000090A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275561073.0000000000919000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275599085.000000000091A000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_570000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: +4W$@3W$@3W$`!W
API String ID: 2659868963-806670365
Opcode ID: 08a8ddb1aa18281f980a96ac58ce819bda57acd98c82f3f75bd0d063ab12edc2
Instruction ID: 918fea9a37f8cd214a50696b723ab04dde42f5a42de1cb39742ad5218c2d2234
Opcode Fuzzy Hash: 08a8ddb1aa18281f980a96ac58ce819bda57acd98c82f3f75bd0d063ab12edc2
Instruction Fuzzy Hash: C231B4729002099FCB18DFA8D845A9EFFF9FF08310F10852AF518D7641E770A654DB95

Function 005DD050 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005DD06F
___std_exception_copy.LIBVCRUNTIME ref: 005DD096

Strings

uW, xrefs: 005DD0A5
`!W, xrefs: 005DD09B
`!W, xrefs: 005DD060, 005DD085

Memory Dump Source

Source File: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, Offset: 00570000, based on PE: true

Associated: 00000008.00000002.3273933375.0000000000570000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274002949.00000000006A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274200285.00000000006A8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274233621.00000000006AB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274263488.00000000006AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274295748.00000000006B6000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274325253.00000000006B7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274363388.00000000006B8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274595752.0000000000810000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274651675.0000000000812000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274697776.000000000082C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274727274.000000000082E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.000000000082F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.0000000000838000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274831437.000000000083C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274871919.0000000000844000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274914274.000000000084B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274955028.000000000084C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275002848.0000000000854000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275039466.0000000000856000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275070774.0000000000865000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275107825.0000000000866000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275139356.000000000086E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275173148.000000000087A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275223517.000000000089A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.000000000089B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275404756.0000000000902000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275448792.0000000000903000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.0000000000904000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.000000000090A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275561073.0000000000919000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275599085.000000000091A000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_570000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!W$`!W$uW
API String ID: 2659868963-58997078
Opcode ID: 7f86f9905bd1a33d11d35b496be1e4d26b91e6ed885aeebb1ece0b751b307457
Instruction ID: 9e7c2f3d5726a3ed1a309604d316bbc60cde08ab48c2ffa2e75457d0e29a8fe3
Opcode Fuzzy Hash: 7f86f9905bd1a33d11d35b496be1e4d26b91e6ed885aeebb1ece0b751b307457
Instruction Fuzzy Hash: 6B01A4B6500606AF9704DF59D445882FBF9FB58710704852BA929CBB11E7B0E528CFA4

Function 00576C60 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 247COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00576F11
___std_exception_destroy.LIBVCRUNTIME ref: 00576F20

Strings

[json.exception., xrefs: 00576CB8
`!W, xrefs: 00576F09, 00576F19

Memory Dump Source

Source File: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, Offset: 00570000, based on PE: true

Associated: 00000008.00000002.3273933375.0000000000570000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274002949.00000000006A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274200285.00000000006A8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274233621.00000000006AB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274263488.00000000006AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274295748.00000000006B6000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274325253.00000000006B7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274363388.00000000006B8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274595752.0000000000810000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274651675.0000000000812000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274697776.000000000082C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274727274.000000000082E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.000000000082F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.0000000000838000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274831437.000000000083C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274871919.0000000000844000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274914274.000000000084B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274955028.000000000084C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275002848.0000000000854000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275039466.0000000000856000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275070774.0000000000865000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275107825.0000000000866000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275139356.000000000086E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275173148.000000000087A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275223517.000000000089A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.000000000089B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275404756.0000000000902000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275448792.0000000000903000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.0000000000904000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.000000000090A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275561073.0000000000919000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275599085.000000000091A000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_570000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.$`!W
API String ID: 4194217158-964591096
Opcode ID: 863e6945141acf6f43bcccfadb53f380f7bedfc0f53ee5ea5d4e1d4630dbba13
Instruction ID: 185c66fc76caf31ced68849e9dc5d37921342f763a7362a86ee6353eac3dea47
Opcode Fuzzy Hash: 863e6945141acf6f43bcccfadb53f380f7bedfc0f53ee5ea5d4e1d4630dbba13
Instruction Fuzzy Hash: 5991C470A006059FDB18CF68D984B9EBFF6FF44300F20856CE459AB792D771AA45CB91

Function 00577BE0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 156COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00577D67

Strings

`!W, xrefs: 00577D72
`!W, xrefs: 00577D52
other_error, xrefs: 00577C0A

Memory Dump Source

Source File: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, Offset: 00570000, based on PE: true

Associated: 00000008.00000002.3273933375.0000000000570000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274002949.00000000006A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274200285.00000000006A8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274233621.00000000006AB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274263488.00000000006AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274295748.00000000006B6000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274325253.00000000006B7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274363388.00000000006B8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274595752.0000000000810000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274651675.0000000000812000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274697776.000000000082C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274727274.000000000082E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.000000000082F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.0000000000838000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274831437.000000000083C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274871919.0000000000844000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274914274.000000000084B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274955028.000000000084C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275002848.0000000000854000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275039466.0000000000856000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275070774.0000000000865000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275107825.0000000000866000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275139356.000000000086E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275173148.000000000087A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275223517.000000000089A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.000000000089B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275404756.0000000000902000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275448792.0000000000903000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.0000000000904000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.000000000090A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275561073.0000000000919000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275599085.000000000091A000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_570000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!W$`!W$other_error
API String ID: 2659868963-2305695082
Opcode ID: 05c38ca3a9fb68d44ad3a0295e739def463a60fa5a650624e1540a8620d0fe75
Instruction ID: 1e31358a7312dac2a563bff9b91322171b857d1c301f8f563eeeefebea0f9329
Opcode Fuzzy Hash: 05c38ca3a9fb68d44ad3a0295e739def463a60fa5a650624e1540a8620d0fe75
Instruction Fuzzy Hash: B1516BB0D002089FDB58CFA8E88479DBFF6BF48300F148269E459EB752E7749984CB54

Function 00575010 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005750C8

Strings

`!W, xrefs: 005750B9
recursive_directory_iterator::operator++, xrefs: 0057504C
@3W, xrefs: 005750CD

Memory Dump Source

Source File: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, Offset: 00570000, based on PE: true

Associated: 00000008.00000002.3273933375.0000000000570000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274002949.00000000006A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274200285.00000000006A8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274233621.00000000006AB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274263488.00000000006AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274295748.00000000006B6000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274325253.00000000006B7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274363388.00000000006B8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274595752.0000000000810000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274651675.0000000000812000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274697776.000000000082C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274727274.000000000082E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.000000000082F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.0000000000838000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274831437.000000000083C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274871919.0000000000844000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274914274.000000000084B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274955028.000000000084C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275002848.0000000000854000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275039466.0000000000856000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275070774.0000000000865000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275107825.0000000000866000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275139356.000000000086E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275173148.000000000087A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275223517.000000000089A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.000000000089B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275404756.0000000000902000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275448792.0000000000903000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.0000000000904000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.000000000090A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275561073.0000000000919000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275599085.000000000091A000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_570000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: @3W$`!W$recursive_directory_iterator::operator++
API String ID: 2659868963-812295300
Opcode ID: 6dc4b373d35d6dc1ba185135b896fb7721cc38aa11ebca49021e33f20a700460
Instruction ID: 3e66944857db0ac5f416570417656943591eaf99c34ef1ff32cf8df9825ada91
Opcode Fuzzy Hash: 6dc4b373d35d6dc1ba185135b896fb7721cc38aa11ebca49021e33f20a700460
Instruction Fuzzy Hash: 0A3182B5800609EFC714DF54D945F8ABBFCFB45710F00866AE92A93781EB74BA14CBA1

Function 005EB3C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005EB3DF
___std_exception_copy.LIBVCRUNTIME ref: 005EB406

Strings

`!W, xrefs: 005EB40E
`!W, xrefs: 005EB3D0, 005EB3F5

Memory Dump Source

Source File: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, Offset: 00570000, based on PE: true

Associated: 00000008.00000002.3273933375.0000000000570000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274002949.00000000006A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274200285.00000000006A8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274233621.00000000006AB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274263488.00000000006AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274295748.00000000006B6000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274325253.00000000006B7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274363388.00000000006B8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274595752.0000000000810000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274651675.0000000000812000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274697776.000000000082C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274727274.000000000082E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.000000000082F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.0000000000838000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274831437.000000000083C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274871919.0000000000844000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274914274.000000000084B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274955028.000000000084C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275002848.0000000000854000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275039466.0000000000856000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275070774.0000000000865000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275107825.0000000000866000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275139356.000000000086E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275173148.000000000087A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275223517.000000000089A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.000000000089B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275404756.0000000000902000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275448792.0000000000903000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.0000000000904000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.000000000090A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275561073.0000000000919000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275599085.000000000091A000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_570000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!W$`!W
API String ID: 2659868963-1309570094
Opcode ID: cb88ca37825e92ddba369fd583aaab8085c520398e602967afe0691cc128a525
Instruction ID: 78490c40412956a3a4500f76cf44c39202781701899adc30337679bbcf4b3ebe
Opcode Fuzzy Hash: cb88ca37825e92ddba369fd583aaab8085c520398e602967afe0691cc128a525
Instruction Fuzzy Hash: 77F0C4B6500606AF9708DF58D405886BBE9FA54710705852BE52ACBB01E7B0E528CBA4

Function 00573050 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00573078

Strings

`!W, xrefs: 00573080
`!W, xrefs: 00573063

Memory Dump Source

Source File: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, Offset: 00570000, based on PE: true

Associated: 00000008.00000002.3273933375.0000000000570000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274002949.00000000006A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274200285.00000000006A8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274233621.00000000006AB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274263488.00000000006AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274295748.00000000006B6000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274325253.00000000006B7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274363388.00000000006B8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274595752.0000000000810000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274651675.0000000000812000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274697776.000000000082C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274727274.000000000082E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.000000000082F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.0000000000838000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274831437.000000000083C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274871919.0000000000844000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274914274.000000000084B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274955028.000000000084C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275002848.0000000000854000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275039466.0000000000856000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275070774.0000000000865000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275107825.0000000000866000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275139356.000000000086E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275173148.000000000087A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275223517.000000000089A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.000000000089B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275404756.0000000000902000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275448792.0000000000903000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.0000000000904000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.000000000090A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275561073.0000000000919000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275599085.000000000091A000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_570000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!W$`!W
API String ID: 2659868963-1309570094
Opcode ID: 46834f4df1ecd55b4aa1205a7e9ec62518393eda9536ea2e252bed7e4ca4bd95
Instruction ID: 3ab35861491ba84314fca1011bdd5871c689b915b080ae35dbc355ef9549fd0a
Opcode Fuzzy Hash: 46834f4df1ecd55b4aa1205a7e9ec62518393eda9536ea2e252bed7e4ca4bd95
Instruction Fuzzy Hash: 7BE012B69053089BC710DFA8D8459CAFFF8AB19701F14C6BAE948D7301F6B0D5548BD5

Function 00573090 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005730AE

Strings

`!W, xrefs: 005730B6
`!W, xrefs: 0057309C

Memory Dump Source

Source File: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, Offset: 00570000, based on PE: true

Associated: 00000008.00000002.3273933375.0000000000570000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274002949.00000000006A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274200285.00000000006A8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274233621.00000000006AB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274263488.00000000006AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274295748.00000000006B6000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274325253.00000000006B7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274363388.00000000006B8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274595752.0000000000810000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274651675.0000000000812000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274697776.000000000082C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274727274.000000000082E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.000000000082F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.0000000000838000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274831437.000000000083C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274871919.0000000000844000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274914274.000000000084B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274955028.000000000084C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275002848.0000000000854000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275039466.0000000000856000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275070774.0000000000865000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275107825.0000000000866000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275139356.000000000086E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275173148.000000000087A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275223517.000000000089A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.000000000089B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275404756.0000000000902000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275448792.0000000000903000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.0000000000904000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.000000000090A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275561073.0000000000919000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275599085.000000000091A000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_570000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!W$`!W
API String ID: 2659868963-1309570094
Opcode ID: 6a875beb7af8cd0826c44e8cf92bde6394dff30081b879ca02400d6f08f4591a
Instruction ID: 787746f53ecc4a668d5880140d964008c5d3a140de443cd86299eeb77bf4f77d
Opcode Fuzzy Hash: 6a875beb7af8cd0826c44e8cf92bde6394dff30081b879ca02400d6f08f4591a
Instruction Fuzzy Hash: 14E017B26042189FD718DF88E805C86BFEDEB15755745C43EF64DDB301E6B0E8248BA8

Function 00572230 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0057224E

Strings

`!W, xrefs: 0057223C
`!W, xrefs: 00572256

Memory Dump Source

Source File: 00000008.00000002.3274002949.0000000000571000.00000040.00000001.01000000.00000005.sdmp, Offset: 00570000, based on PE: true

Associated: 00000008.00000002.3273933375.0000000000570000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274002949.00000000006A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274200285.00000000006A8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274233621.00000000006AB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274263488.00000000006AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274295748.00000000006B6000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274325253.00000000006B7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274363388.00000000006B8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274595752.0000000000810000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274651675.0000000000812000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274697776.000000000082C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274727274.000000000082E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.000000000082F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274753399.0000000000838000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274831437.000000000083C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274871919.0000000000844000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274914274.000000000084B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3274955028.000000000084C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275002848.0000000000854000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275039466.0000000000856000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275070774.0000000000865000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275107825.0000000000866000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275139356.000000000086E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275173148.000000000087A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275223517.000000000089A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.000000000089B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275268863.00000000008D5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275404756.0000000000902000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275448792.0000000000903000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.0000000000904000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275483019.000000000090A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275561073.0000000000919000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3275599085.000000000091A000.00000080.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_570000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!W$`!W
API String ID: 2659868963-1309570094
Opcode ID: 9422a05edc101d84051c1e413902affd673cd1077de424739517e15d869d36a0
Instruction ID: 57985fab7dc98aac6c42500ac0b59842d380082e2ae0c9e5ecbe7ee87899265f
Opcode Fuzzy Hash: 9422a05edc101d84051c1e413902affd673cd1077de424739517e15d869d36a0
Instruction Fuzzy Hash: DBE0E2B2A042149BD7189F88E801886BBEDAA15755745C43EF649DB301E6B0E8248BA8

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LisectAVT_2403002A_191.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\MPGPH131\MPGPH131.exe

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
LisectAVT_2403002A_191.exe

Function 0015B6A0 Relevance: 21.8, APIs: 4, Strings: 8, Instructions: 840
registryCOMMON

Function 0016E0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Function 001CA520 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 234
COMMON

Function 0015A690 Relevance: 4.6, APIs: 3, Instructions: 93
COMMON

Function 0015A090 Relevance: 3.3, APIs: 2, Instructions: 342
COMMON

Function 00244623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Function 0024549C Relevance: 1.7, APIs: 1, Instructions: 198
fileCOMMON

Function 00234942 Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Function 001C0560 Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Function 00244B12 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 0023E05C Relevance: 1.6, APIs: 1, Instructions: 54
COMMONLIBRARYCODE

Function 0022F290 Relevance: 1.6, APIs: 1, Instructions: 51
COMMONLIBRARYCODE