Edit tour

Windows Analysis Report
LisectAVT_2403002A_185.exe

Overview

General Information

Sample name:	LisectAVT_2403002A_185.exe
Analysis ID:	1482448
MD5:	e4561ad384f825254ddf8335308bbbcf
SHA1:	0379bbd4b8684caa337908286b870f5e38a58693
SHA256:	8506917c0d92df1de8f1f7e6883669a0190d9997532a653d085d51a4e2123d13
Tags:	exe
Infos:

Detection

RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Yara detected RisePro Stealer

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Potentially malicious time measurement code found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Uses schtasks.exe or at.exe to add and modify task schedules

Abnormal high CPU Usage

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to read the PEB

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

LisectAVT_2403002A_185.exe (PID: 7284 cmdline: "C:\Users\user\Desktop\LisectAVT_2403002A_185.exe" MD5: E4561AD384F825254DDF8335308BBBCF)

schtasks.exe (PID: 7472 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7520 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MPGPH131.exe (PID: 7572 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: E4561AD384F825254DDF8335308BBBCF)

MPGPH131.exe (PID: 7584 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: E4561AD384F825254DDF8335308BBBCF)

RageMP131.exe (PID: 7884 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: E4561AD384F825254DDF8335308BBBCF)

RageMP131.exe (PID: 8148 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: E4561AD384F825254DDF8335308BBBCF)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000007.00000003.1393916127.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000008.00000003.1468115557.0000000005100000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000006.00000003.1392470110.00000000049C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000003.1331208487.00000000050E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000A.00000003.1548941705.00000000051A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: LisectAVT_2403002A_185.exe PID: 7284	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 7572	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 7584	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 7884	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 8148	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe, ProcessId: 7284, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.9 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T23:07:58.426243+0200
SID:	2046269
Source Port:	49707
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE RisePro TCP Heartbeat Packet - Source IP: 192.168.2.9 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T23:07:49.737468+0200
SID:	2049060
Source Port:	49706
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.9 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T23:07:52.722847+0200
SID:	2046269
Source Port:	49706
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.127.169.103 - Destination IP: 192.168.2.9

Timestamp:	2024-07-25T23:08:30.745853+0200
SID:	2022930
Source Port:	443
Destination Port:	64440
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.9 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T23:08:12.379153+0200
SID:	2046269
Source Port:	49712
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.9 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T23:08:04.317411+0200
SID:	2046269
Source Port:	49709
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE RisePro TCP Heartbeat Packet - Source IP: 192.168.2.9 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T23:07:55.457201+0200
SID:	2049060
Source Port:	49708
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.9 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T23:07:58.426100+0200
SID:	2046269
Source Port:	49708
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.127.169.103 - Destination IP: 192.168.2.9

Timestamp:	2024-07-25T23:08:03.751669+0200
SID:	2022930
Source Port:	443
Destination Port:	49710
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: LisectAVT_2403002A_185.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Avira: detection malicious, Label: TR/Redcap.xyhrk
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Avira: detection malicious, Label: TR/Redcap.xyhrk

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: LisectAVT_2403002A_185.exe

Joe Sandbox ML: detected

Source: LisectAVT_2403002A_185.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 193.233.132.74 ports 0,5,7,8,58709,9

Source: global traffic

TCP traffic: 192.168.2.9:49706 -> 193.233.132.74:58709

Source: Joe Sandbox View

IP Address: 193.233.132.74 193.233.132.74

Source: Joe Sandbox View

ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU

Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74

Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe

Code function: 0_2_0083E0A0 recv,setsockopt,WSAStartup,closesocket,socket,connect,closesocket,

0_2_0083E0A0

Source: LisectAVT_2403002A_185.exe, 00000000.00000003.1331208487.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002A_185.exe, 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000006.00000003.1392470110.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1393916127.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000003.1468115557.0000000005100000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000003.1548941705.00000000051A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: LisectAVT_2403002A_185.exe, 00000000.00000003.1331208487.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002A_185.exe, 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000006.00000003.1392470110.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1393916127.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000003.1468115557.0000000005100000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000003.1548941705.00000000051A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: LisectAVT_2403002A_185.exe, 00000000.00000002.3789734640.000000000138E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3789661923.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3789574147.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3789735499.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.3790015018.0000000001478000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: RageMP131.exe, 0000000A.00000002.3790015018.0000000001478000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTD
Source: LisectAVT_2403002A_185.exe, 00000000.00000002.3789734640.000000000138E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTN

System Summary

PE file contains section with special chars

Source: LisectAVT_2403002A_185.exe	Static PE information: section name:
Source: LisectAVT_2403002A_185.exe	Static PE information: section name: .idata
Source: LisectAVT_2403002A_185.exe	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name: .idata
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name: .idata
Source: MPGPH131.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_008A9880	0_2_008A9880
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_008950B0	0_2_008950B0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_00919824	0_2_00919824
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_008291A0	0_2_008291A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_00DBD1AE	0_2_00DBD1AE
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_008973F0	0_2_008973F0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_009084A0	0_2_009084A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_00902CE0	0_2_00902CE0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_008224F0	0_2_008224F0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_0090646A	0_2_0090646A
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_008A55B0	0_2_008A55B0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_008A6550	0_2_008A6550
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_00828D70	0_2_00828D70
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_0090BEAF	0_2_0090BEAF
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_00839F50	0_2_00839F50
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00309824	6_2_00309824
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002850B0	6_2_002850B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00299880	6_2_00299880
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002191A0	6_2_002191A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_007AD1AE	6_2_007AD1AE
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002873F0	6_2_002873F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002F646A	6_2_002F646A
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002F84A0	6_2_002F84A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002F2CE0	6_2_002F2CE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002124F0	6_2_002124F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00218D70	6_2_00218D70
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00296550	6_2_00296550
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002955B0	6_2_002955B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002FBEAF	6_2_002FBEAF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0030F771	6_2_0030F771
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00229F50	6_2_00229F50
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00309824	7_2_00309824
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_002850B0	7_2_002850B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00299880	7_2_00299880
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_002191A0	7_2_002191A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_007AD1AE	7_2_007AD1AE
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_002873F0	7_2_002873F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_002F646A	7_2_002F646A
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_002F84A0	7_2_002F84A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_002F2CE0	7_2_002F2CE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_002124F0	7_2_002124F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00218D70	7_2_00218D70
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00296550	7_2_00296550
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_002955B0	7_2_002955B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_002FBEAF	7_2_002FBEAF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_0030F771	7_2_0030F771
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00229F50	7_2_00229F50
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_008C9880	8_2_008C9880
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_008B50B0	8_2_008B50B0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00939824	8_2_00939824
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_008491A0	8_2_008491A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00DDD1AE	8_2_00DDD1AE
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_008B73F0	8_2_008B73F0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_009284A0	8_2_009284A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00922CE0	8_2_00922CE0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_008424F0	8_2_008424F0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_0092646A	8_2_0092646A
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_008C55B0	8_2_008C55B0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_008C6550	8_2_008C6550
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00848D70	8_2_00848D70
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00989680	8_2_00989680
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_0092BEAF	8_2_0092BEAF
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00859F50	8_2_00859F50
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_008C9880	10_2_008C9880
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_008B50B0	10_2_008B50B0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00939824	10_2_00939824
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_008491A0	10_2_008491A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00DDD1AE	10_2_00DDD1AE
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_008B73F0	10_2_008B73F0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_009284A0	10_2_009284A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00922CE0	10_2_00922CE0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_008424F0	10_2_008424F0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_0092646A	10_2_0092646A
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_008C55B0	10_2_008C55B0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_008C6550	10_2_008C6550
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00848D70	10_2_00848D70
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00989680	10_2_00989680
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_0092BEAF	10_2_0092BEAF
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00859F50	10_2_00859F50

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 002EFED0 appears 52 times
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: String function: 0091FED0 appears 52 times

Source: LisectAVT_2403002A_185.exe, 00000000.00000002.3792420626.00000000050D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefilezilla.exe4 vs LisectAVT_2403002A_185.exe
Source: LisectAVT_2403002A_185.exe, 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamefilezilla.exe4 vs LisectAVT_2403002A_185.exe
Source: LisectAVT_2403002A_185.exe	Binary or memory string: OriginalFilenamefilezilla.exe4 vs LisectAVT_2403002A_185.exe

Source: LisectAVT_2403002A_185.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: LisectAVT_2403002A_185.exe	Static PE information: Section: ZLIB complexity 0.9993641774891775
Source: LisectAVT_2403002A_185.exe	Static PE information: Section: kcbbzddg ZLIB complexity 0.9894442103215768
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9993641774891775
Source: RageMP131.exe.0.dr	Static PE information: Section: kcbbzddg ZLIB complexity 0.9894442103215768
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9993641774891775
Source: MPGPH131.exe.0.dr	Static PE information: Section: kcbbzddg ZLIB complexity 0.9894442103215768

Source: classification engine

Classification label: mal100.troj.evad.winEXE@11/5@0/1

Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe

File created: C:\Users\user\AppData\Local\RageMP131

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7480:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7528:120:WilError_03

Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe

File created: C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Jump to behavior

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Command line argument: nI1		6_2_003148C0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Command line argument: nI1		7_2_003148C0

Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: LisectAVT_2403002A_185.exe, 00000000.00000003.1331208487.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002A_185.exe, 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000006.00000003.1392470110.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1393916127.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000003.1468115557.0000000005100000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000003.1548941705.00000000051A0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: LisectAVT_2403002A_185.exe, 00000000.00000003.1331208487.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002A_185.exe, 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000006.00000003.1392470110.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1393916127.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000003.1468115557.0000000005100000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000003.1548941705.00000000051A0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

Source: LisectAVT_2403002A_185.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: MPGPH131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: MPGPH131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: RageMP131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: RageMP131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe

File read: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe "C:\Users\user\Desktop\LisectAVT_2403002A_185.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll	Jump to behavior

Source: LisectAVT_2403002A_185.exe

Static file information: File size 2328582 > 1048576

Source: LisectAVT_2403002A_185.exe

Static PE information: Raw size of kcbbzddg is bigger than: 0x100000 < 0x1a5c00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Unpacked PE file: 0.2.LisectAVT_2403002A_185.exe.820000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kcbbzddg:EW;ixbabcmr:EW; vs :ER;.rsrc:W;.idata :W; :EW;kcbbzddg:EW;ixbabcmr:EW;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 6.2.MPGPH131.exe.210000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kcbbzddg:EW;ixbabcmr:EW; vs :ER;.rsrc:W;.idata :W; :EW;kcbbzddg:EW;ixbabcmr:EW;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 7.2.MPGPH131.exe.210000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kcbbzddg:EW;ixbabcmr:EW; vs :ER;.rsrc:W;.idata :W; :EW;kcbbzddg:EW;ixbabcmr:EW;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 8.2.RageMP131.exe.840000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kcbbzddg:EW;ixbabcmr:EW; vs :ER;.rsrc:W;.idata :W; :EW;kcbbzddg:EW;ixbabcmr:EW;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 10.2.RageMP131.exe.840000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kcbbzddg:EW;ixbabcmr:EW; vs :ER;.rsrc:W;.idata :W; :EW;kcbbzddg:EW;ixbabcmr:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: ixbabcmr

Source: RageMP131.exe.0.dr	Static PE information: real checksum: 0x2397e9 should be: 0x2397ef
Source: LisectAVT_2403002A_185.exe	Static PE information: real checksum: 0x2397e9 should be: 0x2397ef
Source: MPGPH131.exe.0.dr	Static PE information: real checksum: 0x2397e9 should be: 0x2397ef

Source: LisectAVT_2403002A_185.exe	Static PE information: section name:
Source: LisectAVT_2403002A_185.exe	Static PE information: section name: .idata
Source: LisectAVT_2403002A_185.exe	Static PE information: section name:
Source: LisectAVT_2403002A_185.exe	Static PE information: section name: kcbbzddg
Source: LisectAVT_2403002A_185.exe	Static PE information: section name: ixbabcmr
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name: .idata
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name: kcbbzddg
Source: RageMP131.exe.0.dr	Static PE information: section name: ixbabcmr
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name: .idata
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name: kcbbzddg
Source: MPGPH131.exe.0.dr	Static PE information: section name: ixbabcmr

Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_00DBD000 push ebx; mov dword ptr [esp], 284FAD0Eh	0_2_00DBD001
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_00DBD000 push edx; mov dword ptr [esp], eax	0_2_00DBD04F
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_00DBD000 push 0BE3668Ah; mov dword ptr [esp], ecx	0_2_00DBD08E
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_00DBD000 push ebp; mov dword ptr [esp], ecx	0_2_00DBD0B5
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_00DBD000 push eax; mov dword ptr [esp], 7FEFE69Fh	0_2_00DBD0F0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_00DBD000 push esi; mov dword ptr [esp], ecx	0_2_00DBD114
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_00DBD000 push 4252E962h; mov dword ptr [esp], ecx	0_2_00DBD16A
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_00DBD03C push edx; mov dword ptr [esp], eax	0_2_00DBD04F
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_00DBD03C push 0BE3668Ah; mov dword ptr [esp], ecx	0_2_00DBD08E
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_00DBD03C push ebp; mov dword ptr [esp], ecx	0_2_00DBD0B5
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_00DBD03C push eax; mov dword ptr [esp], 7FEFE69Fh	0_2_00DBD0F0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_00DBD03C push esi; mov dword ptr [esp], ecx	0_2_00DBD114
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_00DBD03C push 4252E962h; mov dword ptr [esp], ecx	0_2_00DBD16A
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_00DBD1AE push ecx; mov dword ptr [esp], 4FCF23DBh	0_2_00DBD1AF
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_00DBD1AE push edx; mov dword ptr [esp], esp	0_2_00DBD1DA
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_00DBD1AE push ecx; mov dword ptr [esp], 7DBF004Bh	0_2_00DBD1EB
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_00DBD1AE push edx; mov dword ptr [esp], 6FD36C89h	0_2_00DBD214
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_00DBD1AE push 2588B968h; mov dword ptr [esp], edi	0_2_00DBD24A
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_00DBD1AE push eax; mov dword ptr [esp], ecx	0_2_00DBD260
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_00DBD1AE push ecx; mov dword ptr [esp], ebx	0_2_00DBD26E
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_00DBD1AE push 0A2373CAh; mov dword ptr [esp], ebx	0_2_00DBD2AF
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_00DBD1AE push 5E93CC81h; mov dword ptr [esp], eax	0_2_00DBD36C
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_008FFA97 push ecx; ret	0_2_008FFAAA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_007AD03C push edx; mov dword ptr [esp], eax	6_2_007AD04F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_007AD03C push 0BE3668Ah; mov dword ptr [esp], ecx	6_2_007AD08E
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_007AD03C push ebp; mov dword ptr [esp], ecx	6_2_007AD0B5
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_007AD03C push eax; mov dword ptr [esp], 7FEFE69Fh	6_2_007AD0F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_007AD03C push esi; mov dword ptr [esp], ecx	6_2_007AD114
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_007AD03C push 4252E962h; mov dword ptr [esp], ecx	6_2_007AD16A
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_007AD000 push ebx; mov dword ptr [esp], 284FAD0Eh	6_2_007AD001
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_007AD000 push edx; mov dword ptr [esp], eax	6_2_007AD04F

Source: LisectAVT_2403002A_185.exe	Static PE information: section name: entropy: 7.985397454316368
Source: LisectAVT_2403002A_185.exe	Static PE information: section name: kcbbzddg entropy: 7.949002544785609
Source: RageMP131.exe.0.dr	Static PE information: section name: entropy: 7.985397454316368
Source: RageMP131.exe.0.dr	Static PE information: section name: kcbbzddg entropy: 7.949002544785609
Source: MPGPH131.exe.0.dr	Static PE information: section name: entropy: 7.985397454316368
Source: MPGPH131.exe.0.dr	Static PE information: section name: kcbbzddg entropy: 7.949002544785609

Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe			Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe			Jump to dropped file

Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe

File created: C:\ProgramData\MPGPH131\MPGPH131.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep	graph_0-18934
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep	graph_6-18835
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep	graph_8-19142

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 95FFFB second address: 960008 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AE27B4 second address: AE27D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F74ACBF05E9h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AE27D3 second address: AE27D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AE27D7 second address: AE2823 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACBF05E3h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F74ACBF05E6h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F74ACBF05E9h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AE1771 second address: AE1776 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AE1776 second address: AE1780 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AE1780 second address: AE178D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007F74AD0D7CD2h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AE1D4D second address: AE1D68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACBF05E1h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AE1D68 second address: AE1D70 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AE1D70 second address: AE1D7A instructions: 0x00000000 rdtsc 0x00000002 jl 00007F74ACBF05E2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AE1D7A second address: AE1D80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AE1D80 second address: AE1DA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F74ACBF05E2h 0x0000000a jmp 00007F74ACBF05DCh 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 jo 00007F74ACBF05D6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AE1DA3 second address: AE1DA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: ADB935 second address: ADB956 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F74ACBF05E6h 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AE5F17 second address: AE5F21 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F74AD0D7CC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AE5FA3 second address: AE5FA9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AE5FA9 second address: AE5FAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AE605D second address: AE6084 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACBF05E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d jnp 00007F74ACBF05D6h 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AE6084 second address: AE6088 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AE6088 second address: AE608C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AE61ED second address: AE61FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [eax] 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007F74AD0D7CC8h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AE61FE second address: AE620F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AE620F second address: AE623F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AD0D7CCFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a pop eax 0x0000000b mov dword ptr [ebp+122D1EECh], edi 0x00000011 lea ebx, dword ptr [ebp+12459E77h] 0x00000017 sub di, D10Eh 0x0000001c push eax 0x0000001d push esi 0x0000001e jnp 00007F74AD0D7CCCh 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AE62C1 second address: AE633B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACBF05E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jne 00007F74ACBF05E4h 0x00000010 pushad 0x00000011 jc 00007F74ACBF05D6h 0x00000017 ja 00007F74ACBF05D6h 0x0000001d popad 0x0000001e mov eax, dword ptr [esp+04h] 0x00000022 jmp 00007F74ACBF05E9h 0x00000027 mov eax, dword ptr [eax] 0x00000029 pushad 0x0000002a jp 00007F74ACBF05E6h 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F74ACBF05E0h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AE633B second address: AE63A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push edi 0x0000000c jnl 00007F74AD0D7CC8h 0x00000012 pop edi 0x00000013 pop eax 0x00000014 jng 00007F74AD0D7CD2h 0x0000001a push 00000003h 0x0000001c jne 00007F74AD0D7CCCh 0x00000022 adc esi, 7CC70656h 0x00000028 adc di, FFE3h 0x0000002d push 00000000h 0x0000002f mov esi, 1E38E814h 0x00000034 push 00000003h 0x00000036 call 00007F74AD0D7CD9h 0x0000003b pop esi 0x0000003c push 4842F373h 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AE63A3 second address: AE63AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F74ACBF05D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AF6D8A second address: AF6D91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AF6D91 second address: AF6DB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007F74ACBF05E5h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B04683 second address: B04689 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B04689 second address: B0468F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B04BB1 second address: B04BB7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B04D0C second address: B04D30 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F74ACBF05E7h 0x0000000e popad 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B0512D second address: B0514D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F74AD0D7CD6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B0514D second address: B0515D instructions: 0x00000000 rdtsc 0x00000002 js 00007F74ACBF05D6h 0x00000008 jnp 00007F74ACBF05D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B0515D second address: B05162 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B05162 second address: B05184 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F74ACBF05D6h 0x0000000a jmp 00007F74ACBF05E3h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B05616 second address: B0561A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B0561A second address: B0561E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B05758 second address: B0575E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B0575E second address: B05762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B05762 second address: B05766 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B05766 second address: B05772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F74ACBF05D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B05772 second address: B05777 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B05777 second address: B057A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007F74ACBF05DCh 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007F74ACBF05DCh 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B05D34 second address: B05D3A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B05D3A second address: B05D56 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jbe 00007F74ACBF05D6h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pushad 0x00000010 popad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 ja 00007F74ACBF05D6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B05D56 second address: B05D5E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B05D5E second address: B05D63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B06087 second address: B06091 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B06091 second address: B060A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F74ACBF05DDh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B060A9 second address: B060CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AD0D7CD3h 0x00000007 jmp 00007F74AD0D7CCFh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B06238 second address: B0623C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B0623C second address: B06242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B06242 second address: B06248 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B06248 second address: B0625D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74AD0D7CD1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AFAEA3 second address: AFAEB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 jo 00007F74ACBF05D6h 0x0000000b jmp 00007F74ACBF05DAh 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AC9283 second address: AC9287 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AC9287 second address: AC9299 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b jnl 00007F74ACBF05D6h 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AC9299 second address: AC92AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AD0D7CCEh 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AC92AC second address: AC92CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F74ACBF05DEh 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AC92CA second address: AC92D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AC92D3 second address: AC92D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AC92D7 second address: AC92DD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AC92DD second address: AC92E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AC92E3 second address: AC92E8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B0B89E second address: B0B8BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74ACBF05E9h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B116B6 second address: B116CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jmp 00007F74AD0D7CD1h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B11857 second address: B1185C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B11D10 second address: B11D2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AD0D7CD6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B12989 second address: B1298E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B1298E second address: B12998 instructions: 0x00000000 rdtsc 0x00000002 je 00007F74AD0D7CCCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B12998 second address: B129C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F74ACBF05DCh 0x0000000e pop edx 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 pushad 0x00000014 jns 00007F74ACBF05DCh 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B12C53 second address: B12C5D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F74AD0D7CCCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B13044 second address: B1305E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F74ACBF05E6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B134DB second address: B1350E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jg 00007F74AD0D7CC6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], ebx 0x00000011 mov edi, dword ptr [ebp+122D1EABh] 0x00000017 mov dword ptr [ebp+122D3349h], esi 0x0000001d nop 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F74AD0D7CD3h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B1377D second address: B13788 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B13788 second address: B1378E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B1378E second address: B13793 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B13793 second address: B13799 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B13799 second address: B1379D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B139C7 second address: B139CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B139CB second address: B139D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B139D1 second address: B139DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F74AD0D7CC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B139DB second address: B139DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B139DF second address: B139FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007F74AD0D7CD3h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B14014 second address: B14034 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACBF05DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a je 00007F74ACBF05E4h 0x00000010 pushad 0x00000011 jc 00007F74ACBF05D6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B16B64 second address: B16B73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jc 00007F74AD0D7CCEh 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B16B73 second address: B16B77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B16B77 second address: B16BB1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F74AD0D7CD0h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 ja 00007F74AD0D7CC6h 0x00000016 jmp 00007F74AD0D7CD9h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: ACE3F7 second address: ACE3FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B171B1 second address: B171B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B171B7 second address: B171BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B17CF6 second address: B17D25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push edx 0x0000000c or dword ptr [ebp+12452F22h], esi 0x00000012 pop esi 0x00000013 push 00000000h 0x00000015 mov esi, 5471F417h 0x0000001a push 00000000h 0x0000001c sub dword ptr [ebp+122D1986h], esi 0x00000022 xchg eax, ebx 0x00000023 pushad 0x00000024 ja 00007F74AD0D7CC8h 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B17A77 second address: B17A7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B17D25 second address: B17D36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F74AD0D7CC6h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push ebx 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B17A7B second address: B17A8C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F74ACBF05D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B17A8C second address: B17A90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B1855D second address: B18580 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACBF05E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b jnc 00007F74ACBF05F1h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B193B3 second address: B193BD instructions: 0x00000000 rdtsc 0x00000002 js 00007F74AD0D7CC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B1A969 second address: B1A96E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B1A96E second address: B1A9DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007F74AD0D7CC8h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 mov edi, 34F9BDA5h 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ecx 0x00000030 call 00007F74AD0D7CC8h 0x00000035 pop ecx 0x00000036 mov dword ptr [esp+04h], ecx 0x0000003a add dword ptr [esp+04h], 0000001Bh 0x00000042 inc ecx 0x00000043 push ecx 0x00000044 ret 0x00000045 pop ecx 0x00000046 ret 0x00000047 push 00000000h 0x00000049 xchg eax, ebx 0x0000004a push edi 0x0000004b jmp 00007F74AD0D7CD0h 0x00000050 pop edi 0x00000051 push eax 0x00000052 pushad 0x00000053 pushad 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B1A9DA second address: B1A9E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B1FA3D second address: B1FA41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B1FA41 second address: B1FA47 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B1FA47 second address: B1FA81 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AD0D7CD3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov ebx, dword ptr [ebp+12469855h] 0x00000012 mov ebx, 027B41ACh 0x00000017 push 00000000h 0x00000019 mov ebx, dword ptr [ebp+122D3708h] 0x0000001f push 00000000h 0x00000021 mov bx, D6AAh 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 push ebx 0x00000029 push eax 0x0000002a pop eax 0x0000002b pop ebx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B1FA81 second address: B1FA8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F74ACBF05D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B1FA8B second address: B1FA8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B219EA second address: B219EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B20CDC second address: B20CE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B20DA4 second address: B20DA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B20DA8 second address: B20DAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B22B52 second address: B22B5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B22B5F second address: B22B63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B22B63 second address: B22B69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B23AED second address: B23AF2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B22D19 second address: B22D22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B23AF2 second address: B23B3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 adc bx, 7E63h 0x0000000d push 00000000h 0x0000000f jo 00007F74AD0D7CCCh 0x00000015 xor dword ptr [ebp+122D2006h], eax 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ecx 0x00000020 call 00007F74AD0D7CC8h 0x00000025 pop ecx 0x00000026 mov dword ptr [esp+04h], ecx 0x0000002a add dword ptr [esp+04h], 00000017h 0x00000032 inc ecx 0x00000033 push ecx 0x00000034 ret 0x00000035 pop ecx 0x00000036 ret 0x00000037 mov dword ptr [ebp+122D297Ah], edx 0x0000003d xchg eax, esi 0x0000003e push eax 0x0000003f push edx 0x00000040 je 00007F74AD0D7CC8h 0x00000046 push ecx 0x00000047 pop ecx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B22D22 second address: B22D26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B23B3F second address: B23B50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F74AD0D7CCDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B25BD2 second address: B25BDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F74ACBF05D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B25BDD second address: B25BFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AD0D7CCFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jc 00007F74AD0D7CD0h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B24D6B second address: B24D6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B24D6F second address: B24D78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B24D78 second address: B24D7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B24D7E second address: B24D98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F74AD0D7CD1h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B27AA6 second address: B27AD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACBF05DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007F74ACBF05DCh 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push esi 0x00000015 pop esi 0x00000016 jmp 00007F74ACBF05DDh 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B28A08 second address: B28A23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AD0D7CD7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B28A23 second address: B28ACA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACBF05DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007F74ACBF05D8h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 mov edi, dword ptr [ebp+122D355Ch] 0x0000002c jmp 00007F74ACBF05E0h 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push ecx 0x00000036 call 00007F74ACBF05D8h 0x0000003b pop ecx 0x0000003c mov dword ptr [esp+04h], ecx 0x00000040 add dword ptr [esp+04h], 0000001Dh 0x00000048 inc ecx 0x00000049 push ecx 0x0000004a ret 0x0000004b pop ecx 0x0000004c ret 0x0000004d sub dword ptr [ebp+122D1EB9h], esi 0x00000053 push 00000000h 0x00000055 push ecx 0x00000056 jno 00007F74ACBF05DCh 0x0000005c pop edi 0x0000005d xchg eax, esi 0x0000005e jmp 00007F74ACBF05E1h 0x00000063 push eax 0x00000064 push edx 0x00000065 pushad 0x00000066 pushad 0x00000067 popad 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B299BC second address: B299C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B28C07 second address: B28C17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F74ACBF05DCh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B28C17 second address: B28C1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B29B76 second address: B29B7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B29B7A second address: B29B80 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B29B80 second address: B29B92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B29B92 second address: B29B97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B29B97 second address: B29BA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F74ACBF05D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B2BA1D second address: B2BA21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B2BC50 second address: B2BC5D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F74ACBF05D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B2CE39 second address: B2CE3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B2DB80 second address: B2DBBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov dword ptr [ebp+122D568Eh], edi 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007F74ACBF05D8h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 00000014h 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b xor dword ptr [ebp+122D1F88h], ecx 0x00000031 push 00000000h 0x00000033 movzx ebx, di 0x00000036 xchg eax, esi 0x00000037 pushad 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B2CE3D second address: B2CE4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b jng 00007F74AD0D7CC6h 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B2DBBE second address: B2DBCC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F74ACBF05DCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B2CE4F second address: B2CE54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B34C76 second address: B34CA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jbe 00007F74ACBF05F0h 0x0000000b jnl 00007F74ACBF05D6h 0x00000011 jmp 00007F74ACBF05E4h 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B3474F second address: B34774 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F74AD0D7CC6h 0x0000000a jl 00007F74AD0D7CC6h 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007F74AD0D7CD1h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B34774 second address: B3477A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B3477A second address: B34786 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B34786 second address: B3478C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B348CC second address: B348DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 jo 00007F74AD0D7CF7h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B348DD second address: B348E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B348E1 second address: B34905 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnp 00007F74AD0D7CC6h 0x0000000d jmp 00007F74AD0D7CD5h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B3B45F second address: B3B463 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B3B463 second address: B3B469 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B3B469 second address: B3B46F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: ACC7FC second address: ACC804 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B3BFF8 second address: B3BFFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B3BFFD second address: B3C003 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B3C003 second address: B3C055 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F74ACBF05E2h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jne 00007F74ACBF05EBh 0x00000017 mov eax, dword ptr [eax] 0x00000019 push eax 0x0000001a push edx 0x0000001b push ebx 0x0000001c jmp 00007F74ACBF05E3h 0x00000021 pop ebx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B3C055 second address: B3C05A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B3C05A second address: B3C08E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c jmp 00007F74ACBF05E7h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F74ACBF05DFh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B3C212 second address: B3C229 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AD0D7CD3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B3C229 second address: B3C25C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F74ACBF05E5h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F74ACBF05E5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B3C25C second address: B3C26C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B3C26C second address: B3C287 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F74ACBF05DFh 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d push edi 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B3C384 second address: B3C3E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F74AD0D7CD9h 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007F74AD0D7CD8h 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 jmp 00007F74AD0D7CCAh 0x0000001c mov eax, dword ptr [eax] 0x0000001e push eax 0x0000001f push edx 0x00000020 jns 00007F74AD0D7CD2h 0x00000026 jmp 00007F74AD0D7CCCh 0x0000002b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B3C3E2 second address: B3C3F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F74ACBF05DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B3C3F2 second address: B3C40B instructions: 0x00000000 rdtsc 0x00000002 js 00007F74AD0D7CC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 jnp 00007F74AD0D7CC6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B3C40B second address: B3C414 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B40083 second address: B4008B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B401D3 second address: B401DD instructions: 0x00000000 rdtsc 0x00000002 je 00007F74ACBF05D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B401DD second address: B401F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F74AD0D7CCFh 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B405D7 second address: B405DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B405DB second address: B405E5 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F74AD0D7CC6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B407A5 second address: B407B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007F74ACBF05D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B407B5 second address: B407C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74AD0D7CCBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B408EF second address: B4092C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74ACBF05E3h 0x00000009 jmp 00007F74ACBF05E5h 0x0000000e popad 0x0000000f jmp 00007F74ACBF05E0h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B40C6D second address: B40C7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AD0D7CCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B40C7F second address: B40C97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F74ACBF05E0h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B4720E second address: B47214 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B47214 second address: B47218 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B47218 second address: B47226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F74AD0D7CCCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B463F4 second address: B4640E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74ACBF05E6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B4640E second address: B46437 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jp 00007F74AD0D7CDEh 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B46C5C second address: B46C71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jo 00007F74ACBF05D6h 0x0000000e jp 00007F74ACBF05D6h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AFBA7C second address: AFBA80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: AFBA80 second address: AFBA8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F74ACBF05D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B47091 second address: B470B2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F74AD0D7CD8h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B470B2 second address: B470BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B4A2F7 second address: B4A2FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B4E762 second address: B4E766 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B4E766 second address: B4E76A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B1BCDC second address: B1BCE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B1BF43 second address: B1BF47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B1BFD6 second address: B1C005 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACBF05E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F74ACBF05E3h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B1C245 second address: B1C2A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AD0D7CD6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], esi 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007F74AD0D7CC8h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000015h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 call 00007F74AD0D7CCDh 0x0000002b jmp 00007F74AD0D7CCFh 0x00000030 pop edx 0x00000031 push eax 0x00000032 push ebx 0x00000033 push eax 0x00000034 push edx 0x00000035 push ecx 0x00000036 pop ecx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B1C33D second address: B1C341 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B1CB19 second address: B1CBC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AD0D7CCEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c movsx ecx, di 0x0000000f add edx, 255C73AFh 0x00000015 lea eax, dword ptr [ebp+1248F90Fh] 0x0000001b push 00000000h 0x0000001d push edi 0x0000001e call 00007F74AD0D7CC8h 0x00000023 pop edi 0x00000024 mov dword ptr [esp+04h], edi 0x00000028 add dword ptr [esp+04h], 0000001Ch 0x00000030 inc edi 0x00000031 push edi 0x00000032 ret 0x00000033 pop edi 0x00000034 ret 0x00000035 nop 0x00000036 jmp 00007F74AD0D7CCAh 0x0000003b push eax 0x0000003c jno 00007F74AD0D7CCCh 0x00000042 nop 0x00000043 push 00000000h 0x00000045 push ebx 0x00000046 call 00007F74AD0D7CC8h 0x0000004b pop ebx 0x0000004c mov dword ptr [esp+04h], ebx 0x00000050 add dword ptr [esp+04h], 00000017h 0x00000058 inc ebx 0x00000059 push ebx 0x0000005a ret 0x0000005b pop ebx 0x0000005c ret 0x0000005d or dword ptr [ebp+122D5725h], esi 0x00000063 lea eax, dword ptr [ebp+1248F8CBh] 0x00000069 mov dword ptr [ebp+12452FDEh], ebx 0x0000006f nop 0x00000070 jmp 00007F74AD0D7CCCh 0x00000075 push eax 0x00000076 jbe 00007F74AD0D7CD2h 0x0000007c jp 00007F74AD0D7CCCh 0x00000082 push eax 0x00000083 push edx 0x00000084 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B1CBC7 second address: AFBA7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 nop 0x00000005 push 00000000h 0x00000007 push ebp 0x00000008 call 00007F74ACBF05D8h 0x0000000d pop ebp 0x0000000e mov dword ptr [esp+04h], ebp 0x00000012 add dword ptr [esp+04h], 0000001Bh 0x0000001a inc ebp 0x0000001b push ebp 0x0000001c ret 0x0000001d pop ebp 0x0000001e ret 0x0000001f jnl 00007F74ACBF05D7h 0x00000025 mov ecx, dword ptr [ebp+122D1E16h] 0x0000002b call dword ptr [ebp+122D2D82h] 0x00000031 pushad 0x00000032 jmp 00007F74ACBF05DCh 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F74ACBF05DEh 0x0000003e pushad 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B4D989 second address: B4D999 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jng 00007F74AD0D7CC6h 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B4D999 second address: B4D9A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F74ACBF05D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B1BBA2 second address: AFAEA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F74AD0D7CD1h 0x0000000e popad 0x0000000f pop eax 0x00000010 nop 0x00000011 mov dword ptr [ebp+122D187Ah], esi 0x00000017 call dword ptr [ebp+12453144h] 0x0000001d push eax 0x0000001e push edx 0x0000001f jnp 00007F74AD0D7CD7h 0x00000025 jmp 00007F74AD0D7CCBh 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B4DB28 second address: B4DB43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACBF05E7h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B53777 second address: B53791 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74AD0D7CD5h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B53791 second address: B537AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACBF05DFh 0x00000007 pushad 0x00000008 jne 00007F74ACBF05D6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B537AB second address: B537B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B53A9E second address: B53AA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F74ACBF05D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B53D7B second address: B53D9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74AD0D7CCFh 0x00000009 pop edi 0x0000000a jo 00007F74AD0D7CCCh 0x00000010 jp 00007F74AD0D7CC6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B53D9B second address: B53DA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F74ACBF05D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B53DA5 second address: B53DA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B53F31 second address: B53F35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B53F35 second address: B53F3F instructions: 0x00000000 rdtsc 0x00000002 jns 00007F74AD0D7CC6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B53F3F second address: B53F59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F74ACBF05D8h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jg 00007F74ACBF05D8h 0x00000014 push esi 0x00000015 pop esi 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B53F59 second address: B53F5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B53465 second address: B53469 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B53469 second address: B53473 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B54211 second address: B5421E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F74ACBF05D6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B5421E second address: B54224 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B54224 second address: B54231 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 je 00007F74ACBF05D6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B54231 second address: B5423A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B5423A second address: B5423E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B544E0 second address: B544E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B54843 second address: B5485F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACBF05E6h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B5485F second address: B54864 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B5C0AD second address: B5C0C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74ACBF05E3h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B5C0C6 second address: B5C0CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B5C0CE second address: B5C0DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F74ACBF05D6h 0x0000000a jns 00007F74ACBF05D6h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B5C0DF second address: B5C0E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B5C0E7 second address: B5C0EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B5BDDD second address: B5BDE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push ecx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B5E0A8 second address: B5E0B2 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F74ACBF05D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B6324F second address: B63265 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74AD0D7CD0h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B63524 second address: B63539 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F74ACBF05DFh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B63539 second address: B6353D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B6353D second address: B63555 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F74ACBF05D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007F74ACBF05D8h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B63555 second address: B6355A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B6355A second address: B63562 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B63817 second address: B6381B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B6381B second address: B6382D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F74ACBF05D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B6382D second address: B63831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B63B16 second address: B63B1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B6472A second address: B64747 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74AD0D7CD9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B64747 second address: B64776 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F74ACBF05EAh 0x0000000c pushad 0x0000000d jns 00007F74ACBF05D6h 0x00000013 jbe 00007F74ACBF05D6h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B69387 second address: B6939A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop eax 0x00000008 jnp 00007F74AD0D7CD0h 0x0000000e pushad 0x0000000f push eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B6868D second address: B68695 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B68695 second address: B68699 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B68699 second address: B686A5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B686A5 second address: B686B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74AD0D7CCBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B68AA2 second address: B68AA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B6C26F second address: B6C275 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B6C275 second address: B6C28D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pushad 0x00000008 jno 00007F74ACBF05DCh 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B6C28D second address: B6C2C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AD0D7CD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F74AD0D7CD4h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B6BA16 second address: B6BA1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B6BA1A second address: B6BA38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F74AD0D7CD3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push esi 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B6BA38 second address: B6BA3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B6FA52 second address: B6FA65 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jo 00007F74AD0D7CC6h 0x00000009 push eax 0x0000000a pop eax 0x0000000b pop edi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B6FA65 second address: B6FA7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F74ACBF05D6h 0x0000000a jmp 00007F74ACBF05DEh 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B6FFE8 second address: B6FFEF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B77481 second address: B7749A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F74ACBF05D6h 0x0000000a jmp 00007F74ACBF05DDh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B75450 second address: B75456 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B75456 second address: B7545A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B7545A second address: B7546F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AD0D7CCEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B759E5 second address: B759EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B759EF second address: B75A02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007F74AD0D7CC8h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B76231 second address: B76236 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B76B4F second address: B76B53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B76B53 second address: B76B59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B76B59 second address: B76B75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jo 00007F74AD0D7CCEh 0x00000010 push eax 0x00000011 pop eax 0x00000012 jc 00007F74AD0D7CC6h 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B76B75 second address: B76B83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74ACBF05DAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B76B83 second address: B76BD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AD0D7CCCh 0x00000007 jmp 00007F74AD0D7CD6h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F74AD0D7CD7h 0x00000016 push ebx 0x00000017 jmp 00007F74AD0D7CCBh 0x0000001c push edx 0x0000001d pop edx 0x0000001e pop ebx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B7B168 second address: B7B16E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B7B16E second address: B7B172 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B7A47F second address: B7A483 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B7A483 second address: B7A489 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B7A489 second address: B7A493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B7A493 second address: B7A497 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B7A497 second address: B7A49B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B7A49B second address: B7A4A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F74AD0D7CC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B7A5EB second address: B7A5EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B7A5EF second address: B7A5F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B7A5F3 second address: B7A602 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F74ACBF05D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B7A602 second address: B7A60F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B7A60F second address: B7A615 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B7A615 second address: B7A633 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007F74AD0D7CD9h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B7ABC1 second address: B7ABF4 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F74ACBF05D6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d pushad 0x0000000e jmp 00007F74ACBF05E1h 0x00000013 jmp 00007F74ACBF05DAh 0x00000018 push eax 0x00000019 push edx 0x0000001a jp 00007F74ACBF05D6h 0x00000020 push esi 0x00000021 pop esi 0x00000022 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B7AEBC second address: B7AEC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B7AEC0 second address: B7AECE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F74ACBF05D6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B7AECE second address: B7AED2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B88BCB second address: B88BD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B86EB4 second address: B86EB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B86EB8 second address: B86EC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B86EC0 second address: B86EC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B871B0 second address: B871B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B87329 second address: B8732D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B8732D second address: B87333 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B87333 second address: B87343 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F74AD0D7CC6h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B8775C second address: B87767 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F74ACBF05D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B87A79 second address: B87A80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B87BC8 second address: B87C12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74ACBF05DDh 0x00000009 jmp 00007F74ACBF05DFh 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jnc 00007F74ACBF05DEh 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F74ACBF05E7h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B87C12 second address: B87C18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B88A4F second address: B88A55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B8696C second address: B86976 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F74AD0D7CCCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B8E3E5 second address: B8E3FB instructions: 0x00000000 rdtsc 0x00000002 jg 00007F74ACBF05DEh 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: ACFE26 second address: ACFE2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: ACFE2C second address: ACFE30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: ACFE30 second address: ACFE3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B8DD89 second address: B8DDA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jl 00007F74ACBF05E1h 0x0000000b jmp 00007F74ACBF05DBh 0x00000010 jo 00007F74ACBF05DCh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B8DECD second address: B8DED7 instructions: 0x00000000 rdtsc 0x00000002 je 00007F74AD0D7CCCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B8DED7 second address: B8DEE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jbe 00007F74ACBF05D6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B8DEE8 second address: B8DF05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F74AD0D7CCDh 0x0000000f jg 00007F74AD0D7CC6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B8DF05 second address: B8DF09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B8E077 second address: B8E099 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F74AD0D7CD9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B8E099 second address: B8E0B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74ACBF05E2h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B9BBA5 second address: B9BBB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F74AD0D7CC6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B9BBB1 second address: B9BBB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B9BBB6 second address: B9BBCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F74AD0D7CC6h 0x0000000a jmp 00007F74AD0D7CCCh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BA40CC second address: BA4103 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F74ACBF05E9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007F74ACBF05D6h 0x00000013 jmp 00007F74ACBF05E0h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BA4103 second address: BA410D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F74AD0D7CC6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BA410D second address: BA4118 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BA4118 second address: BA411E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BA411E second address: BA4129 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BA4129 second address: BA4130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BA4130 second address: BA414B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F74ACBF05E3h 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BACC07 second address: BACC1E instructions: 0x00000000 rdtsc 0x00000002 jg 00007F74AD0D7CC6h 0x00000008 jmp 00007F74AD0D7CCAh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BACC1E second address: BACC24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BB74D2 second address: BB74E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74AD0D7CCAh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BB74E5 second address: BB74F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74ACBF05DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BB74F5 second address: BB7514 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AD0D7CD4h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push ecx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BB5FDB second address: BB5FDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BB6670 second address: BB667A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F74AD0D7CC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BB667A second address: BB667E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BB7189 second address: BB719B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F74AD0D7CC6h 0x0000000a jp 00007F74AD0D7CC6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BB719B second address: BB71CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 jmp 00007F74ACBF05E1h 0x0000000e pop ebx 0x0000000f jmp 00007F74ACBF05E4h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BB8DDA second address: BB8DDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BB8DDE second address: BB8DFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F74ACBF05E1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BBD47D second address: BBD486 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BBD486 second address: BBD490 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F74ACBF05D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BBD490 second address: BBD49A instructions: 0x00000000 rdtsc 0x00000002 ja 00007F74AD0D7CC6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BBD04E second address: BBD052 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BBED96 second address: BBEDE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F74AD0D7CC6h 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F74AD0D7CD0h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push edi 0x00000014 jl 00007F74AD0D7CD3h 0x0000001a jmp 00007F74AD0D7CCDh 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F74AD0D7CD9h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BBEBFA second address: BBEC01 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BCAFB2 second address: BCAFB7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BCAFB7 second address: BCAFD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F74ACBF05D6h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F74ACBF05DEh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BD1A0B second address: BD1A0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BD5313 second address: BD5326 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74ACBF05DFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BD5326 second address: BD5335 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jbe 00007F74AD0D7CC6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BCD2C1 second address: BCD2CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F74ACBF05D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BCD2CD second address: BCD300 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F74AD0D7CD0h 0x00000008 pushad 0x00000009 popad 0x0000000a jo 00007F74AD0D7CC6h 0x00000010 popad 0x00000011 jp 00007F74AD0D7CCCh 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push ecx 0x0000001a jl 00007F74AD0D7CCCh 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BE2B2D second address: BE2B4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F74ACBF05E6h 0x0000000b push eax 0x0000000c pop eax 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: BE2B4C second address: BE2B58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F74AD0D7CC6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: C05B7D second address: C05B81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: C04901 second address: C04920 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F74AD0D7CC6h 0x00000008 jmp 00007F74AD0D7CD5h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: C04920 second address: C04937 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jc 00007F74ACBF05D6h 0x0000000b popad 0x0000000c pushad 0x0000000d jng 00007F74ACBF05D6h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: C04937 second address: C04954 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74AD0D7CCDh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edi 0x0000000e push edx 0x0000000f pop edx 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: C04954 second address: C0495E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F74ACBF05D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: C04AB6 second address: C04ABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: C04ABB second address: C04AEE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 pop ecx 0x00000008 push ecx 0x00000009 jmp 00007F74ACBF05E3h 0x0000000e jno 00007F74ACBF05D6h 0x00000014 pop ecx 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jc 00007F74ACBF05DCh 0x0000001f jc 00007F74ACBF05D6h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: C04AEE second address: C04B07 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F74AD0D7CCEh 0x00000008 push edx 0x00000009 pop edx 0x0000000a jnc 00007F74AD0D7CC6h 0x00000010 pushad 0x00000011 jnc 00007F74AD0D7CC6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: C04C6F second address: C04C8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74ACBF05DCh 0x00000009 popad 0x0000000a jbe 00007F74ACBF05DEh 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: C04F19 second address: C04F52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74AD0D7CD1h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F74AD0D7CD7h 0x00000011 jmp 00007F74AD0D7CCAh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: C05515 second address: C05538 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F74ACBF05D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F74ACBF05E3h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: C05538 second address: C05552 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F74AD0D7CD3h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: C056F8 second address: C056FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: C0585D second address: C05861 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: C05861 second address: C05885 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACBF05E0h 0x00000007 ja 00007F74ACBF05D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007F74ACBF05D6h 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: C05885 second address: C058B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F74AD0D7CD9h 0x0000000c je 00007F74AD0D7CC6h 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: C08725 second address: C0873B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACBF05DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: C0873B second address: C0873F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: C08A71 second address: C08A7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F74ACBF05D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: C08A7B second address: C08A7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: C08A7F second address: C08AA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F74ACBF05E2h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 jng 00007F74ACBF05D8h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: C0B4F2 second address: C0B515 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F74AD0D7CCEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F74AD0D7CCBh 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: C0B515 second address: C0B51E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: C0B51E second address: C0B524 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: C0B524 second address: C0B53B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74ACBF05E1h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: C0D37B second address: C0D39C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007F74AD0D7CCCh 0x00000010 jl 00007F74AD0D7CC6h 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 jne 00007F74AD0D7CC6h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: C0D39C second address: C0D3A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 532065E second address: 532068B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AD0D7CD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F74AD0D7CD3h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 532068B second address: 5320691 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5320691 second address: 53206A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F74AD0D7CCBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 53206A0 second address: 53206C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACBF05E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 53206C6 second address: 53206CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 53206CA second address: 53206DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACBF05DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 53206DD second address: 53206E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 53206E3 second address: 53206E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52A0D4A second address: 52A0D59 instructions: 0x00000000 rdtsc 0x00000002 mov ebx, esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov edi, esi 0x00000008 popad 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov ah, dl 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52A0D59 second address: 52A0D80 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 5BD18B85h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov bh, ch 0x0000000b popad 0x0000000c xchg eax, ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F74ACBF05E8h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52A0D80 second address: 52A0DC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F74AD0D7CD1h 0x00000009 and cx, BDB6h 0x0000000e jmp 00007F74AD0D7CD1h 0x00000013 popfd 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F74AD0D7CD3h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52A0DC8 second address: 52A0E14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F74ACBF05DFh 0x00000009 jmp 00007F74ACBF05E3h 0x0000000e popfd 0x0000000f call 00007F74ACBF05E8h 0x00000014 pop ecx 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push dword ptr [ebp+04h] 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52A0E14 second address: 52A0E1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52A0E1A second address: 52A0E20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5320312 second address: 5320328 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AD0D7CCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5320328 second address: 532032C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 532032C second address: 5320330 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5320330 second address: 5320336 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5320336 second address: 532039B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AD0D7CCAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c mov di, A142h 0x00000010 pushfd 0x00000011 jmp 00007F74AD0D7CD3h 0x00000016 xor esi, 51A2F83Eh 0x0000001c jmp 00007F74AD0D7CD9h 0x00000021 popfd 0x00000022 popad 0x00000023 jmp 00007F74AD0D7CD0h 0x00000028 popad 0x00000029 xchg eax, ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d pushad 0x0000002e popad 0x0000002f mov si, di 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 532039B second address: 53203DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 7F911081h 0x00000008 mov ax, 33BDh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov ebp, esp 0x00000011 jmp 00007F74ACBF05E8h 0x00000016 pop ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F74ACBF05E7h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 53203DE second address: 53203F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F74AD0D7CD4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 53203F6 second address: 53203FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52F0B46 second address: 52F0B5E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AD0D7CCEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52F0B5E second address: 52F0B65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ah, 5Dh 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52F0B65 second address: 52F0B6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52F0B6B second address: 52F0B6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52F0B6F second address: 52F0BAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F74AD0D7CCAh 0x0000000e mov ebp, esp 0x00000010 jmp 00007F74AD0D7CD0h 0x00000015 pop ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F74AD0D7CD7h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 53403CC second address: 534040E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACBF05E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushfd 0x0000000e jmp 00007F74ACBF05DAh 0x00000013 jmp 00007F74ACBF05E5h 0x00000018 popfd 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5320DE1 second address: 5320DE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5320DE5 second address: 5320DEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5320DEB second address: 5320DFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, si 0x00000006 mov cx, A53Bh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5320DFF second address: 5320E03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5320E03 second address: 5320E16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AD0D7CCFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52B0701 second address: 52B0750 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, si 0x00000006 pushfd 0x00000007 jmp 00007F74ACBF05DAh 0x0000000c sbb si, A768h 0x00000011 jmp 00007F74ACBF05DBh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b jmp 00007F74ACBF05E9h 0x00000020 xchg eax, ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F74ACBF05DDh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52B0750 second address: 52B0756 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52B0756 second address: 52B075A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5320439 second address: 532043E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 532043E second address: 5320493 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F74ACBF05E5h 0x00000008 pushfd 0x00000009 jmp 00007F74ACBF05E0h 0x0000000e and cx, 9048h 0x00000013 jmp 00007F74ACBF05DBh 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xchg eax, ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F74ACBF05E5h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5320493 second address: 53204EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F74AD0D7CD7h 0x00000008 pushfd 0x00000009 jmp 00007F74AD0D7CD8h 0x0000000e sub cx, 8038h 0x00000013 jmp 00007F74AD0D7CCBh 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F74AD0D7CCBh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 53204EA second address: 5320507 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACBF05E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5320507 second address: 532050D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 532050D second address: 5320511 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5320511 second address: 5320568 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F74AD0D7CCFh 0x0000000e mov ebp, esp 0x00000010 jmp 00007F74AD0D7CD6h 0x00000015 pop ebp 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F74AD0D7CCEh 0x0000001d and ah, FFFFFF88h 0x00000020 jmp 00007F74AD0D7CCBh 0x00000025 popfd 0x00000026 push eax 0x00000027 push edx 0x00000028 mov ecx, 1633AB15h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5320C28 second address: 5320C2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5320C2E second address: 5320C32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5320C32 second address: 5320C36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5320C36 second address: 5320C68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 jmp 00007F74AD0D7CCEh 0x0000000e mov dword ptr [esp], ebp 0x00000011 jmp 00007F74AD0D7CD0h 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5320C68 second address: 5320C6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5320C6C second address: 5320C72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5320C72 second address: 5320C78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5320C78 second address: 5320C7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5320C7C second address: 5320CB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebp+08h] 0x0000000b pushad 0x0000000c mov ah, ADh 0x0000000e push edi 0x0000000f mov ah, 05h 0x00000011 pop edx 0x00000012 popad 0x00000013 and dword ptr [eax], 00000000h 0x00000016 jmp 00007F74ACBF05E8h 0x0000001b and dword ptr [eax+04h], 00000000h 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5320CB4 second address: 5320CBA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5320CBA second address: 5320CC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F74ACBF05DBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5320CC9 second address: 5320CF0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AD0D7CD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov esi, ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5320CF0 second address: 5320CF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5320CF5 second address: 5320CFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5320CFB second address: 5320CFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52F0A54 second address: 52F0A93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F74AD0D7CCFh 0x00000008 pop ecx 0x00000009 mov ebx, 3CD988ECh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], ebp 0x00000014 jmp 00007F74AD0D7CCBh 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F74AD0D7CD0h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52F0A93 second address: 52F0A97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52F0A97 second address: 52F0A9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5320FA5 second address: 5320FCE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACBF05E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F74ACBF05DBh 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52D0856 second address: 52D0876 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop eax 0x00000005 movsx edi, si 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F74AD0D7CCDh 0x00000011 xchg eax, ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52D0876 second address: 52D087C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52D087C second address: 52D08AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AD0D7CD2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F74AD0D7CD7h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52D08AD second address: 52D08D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACBF05E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52D08D1 second address: 52D08D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52D08D7 second address: 52D08DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, dx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5330C19 second address: 5330C5A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AD0D7CCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F74AD0D7CD6h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F74AD0D7CD7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5330C5A second address: 5330CCD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F74ACBF05DFh 0x00000008 call 00007F74ACBF05E8h 0x0000000d pop esi 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push esp 0x00000012 pushad 0x00000013 call 00007F74ACBF05DCh 0x00000018 mov edi, esi 0x0000001a pop ecx 0x0000001b mov si, di 0x0000001e popad 0x0000001f mov dword ptr [esp], ecx 0x00000022 jmp 00007F74ACBF05E9h 0x00000027 mov eax, dword ptr [775F65FCh] 0x0000002c pushad 0x0000002d mov edi, eax 0x0000002f movzx ecx, dx 0x00000032 popad 0x00000033 test eax, eax 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5330CCD second address: 5330CD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5330CD1 second address: 5330CED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACBF05E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5330CED second address: 5330CF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5330CF3 second address: 5330CF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5330CF7 second address: 5330D0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F751F31A92Dh 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5330D0B second address: 5330D0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5330D0F second address: 5330D15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5330D15 second address: 5330D1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5330D1B second address: 5330D1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 53300A7 second address: 53300AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 53300AD second address: 53300B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 53300B1 second address: 53300B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52F00C5 second address: 52F00EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edi 0x00000005 movsx edx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and esp, FFFFFFF8h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F74AD0D7CD8h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52F00EF second address: 52F00FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACBF05DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52F00FE second address: 52F0196 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AD0D7CD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a jmp 00007F74AD0D7CCEh 0x0000000f push eax 0x00000010 jmp 00007F74AD0D7CCBh 0x00000015 xchg eax, ecx 0x00000016 pushad 0x00000017 mov ax, dx 0x0000001a popad 0x0000001b push edx 0x0000001c jmp 00007F74AD0D7CCAh 0x00000021 mov dword ptr [esp], ebx 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007F74AD0D7CCEh 0x0000002b adc eax, 71B69EF8h 0x00000031 jmp 00007F74AD0D7CCBh 0x00000036 popfd 0x00000037 jmp 00007F74AD0D7CD8h 0x0000003c popad 0x0000003d mov ebx, dword ptr [ebp+10h] 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F74AD0D7CCAh 0x00000049 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52F0196 second address: 52F019C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52F019C second address: 52F0204 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, dx 0x00000006 pushfd 0x00000007 jmp 00007F74AD0D7CD9h 0x0000000c adc ax, DFA6h 0x00000011 jmp 00007F74AD0D7CD1h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, esi 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F74AD0D7CCCh 0x00000022 add esi, 5212DD48h 0x00000028 jmp 00007F74AD0D7CCBh 0x0000002d popfd 0x0000002e push ecx 0x0000002f pop esi 0x00000030 popad 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 mov eax, ebx 0x00000037 movsx edx, si 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52F0204 second address: 52F021F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACBF05DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ebx, 493A7116h 0x00000012 mov dl, 88h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52F021F second address: 52F0247 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AD0D7CD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov ah, bh 0x00000011 mov al, CBh 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52F0247 second address: 52F02B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F74ACBF05DCh 0x00000009 sbb ch, FFFFFF98h 0x0000000c jmp 00007F74ACBF05DBh 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push ebp 0x00000016 jmp 00007F74ACBF05E2h 0x0000001b mov dword ptr [esp], edi 0x0000001e jmp 00007F74ACBF05E0h 0x00000023 test esi, esi 0x00000025 pushad 0x00000026 mov cx, 857Dh 0x0000002a popad 0x0000002b je 00007F751EE6E954h 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F74ACBF05E1h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52F02B2 second address: 52F02B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52F02B8 second address: 52F034B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F74ACBF05DAh 0x00000009 sub ch, FFFFFFB8h 0x0000000c jmp 00007F74ACBF05DBh 0x00000011 popfd 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000001e jmp 00007F74ACBF05E4h 0x00000023 je 00007F751EE6E90Ch 0x00000029 pushad 0x0000002a movzx eax, bx 0x0000002d mov bh, ADh 0x0000002f popad 0x00000030 mov edx, dword ptr [esi+44h] 0x00000033 pushad 0x00000034 pushfd 0x00000035 jmp 00007F74ACBF05E0h 0x0000003a xor ecx, 4E083B78h 0x00000040 jmp 00007F74ACBF05DBh 0x00000045 popfd 0x00000046 pushad 0x00000047 push ecx 0x00000048 pop ebx 0x00000049 mov eax, 788931C1h 0x0000004e popad 0x0000004f popad 0x00000050 or edx, dword ptr [ebp+0Ch] 0x00000053 push eax 0x00000054 push edx 0x00000055 jmp 00007F74ACBF05E3h 0x0000005a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52F034B second address: 52F039C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AD0D7CD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test edx, 61000000h 0x0000000f jmp 00007F74AD0D7CCEh 0x00000014 jne 00007F751F355FD2h 0x0000001a jmp 00007F74AD0D7CD0h 0x0000001f test byte ptr [esi+48h], 00000001h 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52F039C second address: 52F03A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52F03A0 second address: 52F03BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AD0D7CD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52F03BD second address: 52F03CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F74ACBF05DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52F03CD second address: 52F03E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F751F355F92h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F74AD0D7CCAh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 52F03E7 second address: 52F03FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACBF05DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test bl, 00000007h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push edx 0x00000010 pop esi 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 53000A4 second address: 53000BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F74AD0D7CD4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 53000BC second address: 53000C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 53000C0 second address: 53000D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and esp, FFFFFFF8h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F74AD0D7CCAh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 53000D7 second address: 53000DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 53000DD second address: 5300117 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AD0D7CCDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F74AD0D7CCCh 0x00000013 or ax, B298h 0x00000018 jmp 00007F74AD0D7CCBh 0x0000001d popfd 0x0000001e push eax 0x0000001f push edx 0x00000020 mov eax, 45EB8CE5h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 530024D second address: 5300253 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5300253 second address: 5300257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5300371 second address: 5300382 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACBF05DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 53003B8 second address: 53003C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F74AD0D7CCCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 53003C8 second address: 53003CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 53003CC second address: 53003DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 53003DB second address: 53003DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 53003DF second address: 53003F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AD0D7CD4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 53003F7 second address: 5300409 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F74ACBF05DEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5300409 second address: 530040D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 530040D second address: 5300423 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esp, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F74ACBF05DAh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5300423 second address: 5300452 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F74AD0D7CD1h 0x00000009 adc esi, 29652666h 0x0000000f jmp 00007F74AD0D7CD1h 0x00000014 popfd 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5300452 second address: 5300462 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop ebp 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b mov eax, 3D64698Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 536180E second address: 5361812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 53618DF second address: 536180E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACBF05E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0004h 0x0000000c lea eax, dword ptr [ebp-10h] 0x0000000f push eax 0x00000010 call ebx 0x00000012 mov edi, edi 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B15581 second address: B15586 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B15726 second address: B1572A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B1572A second address: B1574A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a jmp 00007F74AD0D7CD1h 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: B1574A second address: B1574E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5320899 second address: 5320906 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 mov ah, E6h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov dx, F144h 0x00000011 pushfd 0x00000012 jmp 00007F74AD0D7CCDh 0x00000017 sbb cl, FFFFFF86h 0x0000001a jmp 00007F74AD0D7CD1h 0x0000001f popfd 0x00000020 popad 0x00000021 mov ebp, esp 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 mov eax, edi 0x00000028 pushfd 0x00000029 jmp 00007F74AD0D7CCFh 0x0000002e sbb eax, 05CD99BEh 0x00000034 jmp 00007F74AD0D7CD9h 0x00000039 popfd 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	RDTSC instruction interceptor: First address: 5320906 second address: 532090C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Special instruction interceptor: First address: 95F88D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Special instruction interceptor: First address: B93D1F instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: 34F88D instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: 583D1F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: 97F88D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: BB3D1F instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe

Code function: 0_2_05370822 rdtsc

0_2_05370822

Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Window / User API: threadDelayed 972	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Window / User API: threadDelayed 983	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Window / User API: threadDelayed 1107	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 1222	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 1137	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 746	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 1128	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 1135	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 762	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1121	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 951	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1088	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1171	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1129	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe TID: 7364	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe TID: 7364	Thread sleep time: -68034s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe TID: 7340	Thread sleep count: 972 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe TID: 7340	Thread sleep time: -1944972s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe TID: 7356	Thread sleep count: 983 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe TID: 7356	Thread sleep time: -1966983s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe TID: 7288	Thread sleep count: 105 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe TID: 7288	Thread sleep count: 243 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe TID: 7568	Thread sleep count: 245 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe TID: 7348	Thread sleep count: 1107 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe TID: 7348	Thread sleep time: -2215107s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7640	Thread sleep count: 85 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7640	Thread sleep time: -170085s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7632	Thread sleep count: 107 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7632	Thread sleep time: -214107s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7576	Thread sleep count: 100 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7576	Thread sleep count: 1222 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7576	Thread sleep time: -123422s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7860	Thread sleep count: 1137 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7860	Thread sleep count: 746 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7860	Thread sleep time: -74600s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7612	Thread sleep count: 106 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7612	Thread sleep time: -212106s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7624	Thread sleep count: 116 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7624	Thread sleep time: -232116s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7732	Thread sleep count: 78 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7732	Thread sleep time: -156078s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7724	Thread sleep count: 120 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7724	Thread sleep time: -240120s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7588	Thread sleep count: 91 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7720	Thread sleep count: 114 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7720	Thread sleep time: -228114s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7712	Thread sleep count: 117 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7712	Thread sleep time: -234117s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7588	Thread sleep count: 1128 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7588	Thread sleep time: -113928s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7864	Thread sleep count: 1135 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7864	Thread sleep count: 762 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7864	Thread sleep time: -76200s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7736	Thread sleep count: 69 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7736	Thread sleep time: -138069s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7932	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7912	Thread sleep count: 1121 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7912	Thread sleep time: -2243121s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7888	Thread sleep count: 262 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 8012	Thread sleep count: 223 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7920	Thread sleep count: 951 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7920	Thread sleep time: -1902951s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7908	Thread sleep count: 1088 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7908	Thread sleep time: -2177088s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 3104	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 3104	Thread sleep time: -66033s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 8172	Thread sleep count: 1171 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 8172	Thread sleep time: -2343171s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 8152	Thread sleep count: 250 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7180	Thread sleep count: 255 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 3168	Thread sleep count: 1129 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 3168	Thread sleep time: -2259129s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed

Source: RageMP131.exe, RageMP131.exe, 0000000A.00000002.3788527005.0000000000B0A000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: MPGPH131.exe, 00000007.00000002.3789574147.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: RageMP131.exe, 00000008.00000002.3789735499.00000000012A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000F
Source: LisectAVT_2403002A_185.exe, 00000000.00000002.3789734640.000000000138E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000g
Source: RageMP131.exe, 0000000A.00000002.3790015018.00000000014A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: LisectAVT_2403002A_185.exe, 00000000.00000002.3789734640.0000000001380000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: RageMP131.exe, 00000008.00000002.3789533093.000000000116D000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&0000
Source: RageMP131.exe, 0000000A.00000002.3789536237.00000000010FD000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: RageMP131.exe, 0000000A.00000002.3790015018.00000000014A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllm
Source: RageMP131.exe, 00000008.00000002.3789735499.00000000012EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_3BBBC0DC
Source: MPGPH131.exe, 00000007.00000002.3789574147.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}8
Source: RageMP131.exe, 0000000A.00000002.3790015018.00000000014A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}X
Source: LisectAVT_2403002A_185.exe, 00000000.00000002.3789734640.00000000013C6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000na\AppData\Local\Temp\heidiAo
Source: RageMP131.exe, 0000000A.00000003.1561636088.00000000014BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: RageMP131.exe, 0000000A.00000002.3790015018.00000000014A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&?
Source: LisectAVT_2403002A_185.exe, 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.3788503404.0000000000B0A000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000002.3788527005.0000000000B0A000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: RageMP131.exe, 0000000A.00000002.3790015018.00000000014BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: scsi#disk&ven_vmware&pro
Source: MPGPH131.exe, 00000007.00000002.3789574147.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}-
Source: LisectAVT_2403002A_185.exe, 00000000.00000002.3789734640.0000000001380000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}6
Source: LisectAVT_2403002A_185.exe, 00000000.00000002.3789734640.00000000013C6000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3789661923.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3789574147.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3789735499.00000000012E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: MPGPH131.exe, 00000007.00000002.3789574147.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_3BBBC0DC
Source: LisectAVT_2403002A_185.exe, 00000000.00000002.3789734640.000000000138E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}l
Source: MPGPH131.exe, 00000007.00000002.3789534947.0000000000B3D000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}Hn

Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Thread information set: HideFromDebugger	Jump to behavior

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_0537005C Start: 05370108 End: 05370073	0_2_0537005C
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_053708AC Start: 05370B37 End: 053708C0	0_2_053708AC
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_04D509DC Start: 04D50B05 End: 04D509AD	7_2_04D509DC
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_04D605BD Start: 04D60667 End: 04D605D9	7_2_04D605BD
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_053A008B Start: 053A017F End: 053A005D	8_2_053A008B
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_05420338 Start: 05420352 End: 0542034C	10_2_05420338

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe

Code function: 0_2_05370822 rdtsc

0_2_05370822

Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_00883A40 mov eax, dword ptr fs:[00000030h]	0_2_00883A40
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_00883A40 mov eax, dword ptr fs:[00000030h]	0_2_00883A40
Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Code function: 0_2_00834100 mov eax, dword ptr fs:[00000030h]	0_2_00834100
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00273A40 mov eax, dword ptr fs:[00000030h]	6_2_00273A40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00273A40 mov eax, dword ptr fs:[00000030h]	6_2_00273A40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00224100 mov eax, dword ptr fs:[00000030h]	6_2_00224100
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00273A40 mov eax, dword ptr fs:[00000030h]	7_2_00273A40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00273A40 mov eax, dword ptr fs:[00000030h]	7_2_00273A40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00224100 mov eax, dword ptr fs:[00000030h]	7_2_00224100
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_008A3A40 mov eax, dword ptr fs:[00000030h]	8_2_008A3A40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_008A3A40 mov eax, dword ptr fs:[00000030h]	8_2_008A3A40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00854100 mov eax, dword ptr fs:[00000030h]	8_2_00854100
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_008A3A40 mov eax, dword ptr fs:[00000030h]	10_2_008A3A40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_008A3A40 mov eax, dword ptr fs:[00000030h]	10_2_008A3A40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00854100 mov eax, dword ptr fs:[00000030h]	10_2_00854100

Source: RageMP131.exe, RageMP131.exe, 0000000A.00000002.3788527005.0000000000B0A000.00000040.00000001.01000000.00000006.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe

Code function: 0_2_008FF26A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_008FF26A

Source: C:\Users\user\Desktop\LisectAVT_2403002A_185.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected RisePro Stealer

Source: Yara match	File source: 00000007.00000003.1393916127.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.1468115557.0000000005100000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1392470110.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1331208487.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.1548941705.00000000051A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_185.exe PID: 7284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7584, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7884, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 8148, type: MEMORYSTR

Remote Access Functionality

Yara detected RisePro Stealer

Source: Yara match	File source: 00000007.00000003.1393916127.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.1468115557.0000000005100000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1392470110.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1331208487.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.1548941705.00000000051A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_185.exe PID: 7284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7584, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7884, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 8148, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Command and Scripting Interpreter	1 Scheduled Task/Job	2 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	24 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	2 Process Injection	Security Account Manager	24 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	214 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
LisectAVT_2403002A_185.exe	100%	Avira	TR/Redcap.xyhrk
LisectAVT_2403002A_185.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	100%	Avira	TR/Redcap.xyhrk
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Avira	TR/Redcap.xyhrk
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.winimage.com/zLibDll	0%	URL Reputation	safe
https://t.me/RiseProSUPPORT	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORTD	0%	Avira URL Cloud	safe
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORTN	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	LisectAVT_2403002A_185.exe, 00000000.00000003.1331208487.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002A_185.exe, 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000006.00000003.1392470110.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1393916127.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000003.1468115557.0000000005100000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000003.1548941705.00000000051A0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDll	LisectAVT_2403002A_185.exe, 00000000.00000003.1331208487.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002A_185.exe, 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000006.00000003.1392470110.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1393916127.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000003.1468115557.0000000005100000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000003.1548941705.00000000051A0000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://t.me/RiseProSUPPORT	LisectAVT_2403002A_185.exe, 00000000.00000002.3789734640.000000000138E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3789661923.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.3789574147.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3789735499.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.3790015018.0000000001478000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORTD	RageMP131.exe, 0000000A.00000002.3790015018.0000000001478000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORTN	LisectAVT_2403002A_185.exe, 00000000.00000002.3789734640.000000000138E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.233.132.74	unknown	Russian Federation		2895	FREE-NET-ASFREEnetEU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1482448
Start date and time:	2024-07-25 23:06:55 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LisectAVT_2403002A_185.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@11/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, d.4.1.9.1.6.7.1.0.0.0.0.0.0.0.0.1.0.0.9.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
VT rate limit hit for: LisectAVT_2403002A_185.exe

Simulations

Behavior and APIs

Time	Type	Description
17:08:14	API Interceptor	3219228x Sleep call for process: LisectAVT_2403002A_185.exe modified
17:08:20	API Interceptor	5511x Sleep call for process: MPGPH131.exe modified
17:08:28	API Interceptor	4595929x Sleep call for process: RageMP131.exe modified
22:07:49	Task Scheduler	Run new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
22:07:49	Task Scheduler	Run new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
22:07:49	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
22:07:57	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
193.233.132.74	LisectAVT_2403002A_218.exe	Get hash	malicious	RisePro Stealer	Browse
	LisectAVT_2403002A_228.exe	Get hash	malicious	RisePro Stealer	Browse
	LisectAVT_2403002A_376.exe	Get hash	malicious	RisePro Stealer	Browse
	LisectAVT_2403002B_242.exe	Get hash	malicious	RisePro Stealer	Browse
	LisectAVT_2403002A_224.exe	Get hash	malicious	RisePro Stealer	Browse
	80OrFCsz0u.exe	Get hash	malicious	GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse
	SecuriteInfo.com.Win64.Evo-gen.28136.30716.exe	Get hash	malicious	GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse
	file.exe	Get hash	malicious	RisePro Stealer	Browse
	vGDqFBB1Jz.exe	Get hash	malicious	RisePro Stealer	Browse
	iKV7MCWDJF.exe	Get hash	malicious	RisePro Stealer	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FREE-NET-ASFREEnetEU	LisectAVT_2403002A_191.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.62
	LisectAVT_2403002A_218.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.74
	LisectAVT_2403002A_228.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.74
	LisectAVT_2403002A_30.exe	Get hash	malicious	Amadey	Browse	193.233.132.56
	LisectAVT_2403002A_33.exe	Get hash	malicious	Amadey	Browse	193.233.132.56
	LisectAVT_2403002A_376.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.74
	LisectAVT_2403002A_389.exe	Get hash	malicious	Amadey	Browse	193.233.132.56
	LisectAVT_2403002A_419.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.67
	LisectAVT_2403002A_419.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.67
	LisectAVT_2403002A_464.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.109

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_185.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2328582
Entropy (8bit):	7.965058550429932
Encrypted:	false
SSDEEP:	49152:etQqvanIGlHKxr+3nvtzf6Y42KNfH4KNYsONdgEM:BP1qR+fFN42KNfH9ONdW
MD5:	E4561AD384F825254DDF8335308BBBCF
SHA1:	0379BBD4B8684CAA337908286B870F5E38A58693
SHA-256:	8506917C0D92DF1DE8F1F7E6883669A0190D9997532A653D085D51A4E2123D13
SHA-512:	B9DA16205FF58C533177EE82C312F232DB55434B575A42F0DF541711AEEA4867589AF79D4EB0CFF478F080789EB5E1AED016A17E86AB99A3FED53B189B65E9E3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$......."...f.{Tf.{Tf.{T-.xUk.{T-.~U..{T-.\|Ug.{T)..Tb.{T)..Ut.{T).xUq.{T).~U3.{T-..U..{T-.}Ug.{T-.zU}.{Tf.zT@.{T..rUz.{T..{Ug.{T...Tg.{Tf..Tg.{T..yUg.{TRichf.{T................PE..L....b.e...............".....0........Y...........@...........................Y......#...@...........................Y.L...U...i.......X+.......................................................................................................... . .p..........................@....rsrc...X+..........................@....idata ............."..............@... ..+..........$..............@...kcbbzddg.`...p?..\...&..............@...ixbabcmr......Y.......#.............@...........................................................................................................................................................................................................................

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_185.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_185.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2328582
Entropy (8bit):	7.965058550429932
Encrypted:	false
SSDEEP:	49152:etQqvanIGlHKxr+3nvtzf6Y42KNfH4KNYsONdgEM:BP1qR+fFN42KNfH9ONdW
MD5:	E4561AD384F825254DDF8335308BBBCF
SHA1:	0379BBD4B8684CAA337908286B870F5E38A58693
SHA-256:	8506917C0D92DF1DE8F1F7E6883669A0190D9997532A653D085D51A4E2123D13
SHA-512:	B9DA16205FF58C533177EE82C312F232DB55434B575A42F0DF541711AEEA4867589AF79D4EB0CFF478F080789EB5E1AED016A17E86AB99A3FED53B189B65E9E3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$......."...f.{Tf.{Tf.{T-.xUk.{T-.~U..{T-.\|Ug.{T)..Tb.{T)..Ut.{T).xUq.{T).~U3.{T-..U..{T-.}Ug.{T-.zU}.{Tf.zT@.{T..rUz.{T..{Ug.{T...Tg.{Tf..Tg.{T..yUg.{TRichf.{T................PE..L....b.e...............".....0........Y...........@...........................Y......#...@...........................Y.L...U...i.......X+.......................................................................................................... . .p..........................@....rsrc...X+..........................@....idata ............."..............@... ..+..........$..............@...kcbbzddg.`...p?..\...&..............@...ixbabcmr......Y.......#.............@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_185.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_185.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:LE8n:B
MD5:	BE70E5BC47A6C957551330DFF4DE1D49
SHA1:	E923449442B40A379DEB49F1A8BDAC31F7FBB468
SHA-256:	FB4732654AFF3419F1A24EB24509565B8374898643BA3F4F2EE659DF0A9E66EE
SHA-512:	BD7BEA5AC3D9CB8B565175E62BF6DA4C978DE18B412EFFB1F034378A444C874CE6B8DEC22B77E99A28666A422CF2BE1D7BF8C6BA0D9F3C35A2C5CE7A32940C46
Malicious:	false
Reputation:	low
Preview:	1721946891794

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.965058550429932
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	LisectAVT_2403002A_185.exe
File size:	2'328'582 bytes
MD5:	e4561ad384f825254ddf8335308bbbcf
SHA1:	0379bbd4b8684caa337908286b870f5e38a58693
SHA256:	8506917c0d92df1de8f1f7e6883669a0190d9997532a653d085d51a4e2123d13
SHA512:	b9da16205ff58c533177ee82c312f232db55434b575a42f0df541711aeea4867589af79d4eb0cff478f080789eb5e1aed016a17e86ab99a3fed53b189b65e9e3
SSDEEP:	49152:etQqvanIGlHKxr+3nvtzf6Y42KNfH4KNYsONdgEM:BP1qR+fFN42KNfH9ONdW
TLSH:	EBB533A31C280247FEA32771996914986A94FFA00E76F5DE1FD22CD7F01F28DE8856C5
File Content Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$......."...f.{Tf.{Tf.{T-.xUk.{T-.~U..{T-.\|Ug.{T)..Tb.{T)..Ut.{T).xUq.{T).~U3.{T-..U..{T-.}Ug.{T-.zU}.{Tf.zT@.{T..rUz.{T..{Ug.{T...Tg.{

File Icon


Icon Hash:	c769eccc64f6e2bb

Static PE Info

General

Entrypoint:	0x99d000
Entrypoint Section:	ixbabcmr
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x65FD62AE [Fri Mar 22 10:51:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
push ebx
mov dword ptr [esp], 284FAD0Eh
mov dword ptr [esp], eax
mov dword ptr [esp], esi
push ebx
push esp
pop ebx
add ebx, 00000004h
sub ebx, 04h
xchg dword ptr [esp], ebx
pop esp
mov dword ptr [esp], eax
push eax
mov eax, esp
add eax, 00000004h
sub eax, 04h
xchg dword ptr [esp], eax
pop esp
mov dword ptr [esp], ecx
mov dword ptr [esp], ebx
call 00007F74ACD59286h
int3
push dword ptr [esp]
mov eax, dword ptr [esp]
add esp, 00000004h
add esp, 00000004h
push edx
mov dword ptr [esp], eax
add dword ptr [esp], 5EFAAA36h
pop ebx
push edx
mov edx, 11917529h
inc edx
and edx, 77F59D10h
shl edx, 08h
neg edx
and edx, 75F7F841h
xor edx, 3A19AA36h
sub ebx, edx
pop edx
push edi
mov edi, FFFFFFFFh
sub eax, edi
mov edi, dword ptr [esp]
add esp, 04h
push 0BE3668Ah
mov dword ptr [esp], ecx
mov ecx, 001A6000h
sub eax, ecx
mov ecx, dword ptr [esp]
add esp, 00000004h
sub eax, 0DBA003Ch
add eax, 0DBA0000h
cmp byte ptr [ebx], FFFFFFCCh
jne 00007F74ACD59337h
push ebp
mov dword ptr [esp], ecx
mov cl, EEh
add cl, 0000000Ch
shr cl, 00000007h
add cl, FFFFFFB9h
add cl, 00000001h
sub cl, 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x599fa4	0x4c	kcbbzddg
IMAGE_DIRECTORY_ENTRY_IMPORT	0x13b055	0x69	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x138000	0x2b58	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x13b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x137000	0x90600	46445c4e7f30e8818123b334945f143f	False	0.9993641774891775	data	7.985397454316368	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x138000	0x2b58	0xc00	12c572daf7edcc01809c83d495523296	False	0.83984375	data	7.029029636351581	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x13b000	0x1000	0x200	745dea56938759dccaf9e183aa01b020	False	0.146484375	data	0.998472215956371	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x13c000	0x2bb000	0x200	9b8a148aa552a5bd298c843c153e1f58	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
kcbbzddg	0x3f7000	0x1a6000	0x1a5c00	197a03127b88e9e53028d912b2d4a4af	False	0.9894442103215768	data	7.949002544785609	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ixbabcmr	0x59d000	0x1000	0x600	9dfe49aca0b251e0875364c8c6609388	False	0.6165364583333334	data	5.273959953963499	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x599ff0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Russian	Russia	0.1892116182572614
RT_GROUP_ICON	0x59c598	0x14	data	Russian	Russia	1.15
RT_VERSION	0x59c5ac	0x2e4	data	Russian	Russia	0.4689189189189189
RT_MANIFEST	0x59c890	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Exports

Name	Ordinal	Address
Start	1	0x466e80

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-25T23:07:58.426243+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49707	58709	192.168.2.9	193.233.132.74
2024-07-25T23:07:49.737468+0200	TCP	2049060	ET MALWARE RisePro TCP Heartbeat Packet	49706	58709	192.168.2.9	193.233.132.74
2024-07-25T23:07:52.722847+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49706	58709	192.168.2.9	193.233.132.74
2024-07-25T23:08:30.745853+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	64440	40.127.169.103	192.168.2.9
2024-07-25T23:08:12.379153+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49712	58709	192.168.2.9	193.233.132.74
2024-07-25T23:08:04.317411+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49709	58709	192.168.2.9	193.233.132.74
2024-07-25T23:07:55.457201+0200	TCP	2049060	ET MALWARE RisePro TCP Heartbeat Packet	49708	58709	192.168.2.9	193.233.132.74
2024-07-25T23:07:58.426100+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49708	58709	192.168.2.9	193.233.132.74
2024-07-25T23:08:03.751669+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49710	40.127.169.103	192.168.2.9

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 23:07:49.708216906 CEST	49706	58709	192.168.2.9	193.233.132.74
Jul 25, 2024 23:07:49.713745117 CEST	58709	49706	193.233.132.74	192.168.2.9
Jul 25, 2024 23:07:49.713821888 CEST	49706	58709	192.168.2.9	193.233.132.74
Jul 25, 2024 23:07:49.737468004 CEST	49706	58709	192.168.2.9	193.233.132.74
Jul 25, 2024 23:07:49.742458105 CEST	58709	49706	193.233.132.74	192.168.2.9
Jul 25, 2024 23:07:52.722846985 CEST	49706	58709	192.168.2.9	193.233.132.74
Jul 25, 2024 23:07:52.730820894 CEST	58709	49706	193.233.132.74	192.168.2.9
Jul 25, 2024 23:07:55.428355932 CEST	49707	58709	192.168.2.9	193.233.132.74
Jul 25, 2024 23:07:55.428389072 CEST	49708	58709	192.168.2.9	193.233.132.74
Jul 25, 2024 23:07:55.433662891 CEST	58709	49707	193.233.132.74	192.168.2.9
Jul 25, 2024 23:07:55.433706045 CEST	58709	49708	193.233.132.74	192.168.2.9
Jul 25, 2024 23:07:55.433743954 CEST	49707	58709	192.168.2.9	193.233.132.74
Jul 25, 2024 23:07:55.433784008 CEST	49708	58709	192.168.2.9	193.233.132.74
Jul 25, 2024 23:07:55.455988884 CEST	49707	58709	192.168.2.9	193.233.132.74
Jul 25, 2024 23:07:55.457201004 CEST	49708	58709	192.168.2.9	193.233.132.74
Jul 25, 2024 23:07:55.461016893 CEST	58709	49707	193.233.132.74	192.168.2.9
Jul 25, 2024 23:07:55.462080002 CEST	58709	49708	193.233.132.74	192.168.2.9
Jul 25, 2024 23:07:58.426100016 CEST	49708	58709	192.168.2.9	193.233.132.74
Jul 25, 2024 23:07:58.426243067 CEST	49707	58709	192.168.2.9	193.233.132.74
Jul 25, 2024 23:07:58.431231976 CEST	58709	49708	193.233.132.74	192.168.2.9
Jul 25, 2024 23:07:58.431386948 CEST	58709	49707	193.233.132.74	192.168.2.9
Jul 25, 2024 23:08:01.309616089 CEST	49709	58709	192.168.2.9	193.233.132.74
Jul 25, 2024 23:08:01.314835072 CEST	58709	49709	193.233.132.74	192.168.2.9
Jul 25, 2024 23:08:01.314910889 CEST	49709	58709	192.168.2.9	193.233.132.74
Jul 25, 2024 23:08:01.328531981 CEST	49709	58709	192.168.2.9	193.233.132.74
Jul 25, 2024 23:08:01.333595991 CEST	58709	49709	193.233.132.74	192.168.2.9
Jul 25, 2024 23:08:04.317410946 CEST	49709	58709	192.168.2.9	193.233.132.74
Jul 25, 2024 23:08:04.430593014 CEST	58709	49709	193.233.132.74	192.168.2.9
Jul 25, 2024 23:08:09.359584093 CEST	49712	58709	192.168.2.9	193.233.132.74
Jul 25, 2024 23:08:09.364620924 CEST	58709	49712	193.233.132.74	192.168.2.9
Jul 25, 2024 23:08:09.364706039 CEST	49712	58709	192.168.2.9	193.233.132.74
Jul 25, 2024 23:08:09.392718077 CEST	49712	58709	192.168.2.9	193.233.132.74
Jul 25, 2024 23:08:09.400499105 CEST	58709	49712	193.233.132.74	192.168.2.9
Jul 25, 2024 23:08:11.108750105 CEST	58709	49706	193.233.132.74	192.168.2.9
Jul 25, 2024 23:08:11.108861923 CEST	49706	58709	192.168.2.9	193.233.132.74
Jul 25, 2024 23:08:12.379153013 CEST	49712	58709	192.168.2.9	193.233.132.74
Jul 25, 2024 23:08:12.384428978 CEST	58709	49712	193.233.132.74	192.168.2.9
Jul 25, 2024 23:08:16.875992060 CEST	58709	49708	193.233.132.74	192.168.2.9
Jul 25, 2024 23:08:16.876084089 CEST	49708	58709	192.168.2.9	193.233.132.74
Jul 25, 2024 23:08:16.893651962 CEST	58709	49707	193.233.132.74	192.168.2.9
Jul 25, 2024 23:08:16.893728971 CEST	49707	58709	192.168.2.9	193.233.132.74
Jul 25, 2024 23:08:23.169022083 CEST	58709	49709	193.233.132.74	192.168.2.9
Jul 25, 2024 23:08:23.169115067 CEST	49709	58709	192.168.2.9	193.233.132.74
Jul 25, 2024 23:08:23.169301033 CEST	58709	49709	193.233.132.74	192.168.2.9
Jul 25, 2024 23:08:23.169353008 CEST	49709	58709	192.168.2.9	193.233.132.74
Jul 25, 2024 23:08:23.169658899 CEST	58709	49709	193.233.132.74	192.168.2.9
Jul 25, 2024 23:08:23.169704914 CEST	49709	58709	192.168.2.9	193.233.132.74
Jul 25, 2024 23:08:30.769499063 CEST	58709	49712	193.233.132.74	192.168.2.9
Jul 25, 2024 23:08:30.769634962 CEST	49712	58709	192.168.2.9	193.233.132.74

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 23:08:28.996054888 CEST	53	64832	162.159.36.2	192.168.2.9
Jul 25, 2024 23:08:29.496177912 CEST	53	58675	1.1.1.1	192.168.2.9

Target ID:	0
Start time:	17:07:43
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\LisectAVT_2403002A_185.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LisectAVT_2403002A_185.exe"
Imagebase:	0x820000
File size:	2'328'582 bytes
MD5 hash:	E4561AD384F825254DDF8335308BBBCF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000003.1331208487.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	17:07:48
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0xa40000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:07:48
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:07:48
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0xa40000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:07:48
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:07:49
Start date:	25/07/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x210000
File size:	2'328'582 bytes
MD5 hash:	E4561AD384F825254DDF8335308BBBCF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000006.00000003.1392470110.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	17:07:49
Start date:	25/07/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x210000
File size:	2'328'582 bytes
MD5 hash:	E4561AD384F825254DDF8335308BBBCF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000003.1393916127.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	17:07:57
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x840000
File size:	2'328'582 bytes
MD5 hash:	E4561AD384F825254DDF8335308BBBCF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000008.00000003.1468115557.0000000005100000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	17:08:05
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x840000
File size:	2'328'582 bytes
MD5 hash:	E4561AD384F825254DDF8335308BBBCF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000000A.00000003.1548941705.00000000051A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.8%
Dynamic/Decrypted Code Coverage:	1.3%
Signature Coverage:	2.6%
Total number of Nodes:	615
Total number of Limit Nodes:	61

Executed Functions

Function 0083E0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 0083E0CA
socket.WS2_32(?,?,?), ref: 0083E17F
connect.WS2_32(00000000,?,?), ref: 0083E193
closesocket.WS2_32(00000000), ref: 0083E19E

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: e14bfe76c1bb09c36d06f75620e590dbecbd2033cbf3f2526a6cfbf70a76852a
Instruction ID: 880381c75bba5719472d24b91de28d337b9a9995c056ec8b626caf13042de301
Opcode Fuzzy Hash: e14bfe76c1bb09c36d06f75620e590dbecbd2033cbf3f2526a6cfbf70a76852a
Instruction Fuzzy Hash: 5B31AC72605310ABD7209F299C49B2FB7E8FBC5735F015F19F9A8962D0E33198048B92

Function 00883A40 Relevance: 2.7, APIs: 2, Instructions: 157
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E9,?,00000001,00000000,?,?,?,?,?,?,?,?,00883DB6), ref: 00883B08
Sleep.KERNELBASE(00000001,?,00000001,00000000,?,?,?,?,?,?,?,?,00883DB6), ref: 00883BBA

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 6f44787daf927b166ec07af6ac32c2c6603320bcd24d9dcfc4ddab44b3d153a7
Instruction ID: f58939820435d04d4abd1f623913ea5a3492ddb69f3b0a72fc4ab42dcd8970d4
Opcode Fuzzy Hash: 6f44787daf927b166ec07af6ac32c2c6603320bcd24d9dcfc4ddab44b3d153a7
Instruction Fuzzy Hash: 0B51BB75A042298FCB28DF58C8D0EAAB3B1FF45B14F29459AD845AF352D731EE05CB80

Function 05370822 Relevance: 1.8, APIs: 1, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 053708DC

Memory Dump Source

Source File: 00000000.00000002.3793493063.0000000005370000.00000040.00001000.00020000.00000000.sdmp, Offset: 05370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5370000_LisectAVT_2403002A_185.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: f32ec35ea6e7b06a617d8200f66655bc157f644cdcba7ca7fdd4e299e8ed06d1
Instruction ID: ed8eba6b90c7c56cfad1eb23d1a46509198926a036aded663e7f8287717f9c2f
Opcode Fuzzy Hash: f32ec35ea6e7b06a617d8200f66655bc157f644cdcba7ca7fdd4e299e8ed06d1
Instruction Fuzzy Hash: 6A414DEB94D129BC716AC1826F58EFB576EE5D77307318427F807E1902E2C84E495831

Function 053708AC Relevance: 1.7, APIs: 1, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 053708DC

Memory Dump Source

Source File: 00000000.00000002.3793493063.0000000005370000.00000040.00001000.00020000.00000000.sdmp, Offset: 05370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5370000_LisectAVT_2403002A_185.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: d758eb9ac4a55b8955f705d1cc9adc5df8b896756ca1c25b32c80a27fa651ee8
Instruction ID: d993e54da34b681dc171942354c630ec97fa9128c88b2c174f878dcbcca21306
Opcode Fuzzy Hash: d758eb9ac4a55b8955f705d1cc9adc5df8b896756ca1c25b32c80a27fa651ee8
Instruction Fuzzy Hash: A941B2EB90D129BC726AC1826B58EFA672FE6C77307318467F407E5901E28C4F895831

Function 00914623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35db825da7b3df724fa3763381b46c7e409f42963754736727c81c059fd3a47c
Instruction ID: 0da4f0686348fb9f75223d8ed9a226be7ce7f4ae619c9df990a63eada6dee066
Opcode Fuzzy Hash: 35db825da7b3df724fa3763381b46c7e409f42963754736727c81c059fd3a47c
Instruction Fuzzy Hash: 20B1F570F0424DAFDB11DFA9D841BEEBBB5AF8A310F544198E554AB282C770AD81CB61

Function 0082A210 Relevance: 1.7, APIs: 1, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 0082A343

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 24b3372bce6a1f40f6bbf3d99da3cd1e25af627db33822c386c31ca3daba04f2
Instruction ID: 560f66cf6322b3914729cffdb49446e9aa09eb85d64f657566111440409812af
Opcode Fuzzy Hash: 24b3372bce6a1f40f6bbf3d99da3cd1e25af627db33822c386c31ca3daba04f2
Instruction Fuzzy Hash: 45710470900218AFDB18DF68EC49BAEB7E8FF41700F10856DF805DB782D7B59A818792

Function 05370866 Relevance: 1.7, APIs: 1, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 053708DC

Memory Dump Source

Source File: 00000000.00000002.3793493063.0000000005370000.00000040.00001000.00020000.00000000.sdmp, Offset: 05370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5370000_LisectAVT_2403002A_185.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 49f8ff7aedc570676d89a19ea353c6e0a676fea922e58fbce4fbe876474e43c3
Instruction ID: 4e28737245b3e8c63b6e0652b852f53e5e088f37a661533bf7b38b75743093de
Opcode Fuzzy Hash: 49f8ff7aedc570676d89a19ea353c6e0a676fea922e58fbce4fbe876474e43c3
Instruction Fuzzy Hash: BE41B0EB94D129BCB16AC1826F58EFB562FE6C77307318467F407E1902E29C4E495831

Function 05370898 Relevance: 1.7, APIs: 1, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 053708DC

Memory Dump Source

Source File: 00000000.00000002.3793493063.0000000005370000.00000040.00001000.00020000.00000000.sdmp, Offset: 05370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5370000_LisectAVT_2403002A_185.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 2c01339e69ed63f7fa20f78480c1827bae7fe99e14ceb33c7b21855c69ee9e63
Instruction ID: 9a102ff525d82e3ed28f258314e9698a174c32ac2c6305650759810dedb057b0
Opcode Fuzzy Hash: 2c01339e69ed63f7fa20f78480c1827bae7fe99e14ceb33c7b21855c69ee9e63
Instruction Fuzzy Hash: 43419FFB94D129BCB26AC1826B58EFA562FE6C7730B318427F407E1901E2CC8B495831

Function 0091549C Relevance: 1.7, APIs: 1, Instructions: 198
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000000,00909087,?,00000000,00000000,00000000,?,00000000,?,0082A3EB,00909087,00000000,0082A3EB,?,?), ref: 00915621

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: dd78f63a743da65d45a9b42c0c684153be86ecc9eb907381c94395f2a6699426
Instruction ID: c19138889b656c6219cc453021a8c9beddbae786f0c9d7309c1cd4f83c2325e3
Opcode Fuzzy Hash: dd78f63a743da65d45a9b42c0c684153be86ecc9eb907381c94395f2a6699426
Instruction Fuzzy Hash: 9561C071A0450DEFDF11DFA8C844EEEBBBAAF89304F560545F804A7255D375D9818BA0

Function 053708DA Relevance: 1.7, APIs: 1, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 053708DC

Memory Dump Source

Source File: 00000000.00000002.3793493063.0000000005370000.00000040.00001000.00020000.00000000.sdmp, Offset: 05370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5370000_LisectAVT_2403002A_185.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 46f32ddd14c7ea9b51ed817efec7fa42e497d2ee476b0bc3ca18a00266b2b21d
Instruction ID: ef0a801384029c5fb75abb70f87fcf1d44781bb53d567ffee10ed2da65a0f5de
Opcode Fuzzy Hash: 46f32ddd14c7ea9b51ed817efec7fa42e497d2ee476b0bc3ca18a00266b2b21d
Instruction Fuzzy Hash: C73193FB91D129BC727AC1826B58EFA562FE6C7730B318466F407E6901E2DC8F495831

Function 00904942 Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f92d44a3a7ede6de46dc018fe1879ffab944e6e5bad8223685008d8fe62d8db
Instruction ID: ed4151cebf37bbe79d046e3cc0aa5af8e071712c32f95f0fcec31a3bfccfc2c2
Opcode Fuzzy Hash: 4f92d44a3a7ede6de46dc018fe1879ffab944e6e5bad8223685008d8fe62d8db
Instruction Fuzzy Hash: 4851C8B0B00208AFDF14CF58CC41AAA7FF5EF85354F248158F9599B292D3719E41CB90

Function 00890560 Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 008906AE

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction ID: 2fa00ebbb7dd53aad817714b58385c3669ff9e206dad693277ab6f0125e1b8d8
Opcode Fuzzy Hash: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction Fuzzy Hash: D241B572A002189FCF15EF68D98066E7BA5FF89350F190169F905EB346D730DD609BE1

Function 00914B12 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,009149F9,00000000,CF830579,00951140,0000000C,00914AB5,00908BBD,?), ref: 00914B68

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: dd3d34d57f8e64c6562af08625267a3a6456b2dac0463c9606a78d90e7633ad1
Instruction ID: 2944997ff9bfaedb3cca72bf2becbd316103e8bcc25353670a13f2260aa24208
Opcode Fuzzy Hash: dd3d34d57f8e64c6562af08625267a3a6456b2dac0463c9606a78d90e7633ad1
Instruction Fuzzy Hash: 4911483379912C16C6252274A805BFE674E8BCB7B0F390209F9589B1C2EE20ECC15195

Function 0090E05C Relevance: 1.6, APIs: 1, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00950DF8,0082A3EB,00000002,0082A3EB,00000000,?,?,?,0090E166,00000000,?,0082A3EB,00000002,00950DF8), ref: 0090E098

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 267d329ec78681079144963d500bf17173851120eebe6e2d0d0c01842e0f327a
Instruction ID: 1dd788fb488d2d31bb3ac25598b8ef2cb8cba5cb2caa5636f87e5dd204275cd8
Opcode Fuzzy Hash: 267d329ec78681079144963d500bf17173851120eebe6e2d0d0c01842e0f327a
Instruction Fuzzy Hash: 3301D632715519AFCF199F59CC05D9E3B2AEB81320B240648F8909B2D1E6B1ED419BD0

Function 008FF290 Relevance: 1.6, APIs: 1, Instructions: 51
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0082220E

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: b448e3f1b60b6ac830b5c34ba6028b353d57f5eb109befd4919fd57779b37bbe
Instruction ID: 9991453b10cfb8189a2ebb25696bf5c63ed8fd9f099b290a07d19ad3ded41bdb
Opcode Fuzzy Hash: b448e3f1b60b6ac830b5c34ba6028b353d57f5eb109befd4919fd57779b37bbe
Instruction Fuzzy Hash: AD01DB7550030DBBCB24EFA8E805AA977ECEE40314F508535FB18DB591E770E95487D5

Function 009163F3 Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,009091F7,00000000,?,00915D79,00000001,00000364,00000000,00000006,000000FF,?,00000000,0090D244,009089C3,009091F7,00000000), ref: 00916434

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 3cb58cc641507b3dbcd8f22ad8e0061ba66ed379ae9aed543eb4213b65212f44
Instruction ID: cb5564566aa0562b7de6ff9b0f28ce0c4d2e5106ba5b705ae789e63c6ada640c
Opcode Fuzzy Hash: 3cb58cc641507b3dbcd8f22ad8e0061ba66ed379ae9aed543eb4213b65212f44
Instruction Fuzzy Hash: 4EF0E933F0522C66DB226F669C02BDB7B8C9F81770B258025F804A61E0CB30EC8186E1

Function 00916E2D Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0091D635,4D88C033,?,0091D635,00000220,?,009157EF,4D88C033), ref: 00916E60

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 65a871414a18aa0d32638df31daa27af74dfa04f9d1a8d6f1e2bb6ae63e57745
Instruction ID: de83743e7263a7225e6bd0eb292f9d3a525c9a1b449e9ad18217a2e230e2a19a
Opcode Fuzzy Hash: 65a871414a18aa0d32638df31daa27af74dfa04f9d1a8d6f1e2bb6ae63e57745
Instruction Fuzzy Hash: 62E0E539F0062D66EE3126A5DD007DB7A4CCF813B1F450721FC04921D0CB20C8A041E4

Function 053800B6 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3793544975.0000000005380000.00000040.00001000.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5380000_LisectAVT_2403002A_185.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c974e7eab7329a72c40cc5b948d6464ce87c6a947ce7fdf50de69d3910f8360d
Instruction ID: 2dca85fde8ee5a848afb983999eba201f6129a33429b45c541bffd758a5c3fdf
Opcode Fuzzy Hash: c974e7eab7329a72c40cc5b948d6464ce87c6a947ce7fdf50de69d3910f8360d
Instruction Fuzzy Hash: 9811A2EF148310BEA11EE9916B5CAFA6B6FE9D6630330C426F547C9D02F2E60A4D5171

Function 05380035 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3793544975.0000000005380000.00000040.00001000.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5380000_LisectAVT_2403002A_185.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de8c3981790d8b57ad952beda665aeed8f869fedf448b7bcac81203ee0bed000
Instruction ID: 989178510376c3cd721da4e58f7b93ba79eca984378ad0e2f2cc27acb03e7d0c
Opcode Fuzzy Hash: de8c3981790d8b57ad952beda665aeed8f869fedf448b7bcac81203ee0bed000
Instruction Fuzzy Hash: 731190FF14C220BDB14EE9822B2CAFA6BAFE5D6730330C426F447D5D02E2950A4D2271

Function 0538004F Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3793544975.0000000005380000.00000040.00001000.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5380000_LisectAVT_2403002A_185.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7007103f2b9ddf2047db4d82bcd1137095cfcc88caf9259626ab5e935aa0d74c
Instruction ID: d38ffdc2dec2e983d4e77b6d35844077f5bca2f3c07ae5202858514164a2eada
Opcode Fuzzy Hash: 7007103f2b9ddf2047db4d82bcd1137095cfcc88caf9259626ab5e935aa0d74c
Instruction Fuzzy Hash: 551182FB14C310BEA10EE9816B28AF66BAFE5D6730330C426F447D5D02E2A50A4C5131

Function 05380063 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3793544975.0000000005380000.00000040.00001000.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5380000_LisectAVT_2403002A_185.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e0b8d7b717bc5a616e675bdbb61b506886af20049064d5bed4d9b178ca31354
Instruction ID: 4ac8c8380511b35278d6ac62deb360ee12b62abca35f9b8234726cc73d8d8f7b
Opcode Fuzzy Hash: 2e0b8d7b717bc5a616e675bdbb61b506886af20049064d5bed4d9b178ca31354
Instruction Fuzzy Hash: EE1182FF14C220BEA10EE5916B2DAF66BAFE6D6730730C522F507D6D42E2D50A4D2171

Function 053800D5 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3793544975.0000000005380000.00000040.00001000.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5380000_LisectAVT_2403002A_185.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2039cfeb9ff183c91b9d6be6681c1b07127596415cce77a0c8488e26792558ac
Instruction ID: 86efcf678a2b3a89348c7d7f4bea250d563e58a001ba7ff9de664342634470ef
Opcode Fuzzy Hash: 2039cfeb9ff183c91b9d6be6681c1b07127596415cce77a0c8488e26792558ac
Instruction Fuzzy Hash: 0A1170EF148220BD611EE4852B2CAF6AB6FE5D6731370C523F547D9D02E2D90A4D2171

Function 05380086 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3793544975.0000000005380000.00000040.00001000.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5380000_LisectAVT_2403002A_185.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03059091e33c1481cb72dfc40526d3ae180bb2c5535bec83eaa20f13d94fd79a
Instruction ID: 0a4a73fc002a5df6e50822096076e2e2cc951dfe8487e200b48a63dfeca6eac3
Opcode Fuzzy Hash: 03059091e33c1481cb72dfc40526d3ae180bb2c5535bec83eaa20f13d94fd79a
Instruction Fuzzy Hash: AB01A1FF148210BEA10AE5816B28AFAA76FE9D6730330C466F403DA902E2990A5C6131

Function 05380076 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3793544975.0000000005380000.00000040.00001000.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5380000_LisectAVT_2403002A_185.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 818f7dbd7e9a91b785c3477bca7b8c0cd371315cf362d5780d045a9ebec296b5
Instruction ID: 446e0ab0976c83b251b05a4bc24632255a6e3aa9165da163cbf76549bbf9f063
Opcode Fuzzy Hash: 818f7dbd7e9a91b785c3477bca7b8c0cd371315cf362d5780d045a9ebec296b5
Instruction Fuzzy Hash: 680180FF24C220BDB10EE5812B2CAF6A7AFE5D6730370C426F547D9D02E2990A4D2171

Function 053800FB Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3793544975.0000000005380000.00000040.00001000.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5380000_LisectAVT_2403002A_185.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd9532473d6ba0990de7341509ae060412018e6e9cb53f66e604df2e02072273
Instruction ID: 4fe08b9b8dfd3582b377d6dbbbf70c80fdbf4a05b1066df0ad23515a33a10252
Opcode Fuzzy Hash: cd9532473d6ba0990de7341509ae060412018e6e9cb53f66e604df2e02072273
Instruction Fuzzy Hash: 7FF0A7AF14C350EED14DE5512A3DAB6ABAFB5F33313758456F043C6901D149160C5231

Function 05380123 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3793544975.0000000005380000.00000040.00001000.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5380000_LisectAVT_2403002A_185.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1921ebcb12c599e764f4f543e013255cbd7a80e1ce0ba5f6920dca6beb905cb3
Instruction ID: 75c59e45551ddbc77288c9e59bfd8315378a14a3f0ea281af79e5e2a622e280b
Opcode Fuzzy Hash: 1921ebcb12c599e764f4f543e013255cbd7a80e1ce0ba5f6920dca6beb905cb3
Instruction Fuzzy Hash: 7AE026AF24C204FD918DE492362DAF2ABAFB5B733237889B3F003C6E01E149120D5231

Function 0538014A Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3793544975.0000000005380000.00000040.00001000.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5380000_LisectAVT_2403002A_185.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01e9822cd8beee8cd6b8c52aab03ae6f87ba31830ff490add69acb165c91b32b
Instruction ID: b827ddf28e248fb541cd8361ec1ed6ad09454e1f28b5731999d8f4cffe04e511
Opcode Fuzzy Hash: 01e9822cd8beee8cd6b8c52aab03ae6f87ba31830ff490add69acb165c91b32b
Instruction Fuzzy Hash: 9CD05BAF18C200EDA14CD9463B6C7B6679F75E73313744453F043D6C02D155520D6230

Function 05380166 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3793544975.0000000005380000.00000040.00001000.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5380000_LisectAVT_2403002A_185.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c08c11a93375e6ec8b91c6508d3a76469a22047eb2ff039dc6ca9963db54ee9
Instruction ID: 78c13e8d2bb75940e0e18cbfbb2937f1c391d309d335d136b478671f7bb832f6
Opcode Fuzzy Hash: 0c08c11a93375e6ec8b91c6508d3a76469a22047eb2ff039dc6ca9963db54ee9
Instruction Fuzzy Hash: 17D0A7BF1CD100AD904CD5823B3C7F2639F71E62313F04553F002C2C01D149424C6230

Non-executed Functions

Function 00839F50 Relevance: 18.6, Strings: 13, Instructions: 2331COMMON

Download Yara Rule

Strings

,, xrefs: 0083A5D2
., xrefs: 0083AB30
:, xrefs: 0083A097
arqt, xrefs: 0083A4C7
%s|%s, xrefs: 0083A198
$, xrefs: 0083BD6D
irvl, xrefs: 0083A527
er, xrefs: 0083A659
type must be boolean, but is , xrefs: 0083BF3C, 0083BF6D, 0083C02B
,, xrefs: 0083A6AF
v|, xrefs: 0083A52E
., xrefs: 0083B0E2
131, xrefs: 0083A178, 0083A17F, 0083A190

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID:
String ID: $$%s|%s$,$,$.$.$131$:$arqt$er$irvl$type must be boolean, but is $v|
API String ID: 0-4208100968
Opcode ID: 578206756eca811c252251786ef75d77ba1c981445d1d8ea92149f0bd3561c31
Instruction ID: e4d075ca55ee21e70a227606ec5efb96f92f414945f9b3888492abfc0843dc4a
Opcode Fuzzy Hash: 578206756eca811c252251786ef75d77ba1c981445d1d8ea92149f0bd3561c31
Instruction Fuzzy Hash: BD23CEB0D002588FDB28DF68C858BEDBBB4FF45304F148199E549EB292DB359A84CF91

Function 00828D70 Relevance: 9.1, Strings: 7, Instructions: 327COMMON

Download Yara Rule

Strings

bkg`, xrefs: 00828DB7
eHlW, xrefs: 00828FA2
p, xrefs: 00828DBE
File, xrefs: 00828F73
lwcf, xrefs: 00828FA9
t, xrefs: 00828E37
l, xrefs: 00828FB0

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID:
String ID: File$bkg`$eHlW$l$lwcf$p$t
API String ID: 0-3184506882
Opcode ID: ab74e7aeef880218b44c255ff68a45ffa79f1493974a8f255d00cc7367ea0ed2
Instruction ID: a9082cbfb2599d1df0e500ee38a47f351a8ab27ad58e7d45e0910fd5d66f714f
Opcode Fuzzy Hash: ab74e7aeef880218b44c255ff68a45ffa79f1493974a8f255d00cc7367ea0ed2
Instruction Fuzzy Hash: E0C1AB70D0026DDEEF24DFA4DC85BAEBBB9FF05300F104069E504AB291DB759A85CB65

Function 008973F0 Relevance: 7.9, APIs: 3, Strings: 1, Instructions: 897COMMON

Download Yara Rule

Strings

unordered_map/set too long, xrefs: 008978C7

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID:
String ID: unordered_map/set too long
API String ID: 0-306623848
Opcode ID: 2424e708a34aeb92e62ce9b05cc29c2bc14a481165b7aa1545af147c1b5b3c3e
Instruction ID: f03dd236b77ed01c2853194fe1fcce8bc504e360a179d7ec3e4370a8eb3530ec
Opcode Fuzzy Hash: 2424e708a34aeb92e62ce9b05cc29c2bc14a481165b7aa1545af147c1b5b3c3e
Instruction Fuzzy Hash: 08627175E046199FCF14DF6CC880AADBBB5FF48314F288269E819EB395D730A951CB90

Function 009084A0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction ID: 1cb16778d09f6d46d22577d17ccb954614e9f92d13a90886295972188fa6037e
Opcode Fuzzy Hash: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction Fuzzy Hash: 6F023B71E012199FDF14CFA9C880AAEBBF5FF48314F258269D959E7381DB31A941CB90

Function 008950B0 Relevance: 5.3, Strings: 4, Instructions: 268COMMON

Download Yara Rule

Strings

type must be number, but is , xrefs: 00895241
type must be string, but is , xrefs: 00895114
/Kim, xrefs: 008952C2
/Kim, xrefs: 008952A9

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID:
String ID: /Kim$/Kim$type must be number, but is $type must be string, but is
API String ID: 0-1144537432
Opcode ID: 211e1785944c52f15c421e8191e8101b0a0b83b9af897e1ccf24473bf59cc0b1
Instruction ID: 28a0aadb013a7f053f87a720923255b38c369eb15abf781ded21cb0398894d7a
Opcode Fuzzy Hash: 211e1785944c52f15c421e8191e8101b0a0b83b9af897e1ccf24473bf59cc0b1
Instruction Fuzzy Hash: D5912671E006089FCB08DFACD8517DDBBA9FB89310F18826EE819D7395E7759905CB81

Function 008291A0 Relevance: 4.9, Strings: 3, Instructions: 1146COMMON

Download Yara Rule

Strings

/\/, xrefs: 0082956A, 0082959C
\, xrefs: 00829528
/, xrefs: 008294E2

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID:
String ID: /$/\/$\
API String ID: 0-1523196992
Opcode ID: 58a7d90e07f2a5457cfee94fcbb97ba484412e910e2073bd193c74737c223ea1
Instruction ID: 8f508d619490df8ec0a854bf800027258e9a8f13c6bf6498c469455eff93ee18
Opcode Fuzzy Hash: 58a7d90e07f2a5457cfee94fcbb97ba484412e910e2073bd193c74737c223ea1
Instruction Fuzzy Hash: BB92E271D002688FDF18CFA8D8946EEBBB5FF45314F1442ADD485E7282E7315A86CBA1

Function 008A55B0 Relevance: 3.9, Strings: 3, Instructions: 187COMMON

Download Yara Rule

Strings

eIcm, xrefs: 008A5835
`ic, xrefs: 008A583C
yNrw, xrefs: 008A5764

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID:
String ID: `ic$eIcm$yNrw
API String ID: 0-2666854388
Opcode ID: ccb54c24709347082297d2ad8a3a405570c357ef0461f6f8b99f9511b9f6e896
Instruction ID: 0aea409bf0aee23af8ca989e13eb9ae44476a4912324e1c283965bbe96b1800b
Opcode Fuzzy Hash: ccb54c24709347082297d2ad8a3a405570c357ef0461f6f8b99f9511b9f6e896
Instruction Fuzzy Hash: 36816CB0C1834CAEEF04CFA4D8456AEFBB9EF56300F50809ED851AB651D379434ADBA5

Function 0090BEAF Relevance: 1.5, Strings: 1, Instructions: 293COMMON

Download Yara Rule

Strings

0, xrefs: 0090C01F

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: d9e87bd5bac8469a79b35ebc1e4003f3f1d3eb17d433c267cc7eecdecfc9df35
Instruction ID: 2ce7e7a0030af2ee530b4870a84530a6f9268bfb6fc673872b6e9c51801a415b
Opcode Fuzzy Hash: d9e87bd5bac8469a79b35ebc1e4003f3f1d3eb17d433c267cc7eecdecfc9df35
Instruction Fuzzy Hash: B1B1CDB490460ACFCB24DF68C880ABAB7B9EF45304F244B19D9A6A73D2C731AD45CF51

Function 008FF26A Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,?,008FEC78,?,?,?,?,008340EB,?,00883C2E), ref: 008FF283

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 36fd75f2c3ed645aa63edee0bd3233869aa8113addd8e3dd8e1eaf4bdf60d50d
Instruction ID: b1fdeb5710f5a707034ea5cb5f0bdbe3bda14d89af73cc2057f29cf93149150a
Opcode Fuzzy Hash: 36fd75f2c3ed645aa63edee0bd3233869aa8113addd8e3dd8e1eaf4bdf60d50d
Instruction Fuzzy Hash: 81D0223269523C938A213BE0FC0487CBB28EE09B903500037FB05A3128CE615C02EBC4

Function 008A9880 Relevance: .7, Instructions: 748COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1ae7b508574a3d5998c6f9ac65963f0ae5284503311bef1a463a95e6b50748e
Instruction ID: 6ea58b5269740c2cc832bd7b757af7f25413262be3a6c0a19687eac3ab71e985
Opcode Fuzzy Hash: a1ae7b508574a3d5998c6f9ac65963f0ae5284503311bef1a463a95e6b50748e
Instruction Fuzzy Hash: F8627DB0E042149FEB18CF59C4846ADBBF1FF89308F2881A9D844EB746D775D946CB91

Function 00919824 Relevance: .3, Instructions: 270COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7210c3f750f62daefed82840038d2983538e2b680b787b953231cf69c8d1c65
Instruction ID: 335f8a1e419279b1095caf7138ba7cd8d76dd942fbdc96ad40a62dee2f437b4c
Opcode Fuzzy Hash: b7210c3f750f62daefed82840038d2983538e2b680b787b953231cf69c8d1c65
Instruction Fuzzy Hash: EAB13A316106089FD719CF28C49ABA57BE4FF45364F29869CE8DACF2A1C335E995CB40

Function 008224F0 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d65315b4d7c15a12aad0d64093f20d80529934f81e7ad5e0f123a3e39d8dc833
Instruction ID: 17f45d3ef83a0bd9065d545595e98a340d604ffa4b8fc149cb3d77b1442b963c
Opcode Fuzzy Hash: d65315b4d7c15a12aad0d64093f20d80529934f81e7ad5e0f123a3e39d8dc833
Instruction Fuzzy Hash: 417112B5D04266AFDB14CF6DE9D07FEBBA4FB29304F000169D864D7382C724998AD7A0

Function 008A6550 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66ffa5d12fe2af512e27cc4d7db98cd51ee17c3dc8a6dec640178251cd814627
Instruction ID: c46164d6e4963b2c89ab10c07249d31e30493e61046547a552876193f2d4b834
Opcode Fuzzy Hash: 66ffa5d12fe2af512e27cc4d7db98cd51ee17c3dc8a6dec640178251cd814627
Instruction Fuzzy Hash: 506141716241644FD718CF5EECC05363361E78A31138A466AEBC1DB3A6C735E936EBA0

Function 00834100 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97c9f8bb78ff094fad92454162d51fefae7f69e3af9fdf4d1aa0b45e469af101
Instruction ID: a805c9f5c7d2bb30fac00edbb3c2e9b484307a04f6a4c9a774b7145dcfa781fd
Opcode Fuzzy Hash: 97c9f8bb78ff094fad92454162d51fefae7f69e3af9fdf4d1aa0b45e469af101
Instruction Fuzzy Hash: 6E518BB1E002099FCB18DF98D881AEEBBB5FB88310F14556DE419F7791D734AA44CBA0

Function 00DBD1AE Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dd8f519b587e55e38fcbfea5876b55f5623abdb7c83246d071a47343c68dad6
Instruction ID: c7d26572c7064273c72a173e31b22df020e1003ba4fd08f8e59b29b07d2ae8be
Opcode Fuzzy Hash: 7dd8f519b587e55e38fcbfea5876b55f5623abdb7c83246d071a47343c68dad6
Instruction Fuzzy Hash: 3751A9B26087049FE344AF29D88177ABBE4EF94320F1A492DE6C5C7710E6759880CB47

Function 0090646A Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 920c44e739ca4d08db5b5969fbc7a5a158caad0a814d8dad7807257cb044add9
Instruction ID: e0d2329906fbeecf5e3c05d8949c0a64908976b4a4a42f9fcbff08d8057eac27
Opcode Fuzzy Hash: 920c44e739ca4d08db5b5969fbc7a5a158caad0a814d8dad7807257cb044add9
Instruction Fuzzy Hash: 1E519F72E00219EFDF04CF98CD41AEEBBB6FF88310F198458E915AB241D734AA50DB90

Function 0537005C Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3793493063.0000000005370000.00000040.00001000.00020000.00000000.sdmp, Offset: 05370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5370000_LisectAVT_2403002A_185.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bb8eb7f85e1975caa19789d39cf180ef34c8d150c255d707200f5b4c6c3da7c
Instruction ID: 98f9df3448ce53e934455a3f444703c5611389d64e44243e9beeacb1a140aed7
Opcode Fuzzy Hash: 8bb8eb7f85e1975caa19789d39cf180ef34c8d150c255d707200f5b4c6c3da7c
Instruction Fuzzy Hash: AC112AFB648114BE712AC9826F18EFB6B6EE5C2730331C83BF802D5406E2DA4E1E5571

Function 00902CE0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 7993fe6aee78253ec48f08b58d6fb7600d5dac66821af4ae4997b30b9ad24fca
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: BA113DB72404824FD6148B3DD8BC6B7E39DEBD532473C437AD0414B7D8E222DD45A900

Function 0088F810 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0088F833
std::_Lockit::_Lockit.LIBCPMT ref: 0088F855
std::_Lockit::~_Lockit.LIBCPMT ref: 0088F875
std::_Lockit::~_Lockit.LIBCPMT ref: 0088F89F
std::_Lockit::_Lockit.LIBCPMT ref: 0088F90D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0088F959
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0088F973
std::_Lockit::~_Lockit.LIBCPMT ref: 0088FA08
std::_Facet_Register.LIBCPMT ref: 0088FA15

Strings

bad locale name, xrefs: 0088FA2F
Ps, xrefs: 0088F96B, 0088F972

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$Ps
API String ID: 3375549084-1174896957
Opcode ID: bc9896f9729a7d3cb1b4e20c9f1a47beea2a6287e1bb212cbf4396e2fef81350
Instruction ID: 1dd7bd496a57975ced32f5772ef91bd125f92a724af023c7be269783a74e65b8
Opcode Fuzzy Hash: bc9896f9729a7d3cb1b4e20c9f1a47beea2a6287e1bb212cbf4396e2fef81350
Instruction Fuzzy Hash: A6617EB1D003089FDB10EFA8D845B9EBBB4FF54314F144068EA05EB392D774A905CB92

Function 008239F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00823A58
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00823AA4
__Getctype.LIBCPMT ref: 00823ABA
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00823AE6
std::_Lockit::~_Lockit.LIBCPMT ref: 00823B7B

Strings

bad locale name, xrefs: 00823B96

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: ba050e7c8ffe4c7969d86e7e01da2baf7313a2a3b7c346d2ee10f5527f89e9e6
Instruction ID: 73c7fcd647d4ac088fddf29b0b475472895fca5190659a8e8f38785a42e6d740
Opcode Fuzzy Hash: ba050e7c8ffe4c7969d86e7e01da2baf7313a2a3b7c346d2ee10f5527f89e9e6
Instruction Fuzzy Hash: F9514FB1D002589FDB10DFA8D855B9EBBB8FF14310F144069E909EB381E778DA44CB52

Function 00902E10 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00902E47
___except_validate_context_record.LIBVCRUNTIME ref: 00902E4F
_ValidateLocalCookies.LIBCMT ref: 00902ED8
__IsNonwritableInCurrentImage.LIBCMT ref: 00902F03
_ValidateLocalCookies.LIBCMT ref: 00902F58

Strings

csm, xrefs: 00902EED

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 963a87be952ff6cbb2f79de58c41717a9a8770d9bbc56bdfcbdb3cb51175a2e6
Instruction ID: 9f1cb9e2d7533ae3e66cd7361d7833f359100a6058a997f97a95bbb89bb2f890
Opcode Fuzzy Hash: 963a87be952ff6cbb2f79de58c41717a9a8770d9bbc56bdfcbdb3cb51175a2e6
Instruction Fuzzy Hash: 9E41D630A00209AFCF10DF69C889B9EBBB9AF85364F148055F914AB3D2D731EE55CB91

Function 0088DE70 Relevance: 9.1, APIs: 6, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0088DE93
std::_Lockit::_Lockit.LIBCPMT ref: 0088DEB6
std::_Lockit::~_Lockit.LIBCPMT ref: 0088DED6
std::_Facet_Register.LIBCPMT ref: 0088DF4B
std::_Lockit::~_Lockit.LIBCPMT ref: 0088DF63
Concurrency::cancel_current_task.LIBCPMT ref: 0088DF7B

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 6de0c60faac39e2e0e4804ed26b95e90ae7937739054d52fb44d4ac008c9fb53
Instruction ID: faebb911eda54fad13d18c62cb9f57f738a5dcc0315964746b2766103e7b689b
Opcode Fuzzy Hash: 6de0c60faac39e2e0e4804ed26b95e90ae7937739054d52fb44d4ac008c9fb53
Instruction Fuzzy Hash: DF41E371914319DFCB14EF68E881A6EBBB4FB44710F144269EA15DB392DB30AD40DBD2

Function 00824C50 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 442COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00824F72
___std_exception_destroy.LIBVCRUNTIME ref: 00824FFF
___std_exception_copy.LIBVCRUNTIME ref: 008250C8

Strings

recursive_directory_iterator::operator++, xrefs: 0082504C

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$___std_exception_copy
String ID: recursive_directory_iterator::operator++
API String ID: 1206660477-953255998
Opcode ID: 31e958e778bb3de149da70519951176a8ac2279809dea8086f584bde272f1256
Instruction ID: df58656f6e14884db9fb0e76ae3fdf69b555b956603d9b7f41c3937d4cf921f5
Opcode Fuzzy Hash: 31e958e778bb3de149da70519951176a8ac2279809dea8086f584bde272f1256
Instruction Fuzzy Hash: 00E124B19002189FDB28DF68E845BAEB7F9FF48710F104A2DE456D3781D774A944CBA1

Function 00827820 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0082799A
___std_exception_copy.LIBVCRUNTIME ref: 00827B75

Strings

type_error, xrefs: 0082784A
out_of_range, xrefs: 00827A27

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: out_of_range$type_error
API String ID: 2659868963-3702451861
Opcode ID: d0340af595995d7715775b6d668206638273ad9d7037d19cd473f64a7828569e
Instruction ID: c40f972e4316db8b27128200634c053d072d326ea3fd6cf6d005c21b9f3d2c7d
Opcode Fuzzy Hash: d0340af595995d7715775b6d668206638273ad9d7037d19cd473f64a7828569e
Instruction Fuzzy Hash: BAC168B19002188FDB18CFA8E884B9DFBF1FF49310F148669E419EB782E7749980CB51

Function 008273B0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 008275BE
___std_exception_destroy.LIBVCRUNTIME ref: 008275CD

Strings

at line , xrefs: 008273F7
, column , xrefs: 00827434, 0082744A

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column
API String ID: 4194217158-191570568
Opcode ID: c8fe82fc7642b32c6505416c8b5f64d8ab34f84a8d7a10af89e9cefd6d9449b0
Instruction ID: ab76ba87a1cb985fe024681e897a262958fe463f90f49195f5722c2c8317afe4
Opcode Fuzzy Hash: c8fe82fc7642b32c6505416c8b5f64d8ab34f84a8d7a10af89e9cefd6d9449b0
Instruction Fuzzy Hash: D261D571A042199FDB08DF68ED85BADBBB6FF44300F14462CF415E7781D774A9808B91

Function 00823D10 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00823E7F

Strings

ios_base::eofbit set, xrefs: 00823E41, 00823E63
ios_base::failbit set, xrefs: 00823D32
ios_base::badbit set, xrefs: 00823E17

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: 98ec5e7b561632f935e82db2c5be213114363f3b3b204327d02911b27a3d6dfa
Instruction ID: 7acd1e9e59eb6d2df6f6575b99ed93eb761df758d9d6853898f44a7b8851a05c
Opcode Fuzzy Hash: 98ec5e7b561632f935e82db2c5be213114363f3b3b204327d02911b27a3d6dfa
Instruction Fuzzy Hash: A04118B6900218AFCB14DF68D851BAEB7F8FF48710F14852AF915E7741E774AA44CBA0

Function 00823DE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00823E7F

Strings

ios_base::eofbit set, xrefs: 00823E28, 00823E41, 00823E63
ios_base::failbit set, xrefs: 00823D32, 00823E1E
ios_base::badbit set, xrefs: 00823E17

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: 1a99757ca03cca9004d02f39cb1b13847ea9119838f59663ed34f5feea196d35
Instruction ID: af6f6ee9a34dfb8bc998d887e1543869283379ae5adb0786bbcb52b74a884787
Opcode Fuzzy Hash: 1a99757ca03cca9004d02f39cb1b13847ea9119838f59663ed34f5feea196d35
Instruction Fuzzy Hash: A52105B69003146FC724DF58E815F96B7E8FB44710F08883AFA68DB681E774EA548B91

Function 00826F40 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 349COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00827340

Strings

parse_error, xrefs: 00826F8B
parse error, xrefs: 00826FFF, 00827018

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: parse error$parse_error
API String ID: 2659868963-1820534363
Opcode ID: f7aae4d59cbe30c13bc3a668190816dae1814182d6fbba64ac0f623f677996b9
Instruction ID: 3fd0da0e472a642e86cdbb2eb1d80625da81908963d9b3cfc0ad9af9141cbc7f
Opcode Fuzzy Hash: f7aae4d59cbe30c13bc3a668190816dae1814182d6fbba64ac0f623f677996b9
Instruction Fuzzy Hash: 4BE15C709042588FDB18CF68D885B9DBBB2FF49300F248269E419EB792D7749A85CF91

Function 00826C60 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00826F11
___std_exception_destroy.LIBVCRUNTIME ref: 00826F20

Strings

[json.exception., xrefs: 00826CB8

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.
API String ID: 4194217158-791563284
Opcode ID: 70db6c524abbe37004ea6b73571639e92f4d73a04220048b68b6cc807e520f4e
Instruction ID: e8f8e94f06c288dd789b6591add7bbaf6c565d94a68142bee2ddf372e90d9a29
Opcode Fuzzy Hash: 70db6c524abbe37004ea6b73571639e92f4d73a04220048b68b6cc807e520f4e
Instruction Fuzzy Hash: C091E674A002189FDB18CF68D984B9EBBF6FF44300F20866DE415EB792E771A981CB51

Function 0089E440 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0089E491

Strings

type must be boolean, but is , xrefs: 0089E582
type must be string, but is , xrefs: 0089E4F8

Memory Dump Source

Source File: 00000000.00000002.3788079300.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.3788016037.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788079300.0000000000953000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788426420.0000000000958000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.000000000095C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788479543.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789161730.0000000000C18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3789417141.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_LisectAVT_2403002A_185.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: type must be boolean, but is $type must be string, but is
API String ID: 118556049-436076039
Opcode ID: b87660aedd89df386f7df4b3d2238ae95f2aff1a0dd2d714b90b0af6e043ce50
Instruction ID: 026e7c126ca123b92cf5b1680ae623fff35af81df359ee8bd4c2a84a49488487
Opcode Fuzzy Hash: b87660aedd89df386f7df4b3d2238ae95f2aff1a0dd2d714b90b0af6e043ce50
Instruction Fuzzy Hash: 55412DB1900248AFDB14FBA8E842B9E7BA8FB40310F144675F515D7782EB35E944C797

Analysis Process: MPGPH131.exePID: 7572, Parent PID: 1124COMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	1.1%
Signature Coverage:	0%
Total number of Nodes:	625
Total number of Limit Nodes:	64

Executed Functions

Function 00273A40 Relevance: 2.7, APIs: 2, Instructions: 157
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E9,?,00000001,00000000,?,?,?,?,?,?,?,?,00273DB6), ref: 00273B08
Sleep.KERNELBASE(00000001,?,00000001,00000000,?,?,?,?,?,?,?,?,00273DB6), ref: 00273BBA

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 577013c1b45769c3bd243829062153bc30c053a75f107bf121df6bd722f681f9
Instruction ID: ccef5a1183d406ddc9d65a6936c49d63e6675bb59a9a024e23dcb50d174be6fa
Opcode Fuzzy Hash: 577013c1b45769c3bd243829062153bc30c053a75f107bf121df6bd722f681f9
Instruction Fuzzy Hash: 8F51B835A1421ACFCB24CF58C8D1EAAB3B5FF48708F29859AD449AB351D731EE15DB80

Function 0022E0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 0022E0CA
socket.WS2_32(?,?,?), ref: 0022E17F
connect.WS2_32(00000000,?,?), ref: 0022E193
closesocket.WS2_32(00000000), ref: 0022E19E

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: 8440f7d8ae3c828e4a1313edbb41495a8ca2c513016897ab2267171121762ab5
Instruction ID: 2daaac0b151821fcbc2475f8b0021e972ee119ab34630aa12f62103fef22f6f6
Opcode Fuzzy Hash: 8440f7d8ae3c828e4a1313edbb41495a8ca2c513016897ab2267171121762ab5
Instruction Fuzzy Hash: F831D2715043116BDB209F68DC4976BB7E4EF85738F025F2DF8A8A62D0D3319C249BA2

Function 002EF290 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0021220E

Strings

`!!, xrefs: 00212216
`!!, xrefs: 002121FC

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!!$`!!
API String ID: 2659868963-2180691272
Opcode ID: 4c3baa47f2fc7ac8229b19121d48aeb457c3582fa999572f82e77655b378a937
Instruction ID: 5797e7a1145d7205acbe704b388a24ee9ef47f069e0dd1505d19624fb95200fa
Opcode Fuzzy Hash: 4c3baa47f2fc7ac8229b19121d48aeb457c3582fa999572f82e77655b378a937
Instruction Fuzzy Hash: DF012B3941030DABCB18EFA9E8019A9B7ECDA00360B404439FF1CDB691E770E9B48BD1

Function 04C20041 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 209
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

P, xrefs: 04C2007B

Memory Dump Source

Source File: 00000006.00000002.3793812197.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c20000_MPGPH131.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 046fd0d9ecb231f99dcdfb799274adf3000e249aeb505cf24f41a70b6a48d2dc
Instruction ID: 38942e17965b364f2c494f4d80377b0435d112bc8d518689ef86b488b1bf0789
Opcode Fuzzy Hash: 046fd0d9ecb231f99dcdfb799274adf3000e249aeb505cf24f41a70b6a48d2dc
Instruction Fuzzy Hash: 0E4106EB30C231BEF20296536B55AFB6B6FE5C2330738842BF647E5502F2D46A496131

Function 04C20000 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C20340

Strings

PRPR, xrefs: 04C20009

Memory Dump Source

Source File: 00000006.00000002.3793812197.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c20000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID: PRPR
API String ID: 2104809126-1001624005
Opcode ID: 81e4fc6ffde29acce3b0d4e11ad8c130a96e37f54f50e92da5f10abc046dbb34
Instruction ID: edb511ae18d6b3d3d1928b6577c315d32055b7ff2d06d04cea7c0c42a745420f
Opcode Fuzzy Hash: 81e4fc6ffde29acce3b0d4e11ad8c130a96e37f54f50e92da5f10abc046dbb34
Instruction Fuzzy Hash: E8419DEB30C231BDB10286576B54AFA6A2FE6C6734738842BF607E5102F2D46A497131

Function 002F4942 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

O/, xrefs: 002F4A93, 002F4A61, 002F4AAB, 002F4AC7

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID: O/
API String ID: 0-786838103
Opcode ID: 0f2ed4acd35e06abfeb8ab5359506890258ebe257ad8b887becf5c10587ee188
Instruction ID: 6461959355aaffaa787067a780a662ae6531c6f4a13dcbb5b9a6d6c4636a9cac
Opcode Fuzzy Hash: 0f2ed4acd35e06abfeb8ab5359506890258ebe257ad8b887becf5c10587ee188
Instruction Fuzzy Hash: E951E770A1010CAFDB14EF58C891ABBFBB5EF45394F248168F9499B252D3B19E61CB90

Function 00304623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567fc9bfc9507278f83a0c3a31b4d57581aea4163067429cdae6f313e081e07f
Instruction ID: 5e1d7a3cb6c80fc64046906ae49d0aad243bda76f011e63fbaaa39218e5ba048
Opcode Fuzzy Hash: 567fc9bfc9507278f83a0c3a31b4d57581aea4163067429cdae6f313e081e07f
Instruction Fuzzy Hash: D6B13BB0A05249AFDB13DF98D8A1BBEBBB5AF46300F154168E6409B2C2C771AE51CF51

Function 0021A210 Relevance: 1.7, APIs: 1, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 0021A343

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: c7a6c4c90ba69bd95a487fe68d9fe0d9b5a48781750c24e3400881418b9d7292
Instruction ID: ce1649d151f0ee528c4c6b37fafc322b587cdc2689647eb4afe2a84cbb8d7cc2
Opcode Fuzzy Hash: c7a6c4c90ba69bd95a487fe68d9fe0d9b5a48781750c24e3400881418b9d7292
Instruction Fuzzy Hash: 16714870911208AFDB14DF68CC45BEFF7E8EF41340F1041ADF9199B282D7B599908B92

Function 0030549C Relevance: 1.7, APIs: 1, Instructions: 198
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000000,002F9087,?,00000000,00000000,00000000,?,00000000,?,0021A3EB,002F9087,00000000,0021A3EB,?,?), ref: 00305621

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: fe20f119b7b91cafa61f9765e8ba3694f2dc0ae85c9583123a3d458f07bc08f3
Instruction ID: 593884700fab013d29462d4da2d229328b62da86a4d16a40223592f40c80e531
Opcode Fuzzy Hash: fe20f119b7b91cafa61f9765e8ba3694f2dc0ae85c9583123a3d458f07bc08f3
Instruction Fuzzy Hash: B761A27190150DAFDF12DFA8C894AEFBBBAAF1A304F550145E900AB295D772D911CFA0

Function 04C20023 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C20340

Memory Dump Source

Source File: 00000006.00000002.3793812197.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c20000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 9fd008eb2126ec51dfb2d1c0897e8d1ce628b963c445995520bdebbdc62b1d47
Instruction ID: 935bdea0d7a264b50da6399e1844f4fc4ada2e2fb5a99788fdb5c401f83b4ff7
Opcode Fuzzy Hash: 9fd008eb2126ec51dfb2d1c0897e8d1ce628b963c445995520bdebbdc62b1d47
Instruction Fuzzy Hash: D241CFEF30C231BDB1018A476B54AFB6B6FE2C6330738842BF607E5102F2D46A896031

Function 04C20012 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C20340

Memory Dump Source

Source File: 00000006.00000002.3793812197.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c20000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 80948e5b0e8bb14f3c16bc58002756b6a51ed16b3eb20339baa541fbbeb484be
Instruction ID: 3c779350f68fba6e14ccd392e6b6e0c9b383c19ae766351928398e0e6fdca88b
Opcode Fuzzy Hash: 80948e5b0e8bb14f3c16bc58002756b6a51ed16b3eb20339baa541fbbeb484be
Instruction Fuzzy Hash: 4B4181EF30C231BDB1019A476B54AFB666FE6D6730738842BF607E5101F2D46A496131

Function 04C20095 Relevance: 1.7, APIs: 1, Instructions: 173
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C20340

Memory Dump Source

Source File: 00000006.00000002.3793812197.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c20000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: f7accd289fdd8177ee8140f90db5b7e72ada98191b9a359aae2af201adb98e2b
Instruction ID: 84db9fee5872f22d04287ff38438634388f0f2c2c1f53aa01a90cad2a0d1341f
Opcode Fuzzy Hash: f7accd289fdd8177ee8140f90db5b7e72ada98191b9a359aae2af201adb98e2b
Instruction Fuzzy Hash: 123192EF30C231BDB1418A476B54AFB666FE6C6730B38842BF607E5502F2D46A897131

Function 04C200A0 Relevance: 1.7, APIs: 1, Instructions: 169
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C20340

Memory Dump Source

Source File: 00000006.00000002.3793812197.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c20000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 9faf0522fcae5bb93ae80de479d217f5be9c7391042389706eacbdfa394939de
Instruction ID: c1cb5f35511420a169b81e2a9bc2f40fc09acb5022c3abfa38baf3c4dcb27156
Opcode Fuzzy Hash: 9faf0522fcae5bb93ae80de479d217f5be9c7391042389706eacbdfa394939de
Instruction Fuzzy Hash: 513192EF30C231BDB1418A476B54AFB676FE6C6730B38842BF607E5502F2D46A896131

Function 04C20152 Relevance: 1.7, APIs: 1, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3793812197.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c20000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2264e7c5d276d5d2eb4cb9b7b3cb2e27f71b2ba49c8a0ce3e8fb3eb2f743af0
Instruction ID: f2a91871734c3ec4d27897233cb8cdf9dff1f8b5fef7abb375f1a85d66f56d4c
Opcode Fuzzy Hash: d2264e7c5d276d5d2eb4cb9b7b3cb2e27f71b2ba49c8a0ce3e8fb3eb2f743af0
Instruction Fuzzy Hash: 1F3109EF24C230BEE1019A575B54AF76B2FE6C6330739452BF607A6102F2D46A496131

Function 04C200C6 Relevance: 1.7, APIs: 1, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C20340

Memory Dump Source

Source File: 00000006.00000002.3793812197.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c20000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 94e25d639bed54b9798c7f6fcbcb14b434c566a2f7a31c985d94bf5712e8c396
Instruction ID: 5e8b227ae7c266b88966e9727fb4beb0e4b9a8b312736df4e01abe0b17a8808f
Opcode Fuzzy Hash: 94e25d639bed54b9798c7f6fcbcb14b434c566a2f7a31c985d94bf5712e8c396
Instruction Fuzzy Hash: 5431D7EF34C231BDB1418A576B54AFA662FE6C6330738852BF607E5202F6D46A897031

Function 04C200D9 Relevance: 1.7, APIs: 1, Instructions: 152COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C20340

Memory Dump Source

Source File: 00000006.00000002.3793812197.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c20000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 73cf72f0966f3710460d59d42e9d81a54ed8741426f94483e35cc7e30457f687
Instruction ID: 02e01a1c2634021d50105cccb2e3f7cfefd1ce33053b4e4210f3bbf6d5da408c
Opcode Fuzzy Hash: 73cf72f0966f3710460d59d42e9d81a54ed8741426f94483e35cc7e30457f687
Instruction Fuzzy Hash: 1931E8EF30C234BEB1019A576B547FB6A6FE6C6370738442BF607E6202F2D46A496131

Function 04C20141 Relevance: 1.7, APIs: 1, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3793812197.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c20000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67c117539b96767711b092775869f6b63039a60ab61d2a7dd8fe9106ef5124f3
Instruction ID: b3dd23a98ffe10406d09f584607211e8a70f92be4bf3446e1513ef8b3d368ee4
Opcode Fuzzy Hash: 67c117539b96767711b092775869f6b63039a60ab61d2a7dd8fe9106ef5124f3
Instruction Fuzzy Hash: 0031E6EF74C234BDB1019A575B54BFAAA6FE6C6330738442BF607E5102F2D46E896031

Function 04C2010B Relevance: 1.6, APIs: 1, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3793812197.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c20000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f489b2b476e636298a0edf8ceac1a8c8a7afd983dfa137306ae9eb38a9a728f
Instruction ID: 669f9f7666f5c844419128887f2bc8b6efcc142b5d0f3265aaed2c30b507d0a8
Opcode Fuzzy Hash: 1f489b2b476e636298a0edf8ceac1a8c8a7afd983dfa137306ae9eb38a9a728f
Instruction Fuzzy Hash: F53106EF20C231BEE24296575B54AFB6B2FE6C2330739452BF607E5102F2D46A896131

Function 04C200F6 Relevance: 1.6, APIs: 1, Instructions: 146COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C20340

Memory Dump Source

Source File: 00000006.00000002.3793812197.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c20000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: a25590c959fefdd37bbc4cf17afe1fc7634b2c8acd9c3610b50f45f6ba64fa56
Instruction ID: 683dc9d528ccb492bdce5cde2fab3e6fe155ad231359e201e880e4a6d6ac12b1
Opcode Fuzzy Hash: a25590c959fefdd37bbc4cf17afe1fc7634b2c8acd9c3610b50f45f6ba64fa56
Instruction Fuzzy Hash: C731FBEF34C230BDB1018A575B54AFB6A2FE6C6330738442BF607E5501F2D46B486031

Function 04C2012B Relevance: 1.6, APIs: 1, Instructions: 142COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C20340

Memory Dump Source

Source File: 00000006.00000002.3793812197.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c20000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 81c683634f5a12c2a60f6cc854d7974878f359bfb68f0a22148681e255c8fa00
Instruction ID: 4f6f7277daf1a3218133fc576625430b693b9e9fb9807b79c6b2882d09db2962
Opcode Fuzzy Hash: 81c683634f5a12c2a60f6cc854d7974878f359bfb68f0a22148681e255c8fa00
Instruction Fuzzy Hash: C32106EF34C231BDB10196576B54BFB6A2FE6C2370739852BF607E5202F2D46A892071

Function 00280560 Relevance: 1.6, APIs: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 002806AE

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction ID: 6c831b25343691ddd4c931ca0a7a5cfd9605b226671e1d465d993c1cbb3fed7f
Opcode Fuzzy Hash: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction Fuzzy Hash: 46410676A111299BCB05EF68DD806AEB7A9AF84340F540179FC05EB342E770ED748BE1

Function 04C20184 Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3793812197.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c20000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92e01c1f83ea9e3ff67b4177d4334cbbc64811744b968fa1d38e5e2d5ac773d2
Instruction ID: f3e43be06621e1db0979f6e2cc73672b3cf6fc90b8829e003fce7c25d890a037
Opcode Fuzzy Hash: 92e01c1f83ea9e3ff67b4177d4334cbbc64811744b968fa1d38e5e2d5ac773d2
Instruction Fuzzy Hash: 8421E6EB20C2307EB20295476B446FB576FF6C2770B38402BFA07D5503F1D56A492131

Function 04C201D5 Relevance: 1.6, APIs: 1, Instructions: 105COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C20340

Memory Dump Source

Source File: 00000006.00000002.3793812197.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c20000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 1d4bf13530463c608c3e60cc9f3fca77299e7477d10635f99914d078ca0b9085
Instruction ID: cbb88dd4990ee7d6b6d93edd411c6c628b49814f0c476389028c18f5497bf8c6
Opcode Fuzzy Hash: 1d4bf13530463c608c3e60cc9f3fca77299e7477d10635f99914d078ca0b9085
Instruction Fuzzy Hash: 5F1160EB24C235BDB14291476F54BFB562FE6C6770B398427FA07D1502F2D46E892031

Function 04C201E5 Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C20340

Memory Dump Source

Source File: 00000006.00000002.3793812197.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c20000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 3839e3cb33eaeb14155e02e36bcbe9ec0d3f510cd58d016ecb16c93bc4fa85a0
Instruction ID: 156e29aa7e136af3856173e807ab43dad828fe791965419162815c638e325a10
Opcode Fuzzy Hash: 3839e3cb33eaeb14155e02e36bcbe9ec0d3f510cd58d016ecb16c93bc4fa85a0
Instruction Fuzzy Hash: 86116DEB24C231BDB10291476F54AFB562FE2C6370B398427FA07D4102F2D86A892131

Function 04C20200 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C20340

Memory Dump Source

Source File: 00000006.00000002.3793812197.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c20000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: c5c758cf2436914b23cefd292835d46e3188530c9296f088b0e393b234b880ff
Instruction ID: a5a6f56bef337ab5b61aca9c04ea926362f6fd96bff3c322786d817eb05ea234
Opcode Fuzzy Hash: c5c758cf2436914b23cefd292835d46e3188530c9296f088b0e393b234b880ff
Instruction Fuzzy Hash: D2114CEB24C135BDB10291876F54AFB576FE6D6770B38842BFA03E0006F2D82A892031

Function 04C20217 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C20340

Memory Dump Source

Source File: 00000006.00000002.3793812197.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c20000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 6104a7012ad57bd3b6f826b3f27e57e35f6f70a9934de0d67c824da828978672
Instruction ID: 08f5ed7f3aed16bfbd85017f8d67bc5d2d05d9e23d840fac5ee1cf9086f1f0b4
Opcode Fuzzy Hash: 6104a7012ad57bd3b6f826b3f27e57e35f6f70a9934de0d67c824da828978672
Instruction Fuzzy Hash: D7115EEB64C2757D714291872F55AFB5B6FE4C6770739842BFA03D5406F2C86A8D2031

Function 04C2023C Relevance: 1.6, APIs: 1, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C20340

Memory Dump Source

Source File: 00000006.00000002.3793812197.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c20000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 94cca7d49f6763bad7c069b35b80a18df643bfdd993842efa70af860d935694c
Instruction ID: d02a639d80806466429544942960435c6fddaff7d2fbf89391903113780b5c34
Opcode Fuzzy Hash: 94cca7d49f6763bad7c069b35b80a18df643bfdd993842efa70af860d935694c
Instruction Fuzzy Hash: E4014CEB20C631BDB10191472F65AFB576FE5D5370739842BFA03D5502F6C86A892131

Function 04C20295 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C20340

Memory Dump Source

Source File: 00000006.00000002.3793812197.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c20000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 8251538e63eeddea240a5740fb15dc30cb7369b8f1721dfba796c7e5b962d0bf
Instruction ID: 1b6b73219db8891ae4c2193dcf92a0fdee8628e27ed4cd593e59c461d77e16a2
Opcode Fuzzy Hash: 8251538e63eeddea240a5740fb15dc30cb7369b8f1721dfba796c7e5b962d0bf
Instruction Fuzzy Hash: 8701BCEB74C1317DB10594476B1AAFB1B2FE1C6770339882BF603D4405F2C46A8A2071

Function 04C2025B Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C20340

Memory Dump Source

Source File: 00000006.00000002.3793812197.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c20000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: d188ac36b6b14b47c11c8b823983bcc334b705553a24ce2c6a38630bd586b0d2
Instruction ID: 3cff33ec125b3a99f843e13c9feb3f0479d22fd5dbb9f14a4abfa11b3e56b981
Opcode Fuzzy Hash: d188ac36b6b14b47c11c8b823983bcc334b705553a24ce2c6a38630bd586b0d2
Instruction Fuzzy Hash: 11014BEB74C131BDB10191476F59AFB5B2FE1D6770739882BFA03D4505F2C56A892071

Function 04C20275 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C20340

Memory Dump Source

Source File: 00000006.00000002.3793812197.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c20000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: e03df27ba2b8d0d1af53ae2efc21f0484701438986ab5e9b80343e8fab9bcd09
Instruction ID: b7e607c53290b99812870890f0ad8522c5854a3b588bdbfd9e2fe345382f7abb
Opcode Fuzzy Hash: e03df27ba2b8d0d1af53ae2efc21f0484701438986ab5e9b80343e8fab9bcd09
Instruction Fuzzy Hash: E801AFEA70C231BEB10195472F55AFB6B6FE6D5770739882BFA03D4502F2D82A892031

Function 00304B12 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,003049F9,00000000,CF830579,00341140,0000000C,00304AB5,002F8BBD,?), ref: 00304B68

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 4b5ef46ab1b2c7220ec94ca2b5671ad7eec055c875e5481ca7381088ebaf7700
Instruction ID: 6a1c4939b08949837a1b9a00aa75fe208bf0e72ec806c0ae1953d843bd0699d6
Opcode Fuzzy Hash: 4b5ef46ab1b2c7220ec94ca2b5671ad7eec055c875e5481ca7381088ebaf7700
Instruction Fuzzy Hash: F9116B33A4321816D72736347962B7E7B598BC3774F2A0249FB489F1C2EE62ED414199

Function 002FE05C Relevance: 1.6, APIs: 1, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00340DF8,0021A3EB,00000002,0021A3EB,00000000,?,?,?,002FE166,00000000,?,0021A3EB,00000002,00340DF8), ref: 002FE098

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 4bac6eece5e4d1bcb3b0c98c2bab3fe8a9f0484303e4d88ecb808e558fdc1f69
Instruction ID: 2301557073516d676e43e38bcdf6644a53392319012736456489a25ad02710a7
Opcode Fuzzy Hash: 4bac6eece5e4d1bcb3b0c98c2bab3fe8a9f0484303e4d88ecb808e558fdc1f69
Instruction Fuzzy Hash: 3F012B32620119AFCF169F59CC05CAE7B29DF81364B25025CF950AB1E1EAB2EE518BD0

Function 04C202C7 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C20340

Memory Dump Source

Source File: 00000006.00000002.3793812197.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c20000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 0ecf4b2ff56446b6a7ecfd43149278ae1773799dc8d0411a1142f300a5cda8a2
Instruction ID: 561e2018f848052fce4f1ae917d37612f4803bec09ee99545bb09321803cf9ba
Opcode Fuzzy Hash: 0ecf4b2ff56446b6a7ecfd43149278ae1773799dc8d0411a1142f300a5cda8a2
Instruction Fuzzy Hash: 1FF028A670C2B06EF34162331F647FB1B9B96C2260B38446BE943C140BF2C9294D2033

Function 04C202AD Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C20340

Memory Dump Source

Source File: 00000006.00000002.3793812197.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c20000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: f40557d10d5471c8164ac4fbc89e5204e8d2600b1957afce221d2453fadd91ff
Instruction ID: 4e27ab68d84343199f21417a3dbd049db3f632274b14bdc3ba99047021fc5316
Opcode Fuzzy Hash: f40557d10d5471c8164ac4fbc89e5204e8d2600b1957afce221d2453fadd91ff
Instruction Fuzzy Hash: 85F082E720C270BDB242D1532B51AFB5B9FE5D5270738881BFA03D4506F2D929892132

Function 003063F3 Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,002F91F7,00000000,?,00305D79,00000001,00000364,00000000,00000006,000000FF,?,00000000,002FD244,002F89C3,002F91F7,00000000), ref: 00306435

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a9cf9be1dc6b3d682161f77f76858941a4ba09900bad3d616819252f2ad89c52
Instruction ID: c32d289b44ccb1c3f4072953ea51af9cf1f949f464d40b850d39a544122847c7
Opcode Fuzzy Hash: a9cf9be1dc6b3d682161f77f76858941a4ba09900bad3d616819252f2ad89c52
Instruction Fuzzy Hash: FCF0E93150312567DB236F679C23B5B3B4DDF81760F168122ED049A4C8CB30E83046E1

Function 00306E2D Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0030D635,4D88C033,?,0030D635,00000220,?,003057EF,4D88C033), ref: 00306E60

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f112d334607b483eb01827e98107621f88887693e5cea1531e829b16ac7c4662
Instruction ID: eb486f0798bb584837e74f22c68262937f241c8e3e5c4ddf7dcd44e2e1f008ca
Opcode Fuzzy Hash: f112d334607b483eb01827e98107621f88887693e5cea1531e829b16ac7c4662
Instruction Fuzzy Hash: 14E0ED391037266AEB332665CE32B6B7A4C8B827E0F460221FD049A4D8CB20C920C1E5

Function 04C20302 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C20340

Memory Dump Source

Source File: 00000006.00000002.3793812197.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c20000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 7aa545020ee77fb32b7d12aa3dc4850178cb80b80fe04438f304e5deb3f10658
Instruction ID: 4aca6195f43739c51c41ad824f6d94c6d2d60e2a49c8e813b4c75bffc63f7c9c
Opcode Fuzzy Hash: 7aa545020ee77fb32b7d12aa3dc4850178cb80b80fe04438f304e5deb3f10658
Instruction Fuzzy Hash: 73E017F660C274BEB200A5533F21EFF679EE8C4270B39C82BF902C0009F698190D2132

Function 04C2032B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C20340

Memory Dump Source

Source File: 00000006.00000002.3793812197.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c20000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: ed409583115b201822206b584cace71eb6a96564238bb9dd550b1cd725c730ae
Instruction ID: 0d032c9103b5c742bae7fe94a3b728ae63e2ad5ca29cf78f340fbb292b5b332f
Opcode Fuzzy Hash: ed409583115b201822206b584cace71eb6a96564238bb9dd550b1cd725c730ae
Instruction Fuzzy Hash: E3B09295B2C271AFB30136670B122BB29876C29290F6E58279A4B81108F5E8A4002022

Function 04C2033F Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C20340

Memory Dump Source

Source File: 00000006.00000002.3793812197.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c20000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 1b3875494bdc62041688b41bf8cc53c74c1e613d05a26e593c81b702a5d82ac6
Instruction ID: 9e9e400a154726584f310d64ff0aab478d227110d21205f6b893efb0da7cce6e
Opcode Fuzzy Hash: 1b3875494bdc62041688b41bf8cc53c74c1e613d05a26e593c81b702a5d82ac6
Instruction Fuzzy Hash: 95B024445143700F330131370F113FF34433C1015037C50135D074000DF4CC74001011

Non-executed Functions

Function 002F84A0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction ID: 83abcd7b636bf3b21254bdbcf1981523a114d196973ea6ca797c36fdcfedefd5
Opcode Fuzzy Hash: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction Fuzzy Hash: 78025B71E1121E9BDF14CFA9C9806AEFBF5FF48354F248269D615E7380DB31A9118B90

Function 0027F810 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0027F833
std::_Lockit::_Lockit.LIBCPMT ref: 0027F855
std::_Lockit::~_Lockit.LIBCPMT ref: 0027F875
std::_Lockit::~_Lockit.LIBCPMT ref: 0027F89F
std::_Lockit::_Lockit.LIBCPMT ref: 0027F90D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0027F959
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0027F973
std::_Lockit::~_Lockit.LIBCPMT ref: 0027FA08
std::_Facet_Register.LIBCPMT ref: 0027FA15

Strings

"3, xrefs: 0027F96B, 0027F972
bad locale name, xrefs: 0027FA2F

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$"3
API String ID: 3375549084-1389453244
Opcode ID: cdba6cf1ea1697433d7b3eddab051c5d8ff21cb65df40ed62f48b581e9543429
Instruction ID: cef10b3714573bc59108436e8523610d60d4eb83f1ab6cdf9119d2c3bd9aaa4b
Opcode Fuzzy Hash: cdba6cf1ea1697433d7b3eddab051c5d8ff21cb65df40ed62f48b581e9543429
Instruction Fuzzy Hash: 7B61C0B5D24249DBDF51DFA4C945B9EBBF4AF15310F188068E809AB381EB70E914CF92

Function 00213D10 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00213E7F

Strings

ios_base::eofbit set, xrefs: 00213E41, 00213E63
ios_base::badbit set, xrefs: 00213E17
@3!, xrefs: 00213E84
ios_base::failbit set, xrefs: 00213D32
G>!, xrefs: 00213D2B, 00213D67, 00213D6A
@3!, xrefs: 00213DBE, 00213E9B
G>!, xrefs: 00213DB8
`!!, xrefs: 00213E70

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: @3!$@3!$G>!$G>!$`!!$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-720226797
Opcode ID: 6f19d3dc6d7efca15155186f71feb773e3a936cabd06d1d72de0ba5616a7670f
Instruction ID: f49b27608e178109a802485c39666955834b77e349be59f1d36219cc59aa74bf
Opcode Fuzzy Hash: 6f19d3dc6d7efca15155186f71feb773e3a936cabd06d1d72de0ba5616a7670f
Instruction Fuzzy Hash: 9541C6B6910208AFCB08DF58D845BEEF7F9EF49310F14852AF919D7741E770AA508BA0

Function 002F2E10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 002F2E47
___except_validate_context_record.LIBVCRUNTIME ref: 002F2E4F
_ValidateLocalCookies.LIBCMT ref: 002F2ED8
__IsNonwritableInCurrentImage.LIBCMT ref: 002F2F03
_ValidateLocalCookies.LIBCMT ref: 002F2F58

Strings

csm, xrefs: 002F2EED
i4, xrefs: 002F2F78

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: i4$csm
API String ID: 1170836740-3943644863
Opcode ID: 6ae6c4a546261426fa0133802aa83351caa0c887065b02f9fbb3cb5719c51b1c
Instruction ID: 735b155ecf70a961db9d1f00c1592712b822c92ba1edca731be5c8a50cc0bd35
Opcode Fuzzy Hash: 6ae6c4a546261426fa0133802aa83351caa0c887065b02f9fbb3cb5719c51b1c
Instruction Fuzzy Hash: D941F730A2020DDBCF10DF68C840AAEFBB5AF46354F148165EA059B392C731EE69CB90

Function 00213DE0 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 79COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00213E7F

Strings

ios_base::eofbit set, xrefs: 00213E28, 00213E41, 00213E63
ios_base::badbit set, xrefs: 00213E17
@3!, xrefs: 00213E84
ios_base::failbit set, xrefs: 00213D32, 00213E1E
@3!, xrefs: 00213DBE, 00213E9B
`!!, xrefs: 00213E70

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: @3!$@3!$`!!$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-996552614
Opcode ID: b8decce4d501a5cab286eaad5dafaaba56eba68085f2c22853401b36395cf1ec
Instruction ID: 471198f9ff8072cf2b13f891cf688cd196ef2a7842b675b4408ac3e3b3ef4eb0
Opcode Fuzzy Hash: b8decce4d501a5cab286eaad5dafaaba56eba68085f2c22853401b36395cf1ec
Instruction Fuzzy Hash: 372127B69103056FC714DF58D841BD6B7DDAF18320F08883AFA68CB642E770EA64CB90

Function 00214C50 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 442COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00214F72
___std_exception_destroy.LIBVCRUNTIME ref: 00214FFF
___std_exception_copy.LIBVCRUNTIME ref: 002150C8

Strings

@3!, xrefs: 002150CD
recursive_directory_iterator::operator++, xrefs: 0021504C
`!!, xrefs: 00214F6B, 00214FF8, 002150B9

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$___std_exception_copy
String ID: @3!$`!!$recursive_directory_iterator::operator++
API String ID: 1206660477-2720571213
Opcode ID: 8e5ac4dfbbf2a931ce9dbddd976250b0ab4a81c920c1908ac50e0d61d38f88f1
Instruction ID: 5aa0f32262be9ad25205bc67a60e94e4b8698033834c44acacca94e62274ad1a
Opcode Fuzzy Hash: 8e5ac4dfbbf2a931ce9dbddd976250b0ab4a81c920c1908ac50e0d61d38f88f1
Instruction Fuzzy Hash: C5E103719102049FCB18EF68D845BAEF7F9FF58300F148A2DE45A93B81D774A964CBA1

Function 00217820 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0021799A
___std_exception_copy.LIBVCRUNTIME ref: 00217B75

Strings

`!!, xrefs: 002179A5, 00217B80
out_of_range, xrefs: 00217A27
type_error, xrefs: 0021784A
`!!, xrefs: 00217985, 00217B60

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!!$`!!$out_of_range$type_error
API String ID: 2659868963-1666391579
Opcode ID: 292d02c5f627d3da7a3b3346b080c4c70e6c4b51fe5901976b2d89c7fdace369
Instruction ID: 4d5a7ffcd50fdb7e3feccb2f5f4a5423edc9219a7bae2d2e06b5bbc388c75c97
Opcode Fuzzy Hash: 292d02c5f627d3da7a3b3346b080c4c70e6c4b51fe5901976b2d89c7fdace369
Instruction Fuzzy Hash: BEC169B19102088FDB18CFA8D98479EFBF5FF49310F14866AE419EB741E774A990CB90

Function 00213190 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 170COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 002132C6
___std_exception_destroy.LIBVCRUNTIME ref: 00213350

Strings

`!!, xrefs: 002132D1
@3!, xrefs: 00213316
+4!, xrefs: 00213190
`!!, xrefs: 002132AD, 00213349

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: +4!$@3!$`!!$`!!
API String ID: 2970364248-3890975345
Opcode ID: 03390aee0d23d1c9a4c680c38599c687bd6acce4cbd3363f1923985921673a68
Instruction ID: afeca24145922b3632000cb0720f2de8ac719443e6eadf27461abc6269802549
Opcode Fuzzy Hash: 03390aee0d23d1c9a4c680c38599c687bd6acce4cbd3363f1923985921673a68
Instruction Fuzzy Hash: FB51AF719102089FDB09DF98D885BEEFBFAFF59310F148129E815A7381D774AA91CB90

Function 002139F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00213A58
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00213AA4
__Getctype.LIBCPMT ref: 00213ABA
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00213AE6
std::_Lockit::~_Lockit.LIBCPMT ref: 00213B7B

Strings

bad locale name, xrefs: 00213B96

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: 89549f8df474daad7019168316612d7e579303f3960b5fb227f0de43508b6eb5
Instruction ID: 71d03d78808552b2f4fc8d9c45055f74f1d1536628851dcf6df7e1bdb50a0a8c
Opcode Fuzzy Hash: 89549f8df474daad7019168316612d7e579303f3960b5fb227f0de43508b6eb5
Instruction Fuzzy Hash: E1518FB1D102489BEF10DFA5D885BDEFBF9AF14314F184069E809AB381E774DA54CBA1

Function 0027DE70 Relevance: 9.1, APIs: 6, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0027DE93
std::_Lockit::_Lockit.LIBCPMT ref: 0027DEB6
std::_Lockit::~_Lockit.LIBCPMT ref: 0027DED6
std::_Facet_Register.LIBCPMT ref: 0027DF4B
std::_Lockit::~_Lockit.LIBCPMT ref: 0027DF63
Concurrency::cancel_current_task.LIBCPMT ref: 0027DF7B

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: bf9807801212bc3eb9776367e3e997446f2c54024d01eb24ae84d95516d8cf53
Instruction ID: beb31827efb3eece6397fec8d79a0db4051a0a75452a9d2b6242bf17259f9ca1
Opcode Fuzzy Hash: bf9807801212bc3eb9776367e3e997446f2c54024d01eb24ae84d95516d8cf53
Instruction Fuzzy Hash: EA4101759202569FCB15DF54D841AAEBBB8FF12720F148268E8096B352DB30BD20CBD2

Function 00216F40 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 349COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00217340

Strings

`!!, xrefs: 0021734B
parse error, xrefs: 00216FFF, 00217018
parse_error, xrefs: 00216F8B
`!!, xrefs: 00217328

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!!$`!!$parse error$parse_error
API String ID: 2659868963-3548305109
Opcode ID: 4adffc123308ac10be3ce681c0f6a3f0af3723f5d484d2da3113792af916975b
Instruction ID: 95c3ba380481226956e3b31517d18b998b28076aab7a885352c55c10a2563918
Opcode Fuzzy Hash: 4adffc123308ac10be3ce681c0f6a3f0af3723f5d484d2da3113792af916975b
Instruction Fuzzy Hash: 0CE17F709142488FDB18CF68C88479DBBF5FF59300F2482A9E418EB792D774AA91CF91

Function 002173B0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 002175BE
___std_exception_destroy.LIBVCRUNTIME ref: 002175CD

Strings

, column , xrefs: 00217434, 0021744A
at line , xrefs: 002173F7
`!!, xrefs: 002175B6, 002175C6

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column $`!!
API String ID: 4194217158-2227850838
Opcode ID: 83cdd58159f537b7dfc98dfbf021a250ce34fc812b745f0ac44cf2638ea91898
Instruction ID: c1659944ed7395cebbf5c3eb9316e947ee78f2dfde6b2caf844a6239a1021959
Opcode Fuzzy Hash: 83cdd58159f537b7dfc98dfbf021a250ce34fc812b745f0ac44cf2638ea91898
Instruction Fuzzy Hash: 2261F671A14205AFDB08DF68DC84BADBBF6FF98300F64462CE415A7781D774AA94CB90

Function 00213370 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

APIs

Part of subcall function 00213190: ___std_exception_copy.LIBVCRUNTIME ref: 002132C6

___std_exception_copy.LIBVCRUNTIME ref: 0021345F

Strings

@3!, xrefs: 00213464
+4!, xrefs: 002133B3, 00213410
`!!, xrefs: 00213450
@3!, xrefs: 002133F3, 0021347B

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: +4!$@3!$@3!$`!!
API String ID: 2659868963-1715996797
Opcode ID: 14a91be47303de11b3d69a323f3bc15725ccbf372871a3cd0c28853efb2e5d6d
Instruction ID: f08e496ae6f04b03aaed15d1966e1f85a629c23825ea47a4ac32daa0f7d66a78
Opcode Fuzzy Hash: 14a91be47303de11b3d69a323f3bc15725ccbf372871a3cd0c28853efb2e5d6d
Instruction Fuzzy Hash: CE318575910209AFCB19DFA8D841AEDFBF9FB08310F10452AE518D7741D770A690CF94

Function 00213410 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 47COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0021345F

Strings

@3!, xrefs: 00213464
+4!, xrefs: 002133B3, 00213410
`!!, xrefs: 00213450
@3!, xrefs: 002133F3, 0021347B

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: +4!$@3!$@3!$`!!
API String ID: 2659868963-1715996797
Opcode ID: fc05254cf328883ededbe6766cdf0590881c12736514de55e00c3d3d08a8ff5c
Instruction ID: ec39ae47b172fb14a1e77cbc7cc0a82fbee4abf440082dd33fdaf182588034b7
Opcode Fuzzy Hash: fc05254cf328883ededbe6766cdf0590881c12736514de55e00c3d3d08a8ff5c
Instruction Fuzzy Hash: 25014FBA510609AF8709DFA9D44189AFBFDBF18310700843AE62987611E7B0E564CF90

Function 00216C60 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 247COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00216F11
___std_exception_destroy.LIBVCRUNTIME ref: 00216F20

Strings

[json.exception., xrefs: 00216CB8
`!!, xrefs: 00216F09, 00216F19

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.$`!!
API String ID: 4194217158-2149100017
Opcode ID: c3381df7e79775179dbf97fff69b68cd2088eab9f4a2a54413af15b949812c1b
Instruction ID: 63caa4fea697adad10e6034e0d3049fd13fa4e59ed3f2cd2407e5cf6bb34abb0
Opcode Fuzzy Hash: c3381df7e79775179dbf97fff69b68cd2088eab9f4a2a54413af15b949812c1b
Instruction Fuzzy Hash: 8291D470A102049FDB18CF68D988BDEFBF6EF55300F20866DE415AB792D771A991CB90

Function 00212270 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 218COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00212275

Part of subcall function 002ED6E9: std::invalid_argument::invalid_argument.LIBCONCRT ref: 002ED6F5

Strings

string too long, xrefs: 00212270
L4, xrefs: 00212427
L4, xrefs: 00212347

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: string too long$L4$L4
API String ID: 1997705970-2458504751
Opcode ID: 296037d0a52e692f84c98c5ab7b65a1af5250fb8032dfdc0d2aa0bcdb93a389f
Instruction ID: 5f372d11cff458509627a350c105f2e0a0b1eea665717a9f128b801ece91ee80
Opcode Fuzzy Hash: 296037d0a52e692f84c98c5ab7b65a1af5250fb8032dfdc0d2aa0bcdb93a389f
Instruction Fuzzy Hash: 20814775A14285DFDB02CF68C4507EDBFF5EF6A300F1841AAE894A7742C37585A9CBA0

Function 00217620 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 167COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 002177B4

Strings

invalid_iterator, xrefs: 00217656
`!!, xrefs: 002177BF
`!!, xrefs: 0021779F

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!!$`!!$invalid_iterator
API String ID: 2659868963-2956669300
Opcode ID: 56f691642fa30cd4bd6a8f5f879afbd6126eeb4ee37d8ee61cef13095301a407
Instruction ID: 80807dbcb7eb4ac46c057e6e1606d892bfb1699b297e07e50174c8490f9d3836
Opcode Fuzzy Hash: 56f691642fa30cd4bd6a8f5f879afbd6126eeb4ee37d8ee61cef13095301a407
Instruction Fuzzy Hash: 6F515AB49102088FDB08CFA8D98479DFBF5FB89310F148669E419EB791E774A990CF90

Function 00217BE0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 156COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00217D67

Strings

other_error, xrefs: 00217C0A
`!!, xrefs: 00217D72
`!!, xrefs: 00217D52

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!!$`!!$other_error
API String ID: 2659868963-1358939976
Opcode ID: ebbe80e0a319e6f310339154c14b398ff60afc83df3d53ffde16fdfad303368e
Instruction ID: 4eb6d5af361b7fa197aa783f44b61775f1f0b9ceb0c20f125b7fb74729ccef09
Opcode Fuzzy Hash: ebbe80e0a319e6f310339154c14b398ff60afc83df3d53ffde16fdfad303368e
Instruction Fuzzy Hash: FA515AB09102488FDB18CFA8E8847EDFBF5BF49300F148669E459EB741E774A990CB51

Function 0027D050 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0027D06F
___std_exception_copy.LIBVCRUNTIME ref: 0027D096

Strings

`!!, xrefs: 0027D09B
`!!, xrefs: 0027D060, 0027D085

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!!$`!!
API String ID: 2659868963-2180691272
Opcode ID: 770dd1bd0c26611c31851f69b79bd0d6ab7377aead4bfbfbbd1c0d013100dd9b
Instruction ID: ea97fb3ebcd2abc18d4ea8ca88597ff2ed48c170b3bfe86f5acc8e13d7d3cc24
Opcode Fuzzy Hash: 770dd1bd0c26611c31851f69b79bd0d6ab7377aead4bfbfbbd1c0d013100dd9b
Instruction Fuzzy Hash: 6F01A4BA50060AAF8709DF59D445896FBF9FB49710700853BA629CBB11E7B0F568CFA0

Function 0028B3C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0028B3DF
___std_exception_copy.LIBVCRUNTIME ref: 0028B406

Strings

`!!, xrefs: 0028B40E
`!!, xrefs: 0028B3D0, 0028B3F5

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!!$`!!
API String ID: 2659868963-2180691272
Opcode ID: 7a514dc8ad901c64981dc73cc816b082501888a0704fe8554fec48844ea073c5
Instruction ID: 9d7df70f6e7d34e04a321e0e27ff8ab808da5f7b370c162b2825dcbc3a06c15e
Opcode Fuzzy Hash: 7a514dc8ad901c64981dc73cc816b082501888a0704fe8554fec48844ea073c5
Instruction Fuzzy Hash: 06F0C9BA500605AF8709DF54D445896FBEDFA49710301853BE62ACB701E7B0E564CFA0

Function 0028B450 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 190COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0028B612

Strings

Px(, xrefs: 0028B456, 0028B5BA, 0028B5F3, 0028B54A, 0028B4F1
invalid hash bucket count, xrefs: 0028B60D

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_
String ID: Px($invalid hash bucket count
API String ID: 909987262-3311336540
Opcode ID: 16d5219eed1dd4386e140163b41af27109c1de16839d133d0a5f287038371092
Instruction ID: 4d922427420b3b3b5f9a9d8d997b18c8e64b0c38ce1df7cf0378fe456f114c3b
Opcode Fuzzy Hash: 16d5219eed1dd4386e140163b41af27109c1de16839d133d0a5f287038371092
Instruction Fuzzy Hash: D37110B8A11605DFCB15DF48C18086AFBB9FF88300764C5AED8199B396D731EA52CF90

Function 0028E440 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0028E491

Strings

type must be string, but is , xrefs: 0028E4F8
type must be boolean, but is , xrefs: 0028E582

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: type must be boolean, but is $type must be string, but is
API String ID: 118556049-436076039
Opcode ID: 7a9c7305f4d1bb16931084e2c2323a77d5be0f10e141f37551cb94381bc1e6c5
Instruction ID: a635489aa732adc2b4759992f303e85a469d67d3104ea5e39027a11dce199853
Opcode Fuzzy Hash: 7a9c7305f4d1bb16931084e2c2323a77d5be0f10e141f37551cb94381bc1e6c5
Instruction Fuzzy Hash: C0416DB5910248AFDB14FBA4D802BDEB7A8DB14310F148578F419D77C2EB35E964CB91

Function 00213050 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00213078

Strings

`!!, xrefs: 00213080
`!!, xrefs: 00213063

Memory Dump Source

Source File: 00000006.00000002.3788234643.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000006.00000002.3788180460.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788234643.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788574573.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3788634361.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789194073.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3789388136.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!!$`!!
API String ID: 2659868963-2180691272
Opcode ID: d7d7c47e46c7553b45d16e06dfe283e4ae8ce367466ff934851d90e230749fa9
Instruction ID: 212a53dcb06685420b27ffa7a84bd05fec3cd058acbdbd15169ad05476d6f597
Opcode Fuzzy Hash: d7d7c47e46c7553b45d16e06dfe283e4ae8ce367466ff934851d90e230749fa9
Instruction Fuzzy Hash: C3E0EDB69112089FC711DFA898459CAFFE8AB19711F0086BAE948D7301F6B095948BD1

Analysis Process: MPGPH131.exePID: 7584, Parent PID: 1124COMMON

Execution Graph

Execution Coverage:	3%
Dynamic/Decrypted Code Coverage:	3.4%
Signature Coverage:	0%
Total number of Nodes:	683
Total number of Limit Nodes:	72

Executed Functions

Function 00273A40 Relevance: 2.7, APIs: 2, Instructions: 157
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E9,?,00000001,00000000,?,?,?,?,?,?,?,?,00273DB6), ref: 00273B08
Sleep.KERNELBASE(00000001,?,00000001,00000000,?,?,?,?,?,?,?,?,00273DB6), ref: 00273BBA

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: e3337f7648320ac2a93052af3cbb68c77d46aaf1fb5ba97cc1b7ba057e92a005
Instruction ID: 7ac9576f318c24027f780780ebc96e82fd24f37496f729342479b8f25faf2df0
Opcode Fuzzy Hash: e3337f7648320ac2a93052af3cbb68c77d46aaf1fb5ba97cc1b7ba057e92a005
Instruction Fuzzy Hash: 3C51B835A1421ACFCB24CF58C8D1EAAB3B5FF48708F29859AD449AB351D731EE15DB80

Function 04D509DC Relevance: 1.7, APIs: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D509D2

Memory Dump Source

Source File: 00000007.00000002.3793381793.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d50000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: c60aa35481d2fd3cdf828d18a37eb245dc152a608cf284624f444ccf30f18fdf
Instruction ID: 2eb652aef1a30e2857b28904fb0d0a538d19d0829119fae70fa1e9c83971c6e2
Opcode Fuzzy Hash: c60aa35481d2fd3cdf828d18a37eb245dc152a608cf284624f444ccf30f18fdf
Instruction Fuzzy Hash: 764178EB70C121FC7A0385855B90AF667AEEAD77303318426FC87D6220FE90EE456171

Function 0022E0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 0022E0CB
socket.WS2_32(?,?,?), ref: 0022E17E
connect.WS2_32(00000000,?,?), ref: 0022E193
closesocket.WS2_32(00000000), ref: 0022E19E

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: fe705004556cdb403c2ff58ac560e49f13c8c8d7678d9b963d072ed62886ed55
Instruction ID: 2265b0cc8b4a3a735b5909ed6b2b401371b877319eec00aebbea77e08bf7611e
Opcode Fuzzy Hash: fe705004556cdb403c2ff58ac560e49f13c8c8d7678d9b963d072ed62886ed55
Instruction Fuzzy Hash: 3331D0712043116BDB209F68DC49B6BB7E4EF85328F015F2DF9A8A22D0D3319C249B92

Function 002EF290 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0021220E

Strings

`!!, xrefs: 002121FC
`!!, xrefs: 00212216

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!!$`!!
API String ID: 2659868963-2180691272
Opcode ID: 4c3baa47f2fc7ac8229b19121d48aeb457c3582fa999572f82e77655b378a937
Instruction ID: 5797e7a1145d7205acbe704b388a24ee9ef47f069e0dd1505d19624fb95200fa
Opcode Fuzzy Hash: 4c3baa47f2fc7ac8229b19121d48aeb457c3582fa999572f82e77655b378a937
Instruction Fuzzy Hash: DF012B3941030DABCB18EFA9E8019A9B7ECDA00360B404439FF1CDB691E770E9B48BD1

Function 002F4942 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

O/, xrefs: 002F4A93, 002F4A61, 002F4AAB, 002F4AC7

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID: O/
API String ID: 0-786838103
Opcode ID: 0f2ed4acd35e06abfeb8ab5359506890258ebe257ad8b887becf5c10587ee188
Instruction ID: 6461959355aaffaa787067a780a662ae6531c6f4a13dcbb5b9a6d6c4636a9cac
Opcode Fuzzy Hash: 0f2ed4acd35e06abfeb8ab5359506890258ebe257ad8b887becf5c10587ee188
Instruction Fuzzy Hash: E951E770A1010CAFDB14EF58C891ABBFBB5EF45394F248168F9499B252D3B19E61CB90

Function 00304623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8d4781309cd3b97b1a598e90b89b7493b5e495228b5a143b8340819ba0c41de
Instruction ID: cb597c0d69f13dd26200cd0cdb423d635fdbd7e66b15b92ec4ece2165937718d
Opcode Fuzzy Hash: e8d4781309cd3b97b1a598e90b89b7493b5e495228b5a143b8340819ba0c41de
Instruction Fuzzy Hash: 8EB13BB0A05249AFDB13DF98D8A1BBEBBB5AF46300F154168E6409B3C2C771AE51CF51

Function 04D5088C Relevance: 1.8, APIs: 1, Instructions: 269
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.3793381793.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d50000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e98924b609a243a2779941eb99731cd29da24fd7cb9225091b2ec368c4354267
Instruction ID: dac1c863f09c1fc18f2510f297a3b4dc40cd9c7c96ac42bc8f59b1774695b86b
Opcode Fuzzy Hash: e98924b609a243a2779941eb99731cd29da24fd7cb9225091b2ec368c4354267
Instruction Fuzzy Hash: C55168E770C211EDAA0395815B50AF66A6DEB97730B308426FCC7D6121FE90EA4971B1

Function 04D507E4 Relevance: 1.8, APIs: 1, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.3793381793.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d50000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 9c2f4becd37bc2dc26a8f00e54d1f9ea87e7e3fda09706d4d1cdcae886393713
Instruction ID: d15dbefb97c3b2a57ec6b65e905ee9cbbef9a72aee5a968f0c3027752eae5628
Opcode Fuzzy Hash: 9c2f4becd37bc2dc26a8f00e54d1f9ea87e7e3fda09706d4d1cdcae886393713
Instruction Fuzzy Hash: 625189E770C211FCBA0395814B51AF66A6EEA97730B308426FCC7D6221FE90EA457171

Function 04D50810 Relevance: 1.8, APIs: 1, Instructions: 259
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.3793381793.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d50000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 774aa474b5780c0f79fdd863c84b31d2f9d86b7d865311117dabaa55a56b7353
Instruction ID: a9dae2386bda6e50d1ff540cdd3b3be4914db6736a6140ced3a56f7ad963effa
Opcode Fuzzy Hash: 774aa474b5780c0f79fdd863c84b31d2f9d86b7d865311117dabaa55a56b7353
Instruction Fuzzy Hash: 9C5198E770C211FDAA0391854B50AF66A6EEB97730B308426FCC7D6221FE90EA447171

Function 04D5082C Relevance: 1.8, APIs: 1, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.3793381793.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d50000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 4f6ca086ec76e7a81862359c8b297c335ddddf1c9d66e70bc06baa1b2c7948d3
Instruction ID: 298b17ab12f590fe6d6adef6530655fe1f70316d1ecf32d1ec02a10a944c217f
Opcode Fuzzy Hash: 4f6ca086ec76e7a81862359c8b297c335ddddf1c9d66e70bc06baa1b2c7948d3
Instruction Fuzzy Hash: D65177E770C211FDBA0391855B90AF66A6EEB97730B308426FCC7D6221FE90EA457171

Function 04D508B0 Relevance: 1.8, APIs: 1, Instructions: 254
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D509D2

Memory Dump Source

Source File: 00000007.00000002.3793381793.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d50000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: d78d88a7c18d00d586faae6666ce2a6e3e54f4e0535b600938862018053689ea
Instruction ID: 89ebe3a52ee1eb0fed4895f5070147612a722467f8c10623c222b128d3bbdc5a
Opcode Fuzzy Hash: d78d88a7c18d00d586faae6666ce2a6e3e54f4e0535b600938862018053689ea
Instruction Fuzzy Hash: 805147E770C111FCBA0395855B50AF76A6EEAD77307308426FC87D6221FE90EA4971B1

Function 04D50848 Relevance: 1.8, APIs: 1, Instructions: 253
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D509D2

Memory Dump Source

Source File: 00000007.00000002.3793381793.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d50000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 961f2eed985779251c521eb91041bee8a1f86c93b084b78f22a939b08239ec11
Instruction ID: c882c97e0a82984f980ebc8173c218ae8870a437b36d174c4f42acef57e35c0b
Opcode Fuzzy Hash: 961f2eed985779251c521eb91041bee8a1f86c93b084b78f22a939b08239ec11
Instruction Fuzzy Hash: 4B5149E770C211FDBA0391855B90AF66A6EEA97730B308426FCC7D6221FED0EA457171

Function 04D50871 Relevance: 1.7, APIs: 1, Instructions: 249
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.3793381793.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d50000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: df630fead4e3a66e8712250d95f1faef93a22b256dbb536efab148b20e13f6f9
Instruction ID: 89ae1b71db81dd80e5d91b93afd3565430a95b2abcf542fc0ff31e21b5863cc3
Opcode Fuzzy Hash: df630fead4e3a66e8712250d95f1faef93a22b256dbb536efab148b20e13f6f9
Instruction Fuzzy Hash: 665158EB70C111FDBA0391855B90AF76A6EEAD7730B308426FC87D6221FE90EA457171

Function 0021A210 Relevance: 1.7, APIs: 1, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 0021A343

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 3d49ba3357fbb25febc257fcc00c39cabffe566aac7b3ac9322940b8c5b26bfe
Instruction ID: 8fdf9b2ee82cc4c4eda03fdf9c7a8b345385f716247a54126c704f4e3a6909f5
Opcode Fuzzy Hash: 3d49ba3357fbb25febc257fcc00c39cabffe566aac7b3ac9322940b8c5b26bfe
Instruction Fuzzy Hash: EE714770911208AFDB14DF68CC49BEFF7E8EF41740F10856DF9189B282D7B59A918B92

Function 04D508D4 Relevance: 1.7, APIs: 1, Instructions: 222
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.3793381793.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d50000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: fa9d41518c4912bf33ac683d909ad6a4f4e2e12baf0afa766e1f494e7950baa3
Instruction ID: b5585fcf668e35d2f8e5489554ccc59ebea2cf59eb9dddcb063871ac5435750b
Opcode Fuzzy Hash: fa9d41518c4912bf33ac683d909ad6a4f4e2e12baf0afa766e1f494e7950baa3
Instruction Fuzzy Hash: CD4154E770C111FCBA0381855BA0AF7666EEAD7730B308026FC87D6221FE90EA497171

Function 04D5091F Relevance: 1.7, APIs: 1, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.3793381793.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d50000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 68f57a0e90d981ebd6bc940f4422ae4b4b42f8f5186b8694ebe40ad4f2db7526
Instruction ID: 8376829d0477dd032e44f0a3e5aa489ad0d4915e7045654276f639bb67b30d59
Opcode Fuzzy Hash: 68f57a0e90d981ebd6bc940f4422ae4b4b42f8f5186b8694ebe40ad4f2db7526
Instruction Fuzzy Hash: 404178EB70C111FCBA0381451BA0AF767AEEAD77307308026FC87D6221FE94EA492170

Function 04D50915 Relevance: 1.7, APIs: 1, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3793381793.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d50000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 5eff124177ca0eb65a6591a17b629990b1108a8ec076f02c2438f78ba616e24e
Instruction ID: 4ed1d903c3bc308fa25bce681dbe0500df70b2bf992f7b210d338d2df97f2c30
Opcode Fuzzy Hash: 5eff124177ca0eb65a6591a17b629990b1108a8ec076f02c2438f78ba616e24e
Instruction Fuzzy Hash: 9C4127EB70C111FCBA0385455BA0AF7666EEAD77307318522FC87D6221FE90EA497171

Function 0030549C Relevance: 1.7, APIs: 1, Instructions: 198fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000000,002F9087,?,00000000,00000000,00000000,?,00000000,?,0021A3EB,002F9087,00000000,0021A3EB,?,?), ref: 00305621

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 901233c6981599de9fce3c49c1cd1da364f16883f59eeb19869e9e7d8e74b35a
Instruction ID: bb4dbad72d7dd83ccd4e8c96b858e5c12a7b2cd1fcae8314aed50bcf508621dc
Opcode Fuzzy Hash: 901233c6981599de9fce3c49c1cd1da364f16883f59eeb19869e9e7d8e74b35a
Instruction Fuzzy Hash: AF61A27190150DAFDF12DFA8CC94AEFBBBAAF0A304F150145E900AB295D772D951CFA0

Function 04D5094C Relevance: 1.7, APIs: 1, Instructions: 196COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D509D2

Memory Dump Source

Source File: 00000007.00000002.3793381793.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d50000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 3d7278169df4e0a8050504f0a712c66b8bac06b154185c2a52f6a977b34de384
Instruction ID: 4387d50a6204536e0e1a47d91ebe38a5ba0317ec539f53eb7c080e6bec02e449
Opcode Fuzzy Hash: 3d7278169df4e0a8050504f0a712c66b8bac06b154185c2a52f6a977b34de384
Instruction Fuzzy Hash: F74125EB70C125BCBA0381851B90AF6666EEAD77307318026FC87D6221FE90EA493171

Function 04D50945 Relevance: 1.7, APIs: 1, Instructions: 193COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D509D2

Memory Dump Source

Source File: 00000007.00000002.3793381793.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d50000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 04dd225201e023b0a343d10a27b6f74da36e5a1feccf9fb768f61cbd600b9cb8
Instruction ID: b83e648701263500eec4f2e7a3c480ab4d67bc7d1b892beb410e0c055ab518db
Opcode Fuzzy Hash: 04dd225201e023b0a343d10a27b6f74da36e5a1feccf9fb768f61cbd600b9cb8
Instruction Fuzzy Hash: FF4114EB70C121FCBA0381851B90AF7666EEAD77307318026FC87D6621FE94EA497171

Function 04D5097C Relevance: 1.7, APIs: 1, Instructions: 191COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D509D2

Memory Dump Source

Source File: 00000007.00000002.3793381793.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d50000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 360566959972feac219e3c45bd08ec75b72ac9fbde692831f9acac465c3c9340
Instruction ID: 2dd25d3072fb62cf4a8b5e59a0c2b7ef843d99faebfa054d80a9fc0bf6ff6dc1
Opcode Fuzzy Hash: 360566959972feac219e3c45bd08ec75b72ac9fbde692831f9acac465c3c9340
Instruction Fuzzy Hash: F84167E770C111BDBA0385451BA0AF6676EEA977307318026FC87D6221FF90EA456171

Function 04D50961 Relevance: 1.7, APIs: 1, Instructions: 188COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D509D2

Memory Dump Source

Source File: 00000007.00000002.3793381793.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d50000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: a9a2e6e5e73b6e96201bc23f3a0b561c31e543845c07dfece419c5832f6decc7
Instruction ID: 0353389e71134c007954aa5c1075ddba32508e52bea64a076b28b2903d83edd7
Opcode Fuzzy Hash: a9a2e6e5e73b6e96201bc23f3a0b561c31e543845c07dfece419c5832f6decc7
Instruction Fuzzy Hash: C04127E770C125FCBA0385851B909F6666EEAD77307318426FC87D6221FF90EA497171

Function 04D509A2 Relevance: 1.7, APIs: 1, Instructions: 175COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D509D2

Memory Dump Source

Source File: 00000007.00000002.3793381793.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d50000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: b700135090db1ab356b2fb438d66e152afb5e6dfb45606f6516795666bb0ebc4
Instruction ID: 855969ac6aca8c0ff91431bb4fbb10c5232778e6a6ced0e18759213375d76548
Opcode Fuzzy Hash: b700135090db1ab356b2fb438d66e152afb5e6dfb45606f6516795666bb0ebc4
Instruction Fuzzy Hash: BB3128EB70C121BC7A0385851B90AF6666EE9D77307318422FC87D6621FE94EE457171

Function 04D509C7 Relevance: 1.7, APIs: 1, Instructions: 160COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D509D2

Memory Dump Source

Source File: 00000007.00000002.3793381793.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d50000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 9e6059c7428f19d768c4adfeffeb3f8201eaa12ba523a479eb1f58f6bae90fb1
Instruction ID: 382a9e48df26912deb66f9eaef089921c3fd3dc7df4c3bd9a35254c4ba26855d
Opcode Fuzzy Hash: 9e6059c7428f19d768c4adfeffeb3f8201eaa12ba523a479eb1f58f6bae90fb1
Instruction Fuzzy Hash: E03158DB70C124FCAA1391851B90AF6266EEA977307308122BC87D6620FFD0EE457170

Function 00280560 Relevance: 1.6, APIs: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 002806AE

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction ID: 6c831b25343691ddd4c931ca0a7a5cfd9605b226671e1d465d993c1cbb3fed7f
Opcode Fuzzy Hash: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction Fuzzy Hash: 46410676A111299BCB05EF68DD806AEB7A9AF84340F540179FC05EB342E770ED748BE1

Function 00304B12 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,003049F9,00000000,CF830579,00341140,0000000C,00304AB5,002F8BBD,?), ref: 00304B68

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 15af622eab69d7f7fa10dcf08add716fd4f6c56a3399d926bd43f344926fb408
Instruction ID: 0780870c1298cde7a3e1ce6f7933be9fefd100d74af6cab6303d0ba299a5de31
Opcode Fuzzy Hash: 15af622eab69d7f7fa10dcf08add716fd4f6c56a3399d926bd43f344926fb408
Instruction Fuzzy Hash: 9F114832A4321816D62736346962B7E7B5A8B82774F2A0209FA449F1C2EE62ED415195

Function 002FE05C Relevance: 1.6, APIs: 1, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00340DF8,0021A3EB,00000002,0021A3EB,00000000,?,?,?,002FE166,00000000,?,0021A3EB,00000002,00340DF8), ref: 002FE098

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 46bfb6ea90ac6f472a8fe4dd988068d3fb0c1faaeede62b6accb65cb5ea7a8b6
Instruction ID: 00df179cdfeed3924a2aaa2946dae74081280a204e2e09945fcdda0670408b0a
Opcode Fuzzy Hash: 46bfb6ea90ac6f472a8fe4dd988068d3fb0c1faaeede62b6accb65cb5ea7a8b6
Instruction Fuzzy Hash: 8F012B32620209AFCF169F15DC05CAE7B2ADB81364F25011CF950AB2E1EAB2ED518BD0

Function 003063F3 Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,002F91F7,00000000,?,00305D79,00000001,00000364,00000000,00000006,000000FF,?,00000000,002FD244,002F89C3,002F91F7,00000000), ref: 00306434

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e6205f3a1e3864faec79d51f882c7edf973c4dc2f220e7364a964efefd7719f8
Instruction ID: 02ae0dc287624728f3fa2f8ee7a3f9a3b2121f0f53c48796eb7d98cda7a079f9
Opcode Fuzzy Hash: e6205f3a1e3864faec79d51f882c7edf973c4dc2f220e7364a964efefd7719f8
Instruction Fuzzy Hash: E5F0E93150712567DB236F679C23B5B3B4D9F81B60F268122ED04AA4C8CA30EC3046E2

Function 00306E2D Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0030D635,4D88C033,?,0030D635,00000220,?,003057EF,4D88C033), ref: 00306E5F

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d4930b1748c1f8f4b88981fc094088e0541c9ab1429d058cd50f8ecde0132544
Instruction ID: 5c16d16f35b59be510f082ecdeea064d3782742dfb4dcf8400a5686bace949c2
Opcode Fuzzy Hash: d4930b1748c1f8f4b88981fc094088e0541c9ab1429d058cd50f8ecde0132544
Instruction Fuzzy Hash: 9DE0E53914371556DB332665CE3275B764C8B817E0F560121FC00964D4CB20CD20C1E5

Function 04D60365 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3793436180.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d60000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0810ab8dddeea3c3ce939c2c02119a2238135a66e373d4be95d9006c7d2baa2e
Instruction ID: 5e3572d011705b426eea943256cd19753f83784efee94752c9fddc1645c818b0
Opcode Fuzzy Hash: 0810ab8dddeea3c3ce939c2c02119a2238135a66e373d4be95d9006c7d2baa2e
Instruction Fuzzy Hash: 332160FB34C1107F7652D5966B14EF7676DD1D6631330C82BF887C6102F295AE4A2132

Function 04D602FE Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3793436180.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d60000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f562cc777e18a7c81faf730cefd7517ba3f1a407d26dabe5cde5608919ddf7c9
Instruction ID: 319b339eb977d78ae2d6670837eebb828c7d897283d6e595e4882599e1402994
Opcode Fuzzy Hash: f562cc777e18a7c81faf730cefd7517ba3f1a407d26dabe5cde5608919ddf7c9
Instruction Fuzzy Hash: D2112BFB34C110BF7542D1966B24AFB67ADD1D6B71330C826F847D2102F298AE4A2131

Function 04D602F4 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3793436180.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d60000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9547f5388ad53c59c1f15b432c7099034ca77289701b018d1ec5d0bd1abd525
Instruction ID: 097b08e442cf75c762d93e001e79833d86951f91abde1fa1beb1233ff7858c4c
Opcode Fuzzy Hash: e9547f5388ad53c59c1f15b432c7099034ca77289701b018d1ec5d0bd1abd525
Instruction Fuzzy Hash: F21128EB34C210BE7552C1867B14AFB676DE1D6731330C827F847D6602F298AE4A6232

Function 04D60330 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3793436180.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d60000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4d8e289cba85414bcee4f5467bae93e2af85eb37d29094ee2d367de92962ef1
Instruction ID: 5c8ded325ceb48cb71d1369e6489da9520dd0b4ff2936de0660333de5936f12d
Opcode Fuzzy Hash: e4d8e289cba85414bcee4f5467bae93e2af85eb37d29094ee2d367de92962ef1
Instruction Fuzzy Hash: D1113DBB34D2107F7652C5867B24AFB676DD5D6A31330C867F447C6502E298AE4E2231

Function 04D60310 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3793436180.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d60000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2af2b2c8e4400d164f61bd9a4a66132a5a9da25774c57153f75a6a82bc0895a1
Instruction ID: 5ae5d8a91fa72dd8693036eee0f187940575ba83d0b1b2fa2d2f46519d7b091e
Opcode Fuzzy Hash: 2af2b2c8e4400d164f61bd9a4a66132a5a9da25774c57153f75a6a82bc0895a1
Instruction Fuzzy Hash: FC11F8FB34C211BE7642C5866B14AFB676DE5C6730370C827F847C6506E298AE4A6231

Function 04D60345 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3793436180.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d60000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ed3863b8b5e0d8d127c88c369666d706ff8fc8ce569648f6f8677f15e3af7e4
Instruction ID: 4797b86b1e370394db9aaa1fac795bbf5bea6b15106e84d01ecf61435e03ae1a
Opcode Fuzzy Hash: 2ed3863b8b5e0d8d127c88c369666d706ff8fc8ce569648f6f8677f15e3af7e4
Instruction Fuzzy Hash: 53014CBB3481107F7642C5857B14AFB676DE1D6731331C867F447C2102F298AE496231

Function 04D603A3 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3793436180.0000000004D60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d60000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c958836e49012289e815dbcf87d738543c28253135ea0cabf08d4fc7e9347804
Instruction ID: 6479b4d1f2533645c040e789242fbff990232b7d78a0cb61572fb17f3a931a6d
Opcode Fuzzy Hash: c958836e49012289e815dbcf87d738543c28253135ea0cabf08d4fc7e9347804
Instruction Fuzzy Hash: DD01A2EB34C1117F7A02D4956B18AFB2B6DE2D6A31331D827F887C6102F295EE4A2131

Non-executed Functions

Function 002F84A0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction ID: 83abcd7b636bf3b21254bdbcf1981523a114d196973ea6ca797c36fdcfedefd5
Opcode Fuzzy Hash: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction Fuzzy Hash: 78025B71E1121E9BDF14CFA9C9806AEFBF5FF48354F248269D615E7380DB31A9118B90

Function 0027F810 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0027F833
std::_Lockit::_Lockit.LIBCPMT ref: 0027F855
std::_Lockit::~_Lockit.LIBCPMT ref: 0027F875
std::_Lockit::~_Lockit.LIBCPMT ref: 0027F89F
std::_Lockit::_Lockit.LIBCPMT ref: 0027F90D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0027F959
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0027F973
std::_Lockit::~_Lockit.LIBCPMT ref: 0027FA08
std::_Facet_Register.LIBCPMT ref: 0027FA15

Strings

"3, xrefs: 0027F96B, 0027F972
bad locale name, xrefs: 0027FA2F

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$"3
API String ID: 3375549084-1389453244
Opcode ID: cdba6cf1ea1697433d7b3eddab051c5d8ff21cb65df40ed62f48b581e9543429
Instruction ID: cef10b3714573bc59108436e8523610d60d4eb83f1ab6cdf9119d2c3bd9aaa4b
Opcode Fuzzy Hash: cdba6cf1ea1697433d7b3eddab051c5d8ff21cb65df40ed62f48b581e9543429
Instruction Fuzzy Hash: 7B61C0B5D24249DBDF51DFA4C945B9EBBF4AF15310F188068E809AB381EB70E914CF92

Function 00213D10 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00213E7F

Strings

ios_base::badbit set, xrefs: 00213E17
ios_base::eofbit set, xrefs: 00213E41, 00213E63
@3!, xrefs: 00213DBE, 00213E9B
@3!, xrefs: 00213E84
G>!, xrefs: 00213D2B, 00213D67, 00213D6A
`!!, xrefs: 00213E70
G>!, xrefs: 00213DB8
ios_base::failbit set, xrefs: 00213D32

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: @3!$@3!$G>!$G>!$`!!$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-720226797
Opcode ID: 6f19d3dc6d7efca15155186f71feb773e3a936cabd06d1d72de0ba5616a7670f
Instruction ID: f49b27608e178109a802485c39666955834b77e349be59f1d36219cc59aa74bf
Opcode Fuzzy Hash: 6f19d3dc6d7efca15155186f71feb773e3a936cabd06d1d72de0ba5616a7670f
Instruction Fuzzy Hash: 9541C6B6910208AFCB08DF58D845BEEF7F9EF49310F14852AF919D7741E770AA508BA0

Function 002F2E10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 002F2E47
___except_validate_context_record.LIBVCRUNTIME ref: 002F2E4F
_ValidateLocalCookies.LIBCMT ref: 002F2ED8
__IsNonwritableInCurrentImage.LIBCMT ref: 002F2F03
_ValidateLocalCookies.LIBCMT ref: 002F2F58

Strings

csm, xrefs: 002F2EED
i4, xrefs: 002F2F78

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: i4$csm
API String ID: 1170836740-3943644863
Opcode ID: 6ae6c4a546261426fa0133802aa83351caa0c887065b02f9fbb3cb5719c51b1c
Instruction ID: 735b155ecf70a961db9d1f00c1592712b822c92ba1edca731be5c8a50cc0bd35
Opcode Fuzzy Hash: 6ae6c4a546261426fa0133802aa83351caa0c887065b02f9fbb3cb5719c51b1c
Instruction Fuzzy Hash: D941F730A2020DDBCF10DF68C840AAEFBB5AF46354F148165EA059B392C731EE69CB90

Function 00213DE0 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 79COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00213E7F

Strings

ios_base::badbit set, xrefs: 00213E17
ios_base::eofbit set, xrefs: 00213E28, 00213E41, 00213E63
@3!, xrefs: 00213E84
@3!, xrefs: 00213DBE, 00213E9B
`!!, xrefs: 00213E70
ios_base::failbit set, xrefs: 00213D32, 00213E1E

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: @3!$@3!$`!!$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-996552614
Opcode ID: b8decce4d501a5cab286eaad5dafaaba56eba68085f2c22853401b36395cf1ec
Instruction ID: 471198f9ff8072cf2b13f891cf688cd196ef2a7842b675b4408ac3e3b3ef4eb0
Opcode Fuzzy Hash: b8decce4d501a5cab286eaad5dafaaba56eba68085f2c22853401b36395cf1ec
Instruction Fuzzy Hash: 372127B69103056FC714DF58D841BD6B7DDAF18320F08883AFA68CB642E770EA64CB90

Function 00214C50 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 442COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00214F72
___std_exception_destroy.LIBVCRUNTIME ref: 00214FFF
___std_exception_copy.LIBVCRUNTIME ref: 002150C8

Strings

@3!, xrefs: 002150CD
recursive_directory_iterator::operator++, xrefs: 0021504C
`!!, xrefs: 00214F6B, 00214FF8, 002150B9

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$___std_exception_copy
String ID: @3!$`!!$recursive_directory_iterator::operator++
API String ID: 1206660477-2720571213
Opcode ID: 8e5ac4dfbbf2a931ce9dbddd976250b0ab4a81c920c1908ac50e0d61d38f88f1
Instruction ID: 5aa0f32262be9ad25205bc67a60e94e4b8698033834c44acacca94e62274ad1a
Opcode Fuzzy Hash: 8e5ac4dfbbf2a931ce9dbddd976250b0ab4a81c920c1908ac50e0d61d38f88f1
Instruction Fuzzy Hash: C5E103719102049FCB18EF68D845BAEF7F9FF58300F148A2DE45A93B81D774A964CBA1

Function 00217820 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0021799A
___std_exception_copy.LIBVCRUNTIME ref: 00217B75

Strings

out_of_range, xrefs: 00217A27
`!!, xrefs: 002179A5, 00217B80
`!!, xrefs: 00217985, 00217B60
type_error, xrefs: 0021784A

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!!$`!!$out_of_range$type_error
API String ID: 2659868963-1666391579
Opcode ID: 292d02c5f627d3da7a3b3346b080c4c70e6c4b51fe5901976b2d89c7fdace369
Instruction ID: 4d5a7ffcd50fdb7e3feccb2f5f4a5423edc9219a7bae2d2e06b5bbc388c75c97
Opcode Fuzzy Hash: 292d02c5f627d3da7a3b3346b080c4c70e6c4b51fe5901976b2d89c7fdace369
Instruction Fuzzy Hash: BEC169B19102088FDB18CFA8D98479EFBF5FF49310F14866AE419EB741E774A990CB90

Function 00213190 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 170COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 002132C6
___std_exception_destroy.LIBVCRUNTIME ref: 00213350

Strings

@3!, xrefs: 00213316
`!!, xrefs: 002132D1
`!!, xrefs: 002132AD, 00213349
+4!, xrefs: 00213190

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: +4!$@3!$`!!$`!!
API String ID: 2970364248-3890975345
Opcode ID: 03390aee0d23d1c9a4c680c38599c687bd6acce4cbd3363f1923985921673a68
Instruction ID: afeca24145922b3632000cb0720f2de8ac719443e6eadf27461abc6269802549
Opcode Fuzzy Hash: 03390aee0d23d1c9a4c680c38599c687bd6acce4cbd3363f1923985921673a68
Instruction Fuzzy Hash: FB51AF719102089FDB09DF98D885BEEFBFAFF59310F148129E815A7381D774AA91CB90

Function 002139F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00213A58
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00213AA4
__Getctype.LIBCPMT ref: 00213ABA
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00213AE6
std::_Lockit::~_Lockit.LIBCPMT ref: 00213B7B

Strings

bad locale name, xrefs: 00213B96

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: 89549f8df474daad7019168316612d7e579303f3960b5fb227f0de43508b6eb5
Instruction ID: 71d03d78808552b2f4fc8d9c45055f74f1d1536628851dcf6df7e1bdb50a0a8c
Opcode Fuzzy Hash: 89549f8df474daad7019168316612d7e579303f3960b5fb227f0de43508b6eb5
Instruction Fuzzy Hash: E1518FB1D102489BEF10DFA5D885BDEFBF9AF14314F184069E809AB381E774DA54CBA1

Function 0027DE70 Relevance: 9.1, APIs: 6, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0027DE93
std::_Lockit::_Lockit.LIBCPMT ref: 0027DEB6
std::_Lockit::~_Lockit.LIBCPMT ref: 0027DED6
std::_Facet_Register.LIBCPMT ref: 0027DF4B
std::_Lockit::~_Lockit.LIBCPMT ref: 0027DF63
Concurrency::cancel_current_task.LIBCPMT ref: 0027DF7B

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: bf9807801212bc3eb9776367e3e997446f2c54024d01eb24ae84d95516d8cf53
Instruction ID: beb31827efb3eece6397fec8d79a0db4051a0a75452a9d2b6242bf17259f9ca1
Opcode Fuzzy Hash: bf9807801212bc3eb9776367e3e997446f2c54024d01eb24ae84d95516d8cf53
Instruction Fuzzy Hash: EA4101759202569FCB15DF54D841AAEBBB8FF12720F148268E8096B352DB30BD20CBD2

Function 00216F40 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 349COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00217340

Strings

parse error, xrefs: 00216FFF, 00217018
`!!, xrefs: 0021734B
parse_error, xrefs: 00216F8B
`!!, xrefs: 00217328

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!!$`!!$parse error$parse_error
API String ID: 2659868963-3548305109
Opcode ID: 4adffc123308ac10be3ce681c0f6a3f0af3723f5d484d2da3113792af916975b
Instruction ID: 95c3ba380481226956e3b31517d18b998b28076aab7a885352c55c10a2563918
Opcode Fuzzy Hash: 4adffc123308ac10be3ce681c0f6a3f0af3723f5d484d2da3113792af916975b
Instruction Fuzzy Hash: 0CE17F709142488FDB18CF68C88479DBBF5FF59300F2482A9E418EB792D774AA91CF91

Function 002173B0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 002175BE
___std_exception_destroy.LIBVCRUNTIME ref: 002175CD

Strings

at line , xrefs: 002173F7
, column , xrefs: 00217434, 0021744A
`!!, xrefs: 002175B6, 002175C6

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column $`!!
API String ID: 4194217158-2227850838
Opcode ID: 83cdd58159f537b7dfc98dfbf021a250ce34fc812b745f0ac44cf2638ea91898
Instruction ID: c1659944ed7395cebbf5c3eb9316e947ee78f2dfde6b2caf844a6239a1021959
Opcode Fuzzy Hash: 83cdd58159f537b7dfc98dfbf021a250ce34fc812b745f0ac44cf2638ea91898
Instruction Fuzzy Hash: 2261F671A14205AFDB08DF68DC84BADBBF6FF98300F64462CE415A7781D774AA94CB90

Function 00213370 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

APIs

Part of subcall function 00213190: ___std_exception_copy.LIBVCRUNTIME ref: 002132C6

___std_exception_copy.LIBVCRUNTIME ref: 0021345F

Strings

@3!, xrefs: 00213464
`!!, xrefs: 00213450
@3!, xrefs: 002133F3, 0021347B
+4!, xrefs: 002133B3, 00213410

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: +4!$@3!$@3!$`!!
API String ID: 2659868963-1715996797
Opcode ID: 14a91be47303de11b3d69a323f3bc15725ccbf372871a3cd0c28853efb2e5d6d
Instruction ID: f08e496ae6f04b03aaed15d1966e1f85a629c23825ea47a4ac32daa0f7d66a78
Opcode Fuzzy Hash: 14a91be47303de11b3d69a323f3bc15725ccbf372871a3cd0c28853efb2e5d6d
Instruction Fuzzy Hash: CE318575910209AFCB19DFA8D841AEDFBF9FB08310F10452AE518D7741D770A690CF94

Function 00213410 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 47COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0021345F

Strings

@3!, xrefs: 00213464
`!!, xrefs: 00213450
@3!, xrefs: 002133F3, 0021347B
+4!, xrefs: 002133B3, 00213410

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: +4!$@3!$@3!$`!!
API String ID: 2659868963-1715996797
Opcode ID: fc05254cf328883ededbe6766cdf0590881c12736514de55e00c3d3d08a8ff5c
Instruction ID: ec39ae47b172fb14a1e77cbc7cc0a82fbee4abf440082dd33fdaf182588034b7
Opcode Fuzzy Hash: fc05254cf328883ededbe6766cdf0590881c12736514de55e00c3d3d08a8ff5c
Instruction Fuzzy Hash: 25014FBA510609AF8709DFA9D44189AFBFDBF18310700843AE62987611E7B0E564CF90

Function 00216C60 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 247COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00216F11
___std_exception_destroy.LIBVCRUNTIME ref: 00216F20

Strings

[json.exception., xrefs: 00216CB8
`!!, xrefs: 00216F09, 00216F19

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.$`!!
API String ID: 4194217158-2149100017
Opcode ID: c3381df7e79775179dbf97fff69b68cd2088eab9f4a2a54413af15b949812c1b
Instruction ID: 63caa4fea697adad10e6034e0d3049fd13fa4e59ed3f2cd2407e5cf6bb34abb0
Opcode Fuzzy Hash: c3381df7e79775179dbf97fff69b68cd2088eab9f4a2a54413af15b949812c1b
Instruction Fuzzy Hash: 8291D470A102049FDB18CF68D988BDEFBF6EF55300F20866DE415AB792D771A991CB90

Function 00212270 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 218COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00212275

Part of subcall function 002ED6E9: std::invalid_argument::invalid_argument.LIBCONCRT ref: 002ED6F5

Strings

string too long, xrefs: 00212270
L4, xrefs: 00212347
L4, xrefs: 00212427

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: string too long$L4$L4
API String ID: 1997705970-2458504751
Opcode ID: 296037d0a52e692f84c98c5ab7b65a1af5250fb8032dfdc0d2aa0bcdb93a389f
Instruction ID: 5f372d11cff458509627a350c105f2e0a0b1eea665717a9f128b801ece91ee80
Opcode Fuzzy Hash: 296037d0a52e692f84c98c5ab7b65a1af5250fb8032dfdc0d2aa0bcdb93a389f
Instruction Fuzzy Hash: 20814775A14285DFDB02CF68C4507EDBFF5EF6A300F1841AAE894A7742C37585A9CBA0

Function 00217620 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 167COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 002177B4

Strings

invalid_iterator, xrefs: 00217656
`!!, xrefs: 002177BF
`!!, xrefs: 0021779F

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!!$`!!$invalid_iterator
API String ID: 2659868963-2956669300
Opcode ID: 56f691642fa30cd4bd6a8f5f879afbd6126eeb4ee37d8ee61cef13095301a407
Instruction ID: 80807dbcb7eb4ac46c057e6e1606d892bfb1699b297e07e50174c8490f9d3836
Opcode Fuzzy Hash: 56f691642fa30cd4bd6a8f5f879afbd6126eeb4ee37d8ee61cef13095301a407
Instruction Fuzzy Hash: 6F515AB49102088FDB08CFA8D98479DFBF5FB89310F148669E419EB791E774A990CF90

Function 00217BE0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 156COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00217D67

Strings

other_error, xrefs: 00217C0A
`!!, xrefs: 00217D72
`!!, xrefs: 00217D52

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!!$`!!$other_error
API String ID: 2659868963-1358939976
Opcode ID: ebbe80e0a319e6f310339154c14b398ff60afc83df3d53ffde16fdfad303368e
Instruction ID: 4eb6d5af361b7fa197aa783f44b61775f1f0b9ceb0c20f125b7fb74729ccef09
Opcode Fuzzy Hash: ebbe80e0a319e6f310339154c14b398ff60afc83df3d53ffde16fdfad303368e
Instruction Fuzzy Hash: FA515AB09102488FDB18CFA8E8847EDFBF5BF49300F148669E459EB741E774A990CB51

Function 0027D050 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0027D06F
___std_exception_copy.LIBVCRUNTIME ref: 0027D096

Strings

`!!, xrefs: 0027D09B
`!!, xrefs: 0027D060, 0027D085

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!!$`!!
API String ID: 2659868963-2180691272
Opcode ID: 770dd1bd0c26611c31851f69b79bd0d6ab7377aead4bfbfbbd1c0d013100dd9b
Instruction ID: ea97fb3ebcd2abc18d4ea8ca88597ff2ed48c170b3bfe86f5acc8e13d7d3cc24
Opcode Fuzzy Hash: 770dd1bd0c26611c31851f69b79bd0d6ab7377aead4bfbfbbd1c0d013100dd9b
Instruction Fuzzy Hash: 6F01A4BA50060AAF8709DF59D445896FBF9FB49710700853BA629CBB11E7B0F568CFA0

Function 0028B3C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0028B3DF
___std_exception_copy.LIBVCRUNTIME ref: 0028B406

Strings

`!!, xrefs: 0028B40E
`!!, xrefs: 0028B3D0, 0028B3F5

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!!$`!!
API String ID: 2659868963-2180691272
Opcode ID: 7a514dc8ad901c64981dc73cc816b082501888a0704fe8554fec48844ea073c5
Instruction ID: 9d7df70f6e7d34e04a321e0e27ff8ab808da5f7b370c162b2825dcbc3a06c15e
Opcode Fuzzy Hash: 7a514dc8ad901c64981dc73cc816b082501888a0704fe8554fec48844ea073c5
Instruction Fuzzy Hash: 06F0C9BA500605AF8709DF54D445896FBEDFA49710301853BE62ACB701E7B0E564CFA0

Function 0028B450 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 190COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0028B612

Strings

invalid hash bucket count, xrefs: 0028B60D
Px(, xrefs: 0028B456, 0028B5BA, 0028B5F3, 0028B54A, 0028B4F1

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_
String ID: Px($invalid hash bucket count
API String ID: 909987262-3311336540
Opcode ID: 16d5219eed1dd4386e140163b41af27109c1de16839d133d0a5f287038371092
Instruction ID: 4d922427420b3b3b5f9a9d8d997b18c8e64b0c38ce1df7cf0378fe456f114c3b
Opcode Fuzzy Hash: 16d5219eed1dd4386e140163b41af27109c1de16839d133d0a5f287038371092
Instruction Fuzzy Hash: D37110B8A11605DFCB15DF48C18086AFBB9FF88300764C5AED8199B396D731EA52CF90

Function 0028E440 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0028E491

Strings

type must be string, but is , xrefs: 0028E4F8
type must be boolean, but is , xrefs: 0028E582

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: type must be boolean, but is $type must be string, but is
API String ID: 118556049-436076039
Opcode ID: 7a9c7305f4d1bb16931084e2c2323a77d5be0f10e141f37551cb94381bc1e6c5
Instruction ID: a635489aa732adc2b4759992f303e85a469d67d3104ea5e39027a11dce199853
Opcode Fuzzy Hash: 7a9c7305f4d1bb16931084e2c2323a77d5be0f10e141f37551cb94381bc1e6c5
Instruction Fuzzy Hash: C0416DB5910248AFDB14FBA4D802BDEB7A8DB14310F148578F419D77C2EB35E964CB91

Function 00213050 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00213078

Strings

`!!, xrefs: 00213080
`!!, xrefs: 00213063

Memory Dump Source

Source File: 00000007.00000002.3788080872.0000000000211000.00000040.00000001.01000000.00000005.sdmp, Offset: 00210000, based on PE: true

Associated: 00000007.00000002.3788018220.0000000000210000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788080872.0000000000343000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788429281.0000000000348000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.000000000034C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000004DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.00000000005F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3788481819.0000000000607000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789199612.0000000000608000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3789438907.00000000007AD000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_210000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!!$`!!
API String ID: 2659868963-2180691272
Opcode ID: d7d7c47e46c7553b45d16e06dfe283e4ae8ce367466ff934851d90e230749fa9
Instruction ID: 212a53dcb06685420b27ffa7a84bd05fec3cd058acbdbd15169ad05476d6f597
Opcode Fuzzy Hash: d7d7c47e46c7553b45d16e06dfe283e4ae8ce367466ff934851d90e230749fa9
Instruction Fuzzy Hash: C3E0EDB69112089FC711DFA898459CAFFE8AB19711F0086BAE948D7301F6B095948BD1

Analysis Process: RageMP131.exePID: 7884, Parent PID: 3504COMMON

Execution Graph

Execution Coverage:	3.2%
Dynamic/Decrypted Code Coverage:	0.9%
Signature Coverage:	0%
Total number of Nodes:	655
Total number of Limit Nodes:	68

Executed Functions

Function 008A3A40 Relevance: 2.7, APIs: 2, Instructions: 157
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E9,?,00000001,00000000,?,?,?,?,?,?,?,?,008A3DB6), ref: 008A3B08
Sleep.KERNELBASE(00000001,?,00000001,00000000,?,?,?,?,?,?,?,?,008A3DB6), ref: 008A3BBA

Memory Dump Source

Source File: 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.3787995415.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788101303.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788453377.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789212329.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789441990.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: a1c9bd2069d4c19498953f2d538d52cf49b6dde6daca7f6786b2d8bae90b9e47
Instruction ID: dd7ef8869abac888e46c86597bca17e932321653afbffe390f73026569a18417
Opcode Fuzzy Hash: a1c9bd2069d4c19498953f2d538d52cf49b6dde6daca7f6786b2d8bae90b9e47
Instruction Fuzzy Hash: B251CC35A046298FDB24CF58C8D0EAAB3B2FF46714B284599E445AFB51D731FE06CB90

Function 0085E0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 0085E0CA
socket.WS2_32(?,?,?), ref: 0085E17F
connect.WS2_32(00000000,?,?), ref: 0085E192
closesocket.WS2_32(00000000), ref: 0085E19E

Memory Dump Source

Source File: 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.3787995415.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788101303.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788453377.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789212329.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789441990.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: e245437f3077db594f4ab876defb5afda3faf22c3696b98fb2fa330c6182e01d
Instruction ID: 8cccd600e21df44e084c9d0862b66b8cebd9b0776428853490a1b12bd82834f5
Opcode Fuzzy Hash: e245437f3077db594f4ab876defb5afda3faf22c3696b98fb2fa330c6182e01d
Instruction Fuzzy Hash: 6731AF726447006BD7209F248C89B2BB7E8FB85736F015F1DFDA8962D0E33199088B92

Function 00934623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.3787995415.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788101303.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788453377.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789212329.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789441990.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25e757d747eead786977d05ea2f3af8078cdbe4b7f3ac70e58d979c95b0c73aa
Instruction ID: edb130c78d16f1676f4a27e0e524de23588b01700d2876e50703cff54a57e2d0
Opcode Fuzzy Hash: 25e757d747eead786977d05ea2f3af8078cdbe4b7f3ac70e58d979c95b0c73aa
Instruction Fuzzy Hash: 95B13470E04249AFDB11DFA8E841BAEBBB9EF86300F154158E554AB392C774BD41CF61

Function 0084A210 Relevance: 1.7, APIs: 1, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 0084A343

Memory Dump Source

Source File: 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.3787995415.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788101303.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788453377.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789212329.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789441990.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 5d1da4e1b43505445c994e79d62429714658ca75d30394b83c9ee1e08db8d7aa
Instruction ID: 23dc475e55d3d9984fef2b7ef51e9567fb1d157c745fc089272a9d04b9077a25
Opcode Fuzzy Hash: 5d1da4e1b43505445c994e79d62429714658ca75d30394b83c9ee1e08db8d7aa
Instruction Fuzzy Hash: C1714771940218AFDB18DF68DC49BAEB7E8FF81700F10856DF809DB782E7B599418792

Function 0093549C Relevance: 1.7, APIs: 1, Instructions: 198
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000000,00929087,?,00000000,00000000,00000000,?,00000000,?,0084A3EB,00929087,00000000,0084A3EB,?,?), ref: 00935621

Memory Dump Source

Source File: 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.3787995415.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788101303.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788453377.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789212329.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789441990.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3dedab9a5eb99e8515afacaebcb9792e58cb47bd661440acfdc6edf1fb35f941
Instruction ID: 10fe554788715e77129bb512c80520e137e4656dd5f73f1620b379a5476f1365
Opcode Fuzzy Hash: 3dedab9a5eb99e8515afacaebcb9792e58cb47bd661440acfdc6edf1fb35f941
Instruction Fuzzy Hash: 6F61B0B2D04519AFDF11DFA8C845EEEBBBAAF4D308F160545F804A7215D375E9418FA0

Function 053A0210 Relevance: 1.7, APIs: 1, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 053A0252

Memory Dump Source

Source File: 00000008.00000002.3794089756.00000000053A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53a0000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: be05b64305698f68568b850385ba7d79b9c1ef23fd72538dffec1e222cc3c81e
Instruction ID: 027786b70f1fa1799184c17cfaa0b88176e03771deee6bfd3b92df89f06e49a1
Opcode Fuzzy Hash: be05b64305698f68568b850385ba7d79b9c1ef23fd72538dffec1e222cc3c81e
Instruction Fuzzy Hash: 244127EB50C210EEA14ED6E15B5C9FA6B2FF6A7330731806AB447E6E42F6C51B584432

Function 053A0207 Relevance: 1.7, APIs: 1, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 053A0252

Memory Dump Source

Source File: 00000008.00000002.3794089756.00000000053A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53a0000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: c7e0a91298dce28e21efb9aa1371f00764f0d88ff71e120f399bd4e983140848
Instruction ID: 5773c2220af17073b2f52629d1e58f3d054f442b24e9e1f29a48a3a66409c226
Opcode Fuzzy Hash: c7e0a91298dce28e21efb9aa1371f00764f0d88ff71e120f399bd4e983140848
Instruction Fuzzy Hash: 483114EB54C210EEA14ED6D25B5C9FA6B2FF6E73307318066B407E6E42F6D40B584432

Function 053A0221 Relevance: 1.7, APIs: 1, Instructions: 171
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 053A0252

Memory Dump Source

Source File: 00000008.00000002.3794089756.00000000053A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53a0000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: ffb4fd1f61e00a37d5fc02654ea1afc2f98d0c332f37a499d7714262bf13ee3a
Instruction ID: 229558f1badca420bf1286befd5cd25b56d21977b4c93b8c7b173556936e815d
Opcode Fuzzy Hash: ffb4fd1f61e00a37d5fc02654ea1afc2f98d0c332f37a499d7714262bf13ee3a
Instruction Fuzzy Hash: 333157EB50C210EEA14ED6D21B5C5FA6B2FF6A73307318066F447E2E42F6D40B584532

Function 053A0239 Relevance: 1.7, APIs: 1, Instructions: 164
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 053A0252

Memory Dump Source

Source File: 00000008.00000002.3794089756.00000000053A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53a0000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: c86bf8fcf83c07c0dae0af3e5a62e95d79870dee235d3d1f1c8667c2a9741b52
Instruction ID: 75a553158c7d5b88a689a8cbd937f3b2d5bd9be8598b127e75cf136652e223b5
Opcode Fuzzy Hash: c86bf8fcf83c07c0dae0af3e5a62e95d79870dee235d3d1f1c8667c2a9741b52
Instruction Fuzzy Hash: 0E3144EB50C210EEA10ED6E2179C5FA6B2FF6A73307318066F447E2E42F6D40A584432

Function 00924942 Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.3787995415.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788101303.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788453377.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789212329.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789441990.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ca5d0952c920614a067471f6a598fcd655e93ea7b0d7f65bc08396349ca8b02
Instruction ID: a83fd41d6840342f4f3c823865eef64aad5eb94fe45573810560fb840c59488d
Opcode Fuzzy Hash: 1ca5d0952c920614a067471f6a598fcd655e93ea7b0d7f65bc08396349ca8b02
Instruction Fuzzy Hash: 7151C870A00228EFDF14DF58DC85AAABFB5EF89354F248158F8499B256D371DE41CB90

Function 008B0560 Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 008B06AE

Memory Dump Source

Source File: 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.3787995415.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788101303.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788453377.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789212329.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789441990.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction ID: e67ee8b7a0130a12c992bea1da0e33a3dc0d0a9e6acba8d44ccf99c0bcbdde56
Opcode Fuzzy Hash: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction Fuzzy Hash: 0841D572A002289BCB15DF68D9806DF7BA5FF85350F140669F815EB356D730ED608BE1

Function 00934B12 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,009349F9,00000000,CF830579,00971140,0000000C,00934AB5,00928BBD,?), ref: 00934B68

Memory Dump Source

Source File: 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.3787995415.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788101303.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788453377.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789212329.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789441990.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: c43e2767ad2476cd48f77f91d0ea8ecf642e9944ea2d0ea707105f5faf59635e
Instruction ID: 055469b9eaccfef36abd134bd6aca65bc6834a5e59b21045b4da6cef4436dadd
Opcode Fuzzy Hash: c43e2767ad2476cd48f77f91d0ea8ecf642e9944ea2d0ea707105f5faf59635e
Instruction Fuzzy Hash: D911A633A4422456D32123346806B7EF76E8FC37B8F2B020DF8488B0C2EE21FC815986

Function 0092E05C Relevance: 1.6, APIs: 1, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00970DF8,0084A3EB,00000002,0084A3EB,00000000,?,?,?,0092E166,00000000,?,0084A3EB,00000002,00970DF8), ref: 0092E098

Memory Dump Source

Source File: 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.3787995415.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788101303.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788453377.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789212329.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789441990.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 7ef2f04a57fe1198d4f0e0a472f03b35ce59cfc820935d47856fa54747201f41
Instruction ID: 34cc2fa67e8ef174fd11c1a046fb2e8645bc7c41da77a1a613650e0c84711c13
Opcode Fuzzy Hash: 7ef2f04a57fe1198d4f0e0a472f03b35ce59cfc820935d47856fa54747201f41
Instruction Fuzzy Hash: 16014932615228AFCF05DF19EC45C9E3B29DF81334F240208F8509B2D4E6B1ED429BD0

Function 0091F290 Relevance: 1.6, APIs: 1, Instructions: 51
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0084220E

Memory Dump Source

Source File: 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.3787995415.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788101303.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788453377.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789212329.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789441990.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 56600c4e13ce041046437c19c36af837acb259b7c52d405204ed1b9f4d11d4d3
Instruction ID: ee725df62c810334ae00dffd721428ab22701739eb3fec2494ed99bb94e43e8b
Opcode Fuzzy Hash: 56600c4e13ce041046437c19c36af837acb259b7c52d405204ed1b9f4d11d4d3
Instruction Fuzzy Hash: CE012B3650430DABCB14AF98EC1599A7BECDA40310B508835FA18DB551E730E990C795

Function 009363F3 Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,009291F7,00000000,?,00935D79,00000001,00000364,00000000,00000006,000000FF,?,00000000,0092D244,009289C3,009291F7,00000000), ref: 00936435

Memory Dump Source

Source File: 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.3787995415.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788101303.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788453377.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789212329.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789441990.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ed6538af59b8d6954c861b41dd61dcbd42ad8188535711874d61c6bf6d287418
Instruction ID: 5533737820bf65d0da9592118c6ae2488fa901b43e74a8d08f521baaf73876fa
Opcode Fuzzy Hash: ed6538af59b8d6954c861b41dd61dcbd42ad8188535711874d61c6bf6d287418
Instruction Fuzzy Hash: 61F08932D4512576DB226F669C0EB5B7B5D9F81774F15C551EC08961A0CA30D8114EE1

Function 00936E2D Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0093D635,4D88C033,?,0093D635,00000220,?,009357EF,4D88C033), ref: 00936E60

Memory Dump Source

Source File: 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.3787995415.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788101303.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788453377.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789212329.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789441990.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 51525a97cdfee054299a08840aa0bf0cea2da45db8dd4fe4a3d9a86dd9acbe40
Instruction ID: 65baeea477a46991584b586740968249d75433063ac2c00adffe79f7a416b467
Opcode Fuzzy Hash: 51525a97cdfee054299a08840aa0bf0cea2da45db8dd4fe4a3d9a86dd9acbe40
Instruction Fuzzy Hash: A7E0223A140622B6EB3136A5DC00B5B7B5DCFC23B0F048521FD09920E0CB20CC348DE8

Non-executed Functions

Function 009284A0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.3787995415.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788101303.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788453377.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789212329.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789441990.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction ID: f26c70ce3aed86cf07b44611a973a71378612461d28c71c71a59ea3327ca92e5
Opcode Fuzzy Hash: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction Fuzzy Hash: F5023C75E012299BDF14CFA9D8807AEFBF5FF48314F248269D919E7344DB31A9418B90

Function 008AF810 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 008AF833
std::_Lockit::_Lockit.LIBCPMT ref: 008AF855
std::_Lockit::~_Lockit.LIBCPMT ref: 008AF875
std::_Lockit::~_Lockit.LIBCPMT ref: 008AF89F
std::_Lockit::_Lockit.LIBCPMT ref: 008AF90D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 008AF959
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 008AF973
std::_Lockit::~_Lockit.LIBCPMT ref: 008AFA08
std::_Facet_Register.LIBCPMT ref: 008AFA15

Strings

bad locale name, xrefs: 008AFA2F
Ps, xrefs: 008AF96B, 008AF972

Memory Dump Source

Source File: 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.3787995415.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788101303.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788453377.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789212329.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789441990.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$Ps
API String ID: 3375549084-1174896957
Opcode ID: 8cd6f05cd935d5273b086ae9be41728ed43b2d94433cec5bdb40eadb6bf180cb
Instruction ID: e5581424b11cc0f81d66d611584e52fa869d51cc832bb8b353fb206a7e7eb931
Opcode Fuzzy Hash: 8cd6f05cd935d5273b086ae9be41728ed43b2d94433cec5bdb40eadb6bf180cb
Instruction Fuzzy Hash: 29619FB1E012589BEB10DFE4D885BDEBBB4FF45310F184068E908E7742D739A945CB92

Function 008439F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00843A58
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00843AA4
__Getctype.LIBCPMT ref: 00843ABA
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00843AE6
std::_Lockit::~_Lockit.LIBCPMT ref: 00843B7B

Strings

bad locale name, xrefs: 00843B96

Memory Dump Source

Source File: 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.3787995415.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788101303.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788453377.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789212329.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789441990.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: 387278e1df8929f4a2561618fea9984ba6f5f285b7c0675c2d8eeacf37262bd4
Instruction ID: 3d4092120c6214a17def9e170ec68ea9d3962e8d47d614eb2b2c3d6178e2e1aa
Opcode Fuzzy Hash: 387278e1df8929f4a2561618fea9984ba6f5f285b7c0675c2d8eeacf37262bd4
Instruction Fuzzy Hash: A6514DB1D0125C9BEB10DFA4D885B8EBBB8FF54314F144069E809EB341E778DA04CB61

Function 00922E10 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00922E47
___except_validate_context_record.LIBVCRUNTIME ref: 00922E4F
_ValidateLocalCookies.LIBCMT ref: 00922ED8
__IsNonwritableInCurrentImage.LIBCMT ref: 00922F03
_ValidateLocalCookies.LIBCMT ref: 00922F58

Strings

csm, xrefs: 00922EED

Memory Dump Source

Source File: 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.3787995415.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788101303.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788453377.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789212329.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789441990.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: a7b6e3a58a422ae219933ad32ed89c5205582dbfc3012613d7288395b0cd627b
Instruction ID: 7a29819048d850f37bf1f5af102b429ae91a109b5c37f0b72d23ca51c94515e1
Opcode Fuzzy Hash: a7b6e3a58a422ae219933ad32ed89c5205582dbfc3012613d7288395b0cd627b
Instruction Fuzzy Hash: 74410830A00228BBCF10DF68E881B9EBBB9BF85324F148055F8089B396D735DE55DB90

Function 008ADE70 Relevance: 9.1, APIs: 6, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 008ADE93
std::_Lockit::_Lockit.LIBCPMT ref: 008ADEB6
std::_Lockit::~_Lockit.LIBCPMT ref: 008ADED6
std::_Facet_Register.LIBCPMT ref: 008ADF4B
std::_Lockit::~_Lockit.LIBCPMT ref: 008ADF63
Concurrency::cancel_current_task.LIBCPMT ref: 008ADF7B

Memory Dump Source

Source File: 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.3787995415.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788101303.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788453377.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789212329.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789441990.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 47257f551567a6d89b2b52da553d9d762b762ffae118b379424d3d1a36e63526
Instruction ID: 3e29fe2b18fc0478e142814730a6b86f16a1db45b95c997ce35d1de3c22cf20c
Opcode Fuzzy Hash: 47257f551567a6d89b2b52da553d9d762b762ffae118b379424d3d1a36e63526
Instruction Fuzzy Hash: 0541F272A04219DFDB14DF58D881BABBBB4FB45310F144268E81ADBB51DB31AD84CBD1

Function 00844C50 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 442COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00844F72
___std_exception_destroy.LIBVCRUNTIME ref: 00844FFF
___std_exception_copy.LIBVCRUNTIME ref: 008450C8

Strings

recursive_directory_iterator::operator++, xrefs: 0084504C

Memory Dump Source

Source File: 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.3787995415.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788101303.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788453377.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789212329.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789441990.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$___std_exception_copy
String ID: recursive_directory_iterator::operator++
API String ID: 1206660477-953255998
Opcode ID: 0d7d88e2028e1fa0861b3ab60cfc61286179762284b6b31e49b283ec6d746215
Instruction ID: 3b367bd57a8a9e2154bb8c1d60e4d8dcc418ce8ae6599b505e894c93697e1f4f
Opcode Fuzzy Hash: 0d7d88e2028e1fa0861b3ab60cfc61286179762284b6b31e49b283ec6d746215
Instruction Fuzzy Hash: 95E1F4719006089FDB28DF68D845BAEB7F9FF44710F104A2DE456D3B81DB74A944CBA1

Function 00847820 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0084799A
___std_exception_copy.LIBVCRUNTIME ref: 00847B75

Strings

type_error, xrefs: 0084784A
out_of_range, xrefs: 00847A27

Memory Dump Source

Source File: 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.3787995415.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788101303.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788453377.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789212329.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789441990.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: out_of_range$type_error
API String ID: 2659868963-3702451861
Opcode ID: adadc9d4360c0b8c5f364e6335aa997f8265b042ff1105a2e121385f7685f4f4
Instruction ID: d2a780c3a8278941e1bfbe29ba5ec41b40969a52ff81d1f4b94d264c41bad568
Opcode Fuzzy Hash: adadc9d4360c0b8c5f364e6335aa997f8265b042ff1105a2e121385f7685f4f4
Instruction Fuzzy Hash: 06C146B19042089FDB18CFA8D884B9DFBF5FF48310F14866AE419EB792E7749980CB55

Function 008473B0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 008475BE
___std_exception_destroy.LIBVCRUNTIME ref: 008475CD

Strings

at line , xrefs: 008473F7
, column , xrefs: 00847434, 0084744A

Memory Dump Source

Source File: 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.3787995415.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788101303.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788453377.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789212329.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789441990.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column
API String ID: 4194217158-191570568
Opcode ID: 3bc2eb5c7b8a4db1944cd620a6219d4d30897a5889ab201a67dba66e513701b2
Instruction ID: d294294c7d79fe579f766ee4ae19a1081f9ca948970369a73cf1c131466a3473
Opcode Fuzzy Hash: 3bc2eb5c7b8a4db1944cd620a6219d4d30897a5889ab201a67dba66e513701b2
Instruction Fuzzy Hash: 7661C271A042099FDB18CF68DC94BADBBB6FF84300F24462CF415E7B82D774AA448B91

Function 00843D10 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00843E7F

Strings

ios_base::eofbit set, xrefs: 00843E41, 00843E63
ios_base::badbit set, xrefs: 00843E17
ios_base::failbit set, xrefs: 00843D32

Memory Dump Source

Source File: 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.3787995415.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788101303.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788453377.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789212329.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789441990.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: ef647cb74d4d84cceadce87394d8df28b2c69c7cf9291b1a583e8bc4d3c349d3
Instruction ID: d2eec1a30abd01bb0e3d4405aa92677bf9b67089410fb9708ac104d344a4477e
Opcode Fuzzy Hash: ef647cb74d4d84cceadce87394d8df28b2c69c7cf9291b1a583e8bc4d3c349d3
Instruction Fuzzy Hash: 0641B6B2900209AFCB14DF58D845BAEB7F8FF49710F14852AF919D7781E774AA01CBA1

Function 00843DE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00843E7F

Strings

ios_base::eofbit set, xrefs: 00843E28, 00843E41, 00843E63
ios_base::badbit set, xrefs: 00843E17
ios_base::failbit set, xrefs: 00843D32, 00843E1E

Memory Dump Source

Source File: 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.3787995415.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788101303.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788453377.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789212329.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789441990.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: c3179a82d3864173c9d9aec61c4c1f04234fcd61f0a46a89104b4b5766090831
Instruction ID: b8e314dc99320d143af26644ca1d38df9d0a2b6c6c64e5126c10b0400ca88747
Opcode Fuzzy Hash: c3179a82d3864173c9d9aec61c4c1f04234fcd61f0a46a89104b4b5766090831
Instruction Fuzzy Hash: 8421BBB29047196BC724DF58D805F96B7ECFB44310F18882AFA68C7682E774EA14CB91

Function 00846F40 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 349COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00847340

Strings

parse_error, xrefs: 00846F8B
parse error, xrefs: 00846FFF, 00847018

Memory Dump Source

Source File: 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.3787995415.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788101303.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788453377.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789212329.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789441990.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: parse error$parse_error
API String ID: 2659868963-1820534363
Opcode ID: d84d944e0fce3f7fb29a838fa01b081dc50cbd4fb01a342735e15e6c0cbf4f61
Instruction ID: e988ca25601d639e9184c4238d4913cdee6f27adb7d320ceec597fae1cff9223
Opcode Fuzzy Hash: d84d944e0fce3f7fb29a838fa01b081dc50cbd4fb01a342735e15e6c0cbf4f61
Instruction Fuzzy Hash: BFE15F709042488FDB18CF68C894B9DBBB2FF49304F2482ADE419EB796D7749A85CF51

Function 00846C60 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00846F11
___std_exception_destroy.LIBVCRUNTIME ref: 00846F20

Strings

[json.exception., xrefs: 00846CB8

Memory Dump Source

Source File: 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.3787995415.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788101303.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788453377.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789212329.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789441990.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.
API String ID: 4194217158-791563284
Opcode ID: 19c61378378836136b967a3085c0fbb839c1d52f31a58cc4b1d7e790216d15e2
Instruction ID: 67e5287089578a620677c81c8326136e1ad2975f265a23a32ece0c6f7116c67f
Opcode Fuzzy Hash: 19c61378378836136b967a3085c0fbb839c1d52f31a58cc4b1d7e790216d15e2
Instruction Fuzzy Hash: 23919070A002089FDB18CF68D984B9EBBF6FF45300F20866DE415EB792E775A985CB51

Function 008BE440 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 008BE491

Strings

type must be string, but is , xrefs: 008BE4F8
type must be boolean, but is , xrefs: 008BE582

Memory Dump Source

Source File: 00000008.00000002.3788101303.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.3787995415.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788101303.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788453377.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3788503404.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789212329.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.3789441990.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: type must be boolean, but is $type must be string, but is
API String ID: 118556049-436076039
Opcode ID: b9e13bcfbf9e18d12b45398c7a6cf33444b7e9aa8276037e493634fc3e2c38a1
Instruction ID: c0703da12839f106ff6a90d03eabb195e907171dfe906ca9d328f5bb9202d5d0
Opcode Fuzzy Hash: b9e13bcfbf9e18d12b45398c7a6cf33444b7e9aa8276037e493634fc3e2c38a1
Instruction Fuzzy Hash: F1417CB5D0024CAFDB14EBA8E812BDE77A8FB40310F048674F419D7B82EB35A944C796

Analysis Process: RageMP131.exePID: 8148, Parent PID: 3504COMMON

Execution Graph

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	1.3%
Signature Coverage:	0%
Total number of Nodes:	386
Total number of Limit Nodes:	62

Executed Functions

Function 008A3A40 Relevance: 2.7, APIs: 2, Instructions: 157
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E9,?,00000001,00000000,?,?,?,?,?,?,?,?,008A3DB6), ref: 008A3B08
Sleep.KERNELBASE(00000001,?,00000001,00000000,?,?,?,?,?,?,?,?,008A3DB6), ref: 008A3BBA

Memory Dump Source

Source File: 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 0000000A.00000002.3788071906.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788139616.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788476459.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789230368.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789462187.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 9b91ab8d305fed6471ee1dbb4673928e1487e7ad3a9c28e0106504d716e1d999
Instruction ID: ea9890bb2c50438c5bbdbe42f4325e4a9d904da896c64ea34d90091b03cfaa73
Opcode Fuzzy Hash: 9b91ab8d305fed6471ee1dbb4673928e1487e7ad3a9c28e0106504d716e1d999
Instruction Fuzzy Hash: 2451DC35A046298FDB24CF48C4D0EA9B3B2FF46714B28449AE445AF711D731FE06CB90

Function 0085E0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 0085E0CB
socket.WS2_32(?,?,?), ref: 0085E17E
connect.WS2_32(00000000,?,?), ref: 0085E192
closesocket.WS2_32(00000000), ref: 0085E19E

Memory Dump Source

Source File: 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 0000000A.00000002.3788071906.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788139616.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788476459.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789230368.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789462187.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: 8529055a37e7f8f36843a259eaeaa7755c50c02c482c8fb726fa0940f237e44a
Instruction ID: 8197c484065d8c2313f41da191bc6008f7a965219fc7a25cb01504e07130c4f0
Opcode Fuzzy Hash: 8529055a37e7f8f36843a259eaeaa7755c50c02c482c8fb726fa0940f237e44a
Instruction Fuzzy Hash: 2D31AF726457006BD7209F64CC89B2BB7E8FB85336F015F19FDA8D22D0E33199088B92

Function 00934623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 0000000A.00000002.3788071906.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788139616.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788476459.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789230368.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789462187.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f21b10321b0ee3cf6adee0321c7bb1a3834313a0dc103922f02da83b651d9c98
Instruction ID: 6b62bc250a58b7d7c4c38a321715b285a4647fe16cd855820dbd4d37a272503d
Opcode Fuzzy Hash: f21b10321b0ee3cf6adee0321c7bb1a3834313a0dc103922f02da83b651d9c98
Instruction Fuzzy Hash: 63B13470E04245AFDB11DFA8E881BAEBBB9EF8A300F154158E554AB386C774AD41CF61

Function 0542046E Relevance: 1.9, APIs: 1, Instructions: 412
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.3794244762.0000000005420000.00000040.00001000.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5420000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e477617c451188424ca7215d2f8b4894b44d2be62e24b4a7906200c12b5adfb
Instruction ID: 46c5d8fbeef38bd774b2207d4d3c682dde3f10a39d7ab6ae303018fe4ed739b8
Opcode Fuzzy Hash: 5e477617c451188424ca7215d2f8b4894b44d2be62e24b4a7906200c12b5adfb
Instruction Fuzzy Hash: 2181D2EB54D130BDB102D1822B6CAFA6BEFE6D67707B1C46BF40FD6502E2840A8B5131

Function 054204EB Relevance: 1.9, APIs: 1, Instructions: 384
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.3794244762.0000000005420000.00000040.00001000.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5420000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: c5e1619361c29797fabced4292e24118b48f7c2900eda94c0f5266b0ba8546c9
Instruction ID: ef4e30edccfc678a281f1e32d42c42bd837759e0eeacfa3bd6a52bb2e2bff34b
Opcode Fuzzy Hash: c5e1619361c29797fabced4292e24118b48f7c2900eda94c0f5266b0ba8546c9
Instruction Fuzzy Hash: E271B0EB14D130BDB102D1822B6CAFA67EFE6E67707B1C46BF40FD6502E2844A8B5571

Function 054204DB Relevance: 1.9, APIs: 1, Instructions: 381
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.3794244762.0000000005420000.00000040.00001000.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5420000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 9a7e9c92939b7cdc8279cdc2a4a67b0a84dfbd40eac8b1e7c926347c2edda204
Instruction ID: b255851c00351d914efafc4fc478a00ee408074a332132142935847fd4d121d5
Opcode Fuzzy Hash: 9a7e9c92939b7cdc8279cdc2a4a67b0a84dfbd40eac8b1e7c926347c2edda204
Instruction Fuzzy Hash: 2671AEEB14D130BDB102D1822B6CAFA67AFE6D67707B1C42BF80FD6502E2844A8B5531

Function 05420508 Relevance: 1.9, APIs: 1, Instructions: 379
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.3794244762.0000000005420000.00000040.00001000.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5420000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: a44ca33af49f70bf793f51cd0259d2817dd0ac2c55ce084ff2ace67ecd0a7526
Instruction ID: 40afb04ea7bb1634914bf90cd120acbcb1c8aa9491a890e2348c699241fb397e
Opcode Fuzzy Hash: a44ca33af49f70bf793f51cd0259d2817dd0ac2c55ce084ff2ace67ecd0a7526
Instruction Fuzzy Hash: 2A71C0EB14D130BDB102D1822B6CAF76BAFE6D67707B1C46BF40FD6902D2844A8B5531

Function 05420531 Relevance: 1.9, APIs: 1, Instructions: 378
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.3794244762.0000000005420000.00000040.00001000.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5420000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ca75d5fe69907a120ee02dbb02c03dcb9dbf730d6a61c2b68b0988cc7c39acd
Instruction ID: 1ee8e6f07ddab2929dea6db6a412108aef15e636f4a2a8c8f8327e88d1f9ec9a
Opcode Fuzzy Hash: 4ca75d5fe69907a120ee02dbb02c03dcb9dbf730d6a61c2b68b0988cc7c39acd
Instruction Fuzzy Hash: 1371BEEB14D130BDB102D1862B6CAFB67AFE6E67707B1C42BF80FD6502D2844A8B5171

Function 05420550 Relevance: 1.9, APIs: 1, Instructions: 365
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.3794244762.0000000005420000.00000040.00001000.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5420000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: e71aa3cc0cd20acc514449f0066ba585363e6999f6a8e3a7201cd6eb2e6fe0ce
Instruction ID: 34c0a05ed3766c2e3912f35b27325995e140ce7a7d8461524ca2d05242ee445d
Opcode Fuzzy Hash: e71aa3cc0cd20acc514449f0066ba585363e6999f6a8e3a7201cd6eb2e6fe0ce
Instruction Fuzzy Hash: 2761BFEB24D130BCB102D1822B6CAFB67AFE6D67707B1C42BF40FD6502D2840A8B5531

Function 05420563 Relevance: 1.9, APIs: 1, Instructions: 363
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(00000042), ref: 0542073F

Memory Dump Source

Source File: 0000000A.00000002.3794244762.0000000005420000.00000040.00001000.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5420000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: fe9b0e7904a6e5816f88e6982fdbadaaa079006204b76f6d99e2ff7446fad6f2
Instruction ID: 6b56bad6f1e3e5d4a53ec06f92f1da7c60ce84c69a9466ccecbf6d78c45813ef
Opcode Fuzzy Hash: fe9b0e7904a6e5816f88e6982fdbadaaa079006204b76f6d99e2ff7446fad6f2
Instruction Fuzzy Hash: 1361AFEB25D130BDB102D1822B6CAFB67AFE6E67707B1C42BF40FD6502D2844A8B5171

Function 05420578 Relevance: 1.9, APIs: 1, Instructions: 362
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.3794244762.0000000005420000.00000040.00001000.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5420000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 02380ba51a93af95885919b1b7eaeb3e1701d5b1968705dddca6aa8e31d2af0b
Instruction ID: 7ff47779f44f89f6133177bca0bfc829da7afb7477cb09d0198ef9c271a24585
Opcode Fuzzy Hash: 02380ba51a93af95885919b1b7eaeb3e1701d5b1968705dddca6aa8e31d2af0b
Instruction Fuzzy Hash: 5461C0EB24D130BDB102D1826B6CAFB67AFE6E67707B1C427F80FD6502D2840A8B5171

Function 054205EE Relevance: 1.9, APIs: 1, Instructions: 361
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.3794244762.0000000005420000.00000040.00001000.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5420000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 305366f84d2bab17d526edb0b90a0a0dece6107af837fc64072f6351856a1796
Instruction ID: 94069edf2bd2d1c5d29b3d654ebe84119e50512dd8b63f614e22634c34ebb4eb
Opcode Fuzzy Hash: 305366f84d2bab17d526edb0b90a0a0dece6107af837fc64072f6351856a1796
Instruction Fuzzy Hash: 9861BFEB24D130BCB102D1822B6CAFB67AFE6D67707B1C42BF40FD6502E2844A8B5571

Function 054205A7 Relevance: 1.9, APIs: 1, Instructions: 355
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(00000042), ref: 0542073F

Memory Dump Source

Source File: 0000000A.00000002.3794244762.0000000005420000.00000040.00001000.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5420000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 636c05ed0c3846f033d76917ec49eb618b48c25ad0949c83e9f311b84c09b38a
Instruction ID: 57febf896fe45fc64df5e221dee743fdd313e2162fc617de4d2dc2eb2e05336a
Opcode Fuzzy Hash: 636c05ed0c3846f033d76917ec49eb618b48c25ad0949c83e9f311b84c09b38a
Instruction Fuzzy Hash: 75619DEB24D130BCB112D1822B6CAFB67AFE6D67707B1C46BF40BD6502E2844A8B5571

Function 0542061E Relevance: 1.8, APIs: 1, Instructions: 341
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(00000042), ref: 0542073F

Memory Dump Source

Source File: 0000000A.00000002.3794244762.0000000005420000.00000040.00001000.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5420000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: e027330343381ce40b04dfc0badcfd5a5e88f94ab281a3a4a779587aba039e3b
Instruction ID: 2966b2abd7603ec9cb2f1fb36cb36b32a9a61a1cd7de2fd753ca5fad7a3f1ff3
Opcode Fuzzy Hash: e027330343381ce40b04dfc0badcfd5a5e88f94ab281a3a4a779587aba039e3b
Instruction Fuzzy Hash: 8F61BEEB64D130BCB102D0822B6CAFB67EFE6D67707B1C46BF40BD6502E2840A8B5571

Function 0542060A Relevance: 1.8, APIs: 1, Instructions: 312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.3794244762.0000000005420000.00000040.00001000.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5420000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: c8eefc89e983d627aabfdc1394f05a9ba74640bb25a5f324c7a4c9d2da91ce7f
Instruction ID: 4d94d595b6c382136466ee78c89814b3b691409d0c9ca9be52a4680a48751d91
Opcode Fuzzy Hash: c8eefc89e983d627aabfdc1394f05a9ba74640bb25a5f324c7a4c9d2da91ce7f
Instruction Fuzzy Hash: 3051ADEB24D130BCB112D1822B6CAF767AFE6E67707B1C467F80FD6502E2844A8B5571

Function 05420665 Relevance: 1.8, APIs: 1, Instructions: 305COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(00000042), ref: 0542073F

Memory Dump Source

Source File: 0000000A.00000002.3794244762.0000000005420000.00000040.00001000.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5420000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: ba46277db03843bdb8e66de7148d448ef1a3acdb4cf73eb43812457b6afcee51
Instruction ID: 6689224ba106a23e5c8048276ec5590cb0ee1411d130928f871f832041d38818
Opcode Fuzzy Hash: ba46277db03843bdb8e66de7148d448ef1a3acdb4cf73eb43812457b6afcee51
Instruction Fuzzy Hash: 0451CDEB24D130BDB212D1922B6CAFA67AFE6E67307B0C46BF40FD6502D2844A4B1571

Function 05420649 Relevance: 1.8, APIs: 1, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3794244762.0000000005420000.00000040.00001000.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5420000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: f0a206838be9a0179c5093ad90294ebdb0fb68451039f82ec7ef270b5aeb3da7
Instruction ID: 27540118c24e14da27ef4c9ec082e49de90b1c1dd64f69d4a02683af4e1a58ae
Opcode Fuzzy Hash: f0a206838be9a0179c5093ad90294ebdb0fb68451039f82ec7ef270b5aeb3da7
Instruction Fuzzy Hash: 7D51ADEB64D131BDB212D1822B6CAFBA7AFE6E67307B1C467F40BD5502E2840A4B1571

Function 0542071A Relevance: 1.8, APIs: 1, Instructions: 301COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(00000042), ref: 0542073F

Memory Dump Source

Source File: 0000000A.00000002.3794244762.0000000005420000.00000040.00001000.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5420000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 65f2fd5b29adbd0441951b3fd5aa7f62ab0865ff16d47841204ded23d56185c7
Instruction ID: 5d6e488c0897b0df9447bb03804520d4bbe0d8f86231bdd3eaf6d5d31ef68411
Opcode Fuzzy Hash: 65f2fd5b29adbd0441951b3fd5aa7f62ab0865ff16d47841204ded23d56185c7
Instruction Fuzzy Hash: 0C5104EB54D131BDB202D1922B6CAFBABEFE6D67707B1C427F40BD5502D2840A4B4171

Function 05420683 Relevance: 1.8, APIs: 1, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3794244762.0000000005420000.00000040.00001000.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5420000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 820fdd7b9a4ea025f1b7862ee37b7d1e2e976cfe77cc2a84a48c6380a0e9b92a
Instruction ID: bcd1f7348eae182399bd53b86793de4f45b0fdba9eedbf1218fe960cbd865b44
Opcode Fuzzy Hash: 820fdd7b9a4ea025f1b7862ee37b7d1e2e976cfe77cc2a84a48c6380a0e9b92a
Instruction Fuzzy Hash: 0C51ADEB24D130BDB112D1822B6CAFB67AFE6E67707B1C467F80FD5902D2840A8B1571

Function 0542069D Relevance: 1.8, APIs: 1, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3794244762.0000000005420000.00000040.00001000.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5420000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 4804751233279091a3013f5239b500a84a8982b25d1818e9be99f25fafe836c2
Instruction ID: 24ef418a4a8778b824baa84632ff7b0ff29dd8f6bda618fe772dcec4b5826a4d
Opcode Fuzzy Hash: 4804751233279091a3013f5239b500a84a8982b25d1818e9be99f25fafe836c2
Instruction Fuzzy Hash: 5151BDEB24D130BDB102D1822B6CAFB67AFE6E67707B1C42BF80FD5502D2840A8B1571

Function 054206C1 Relevance: 1.8, APIs: 1, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3794244762.0000000005420000.00000040.00001000.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5420000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 2cf51903626a1860871724429578fffb6cf193f1e12f009383b7b62633039b87
Instruction ID: 2bcadb2dded9a008aa112ebbdd88a6efd14149aea108f3dfeda22059b118d74e
Opcode Fuzzy Hash: 2cf51903626a1860871724429578fffb6cf193f1e12f009383b7b62633039b87
Instruction Fuzzy Hash: DC51CFEB24D130BDB102D1822B6CAFBA7AFE6E67707B1C427F40FD5502D2840A4B1571

Function 054206CD Relevance: 1.8, APIs: 1, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3794244762.0000000005420000.00000040.00001000.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5420000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: be4bb27d17d61975d7b68c79307208e444c15e99b1d685cccacbc5518d8e33cd
Instruction ID: 5a70ebfd9b4d92fdca6e192882c81229499d6b65d897481d19c933892322e6d9
Opcode Fuzzy Hash: be4bb27d17d61975d7b68c79307208e444c15e99b1d685cccacbc5518d8e33cd
Instruction Fuzzy Hash: 7F51C0EB64D130BDB102D1822B6CAF7A7AFE6E67707B1C467F80FD5502E2840A4B5171

Function 05420761 Relevance: 1.8, APIs: 1, Instructions: 251COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(00000042), ref: 0542073F

Memory Dump Source

Source File: 0000000A.00000002.3794244762.0000000005420000.00000040.00001000.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5420000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: bc6722716011599af85b6a34a8f6b1d61334bbc61934dfcf541e96ecf3941055
Instruction ID: 0902cbdd5801e52e4ba1065bb3a7eb8ad6041bf35904ea37ce0808f1e48e968a
Opcode Fuzzy Hash: bc6722716011599af85b6a34a8f6b1d61334bbc61934dfcf541e96ecf3941055
Instruction Fuzzy Hash: D241A1EB64D131BCB102D1922B6CAFB67AFE6E67303B1C427F80FD5502E2884A4B5571

Function 054206F1 Relevance: 1.7, APIs: 1, Instructions: 249COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(00000042), ref: 0542073F

Memory Dump Source

Source File: 0000000A.00000002.3794244762.0000000005420000.00000040.00001000.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5420000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 014f45329c80dde5873c8161eb6891854fa53a8dd49f5e6f9cd1bc57d74b3cc8
Instruction ID: 3fdd2c7c3fbe248a5b5266bf3bf9737aab8dfddb6b355a0a0d75b8a520d70788
Opcode Fuzzy Hash: 014f45329c80dde5873c8161eb6891854fa53a8dd49f5e6f9cd1bc57d74b3cc8
Instruction Fuzzy Hash: 544190EB14D131BCB102D1822B6CAFBA7AFE6E67307B1C427F90FD5502E2844A4B5571

Function 0084A210 Relevance: 1.7, APIs: 1, Instructions: 231COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 0084A343

Memory Dump Source

Source File: 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 0000000A.00000002.3788071906.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788139616.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788476459.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789230368.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789462187.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 234ce5f35ee26f6b0f453f40ef6c663d1be6d69a3fa4712fea532310a055e8f8
Instruction ID: 8a9de4b56ffd89b1ee906538746cb88a61db45c748c7e13cc68afb378a7911fc
Opcode Fuzzy Hash: 234ce5f35ee26f6b0f453f40ef6c663d1be6d69a3fa4712fea532310a055e8f8
Instruction Fuzzy Hash: 0271357194021CABDB18DF68DC49BAEB7E8FF41700F10816DF819DB782E7B59A408792

Function 0093549C Relevance: 1.7, APIs: 1, Instructions: 198fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000000,00929087,?,00000000,00000000,00000000,?,00000000,?,0084A3EB,00929087,00000000,0084A3EB,?,?), ref: 00935621

Memory Dump Source

Source File: 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 0000000A.00000002.3788071906.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788139616.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788476459.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789230368.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789462187.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3edb4ffc62d903df01c037133b3974433fe1b0ca375738fe1dcbeb80242a7837
Instruction ID: e8647766f815930e36ffec24aaa646ed5e18ba8d565bfc4b7aa94563c8369115
Opcode Fuzzy Hash: 3edb4ffc62d903df01c037133b3974433fe1b0ca375738fe1dcbeb80242a7837
Instruction Fuzzy Hash: 5F61C0B2904519AFDF11DFA8C885EEEBBBAAF4D308F160545F904A7215D375E9018FA0

Function 00924942 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 0000000A.00000002.3788071906.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788139616.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788476459.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789230368.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789462187.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ca5d0952c920614a067471f6a598fcd655e93ea7b0d7f65bc08396349ca8b02
Instruction ID: a83fd41d6840342f4f3c823865eef64aad5eb94fe45573810560fb840c59488d
Opcode Fuzzy Hash: 1ca5d0952c920614a067471f6a598fcd655e93ea7b0d7f65bc08396349ca8b02
Instruction Fuzzy Hash: 7151C870A00228EFDF14DF58DC85AAABFB5EF89354F248158F8499B256D371DE41CB90

Function 008B0560 Relevance: 1.6, APIs: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 008B06AE

Memory Dump Source

Source File: 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 0000000A.00000002.3788071906.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788139616.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788476459.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789230368.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789462187.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction ID: e67ee8b7a0130a12c992bea1da0e33a3dc0d0a9e6acba8d44ccf99c0bcbdde56
Opcode Fuzzy Hash: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction Fuzzy Hash: 0841D572A002289BCB15DF68D9806DF7BA5FF85350F140669F815EB356D730ED608BE1

Function 00934B12 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,009349F9,00000000,CF830579,00971140,0000000C,00934AB5,00928BBD,?), ref: 00934B68

Memory Dump Source

Source File: 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 0000000A.00000002.3788071906.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788139616.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788476459.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789230368.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789462187.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: ecf118208cacc9fa3df060cb9470d40f43ee0e5d10361a41f943094212ec0b7c
Instruction ID: b0e2844d7ab29c3f33742e3c6b71620fde2221e1ab0ab3fb309e6c5737c03d2b
Opcode Fuzzy Hash: ecf118208cacc9fa3df060cb9470d40f43ee0e5d10361a41f943094212ec0b7c
Instruction Fuzzy Hash: E811A633B4422416C32423346806B3EF7AE8FC3774F2B0209F9488B0C2EE61FC814986

Function 0092E05C Relevance: 1.6, APIs: 1, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00970DF8,0084A3EB,00000002,0084A3EB,00000000,?,?,?,0092E166,00000000,?,0084A3EB,00000002,00970DF8), ref: 0092E098

Memory Dump Source

Source File: 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 0000000A.00000002.3788071906.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788139616.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788476459.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789230368.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789462187.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: aff84dfe6f0bca75a1bc502f1709bb8ccf4a484642d0b98d5529b9d722f5f005
Instruction ID: ecc414eb601fc125c23eae5bd4761f34488d45d5f80f2d4b9e24772469b78f57
Opcode Fuzzy Hash: aff84dfe6f0bca75a1bc502f1709bb8ccf4a484642d0b98d5529b9d722f5f005
Instruction Fuzzy Hash: D2014932655128AFCF09DF59DC49C9E3B29DF81330F240208F8509B2D0E6B2ED428BD0

Function 0091F290 Relevance: 1.6, APIs: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0084220E

Memory Dump Source

Source File: 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 0000000A.00000002.3788071906.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788139616.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788476459.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789230368.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789462187.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 56600c4e13ce041046437c19c36af837acb259b7c52d405204ed1b9f4d11d4d3
Instruction ID: ee725df62c810334ae00dffd721428ab22701739eb3fec2494ed99bb94e43e8b
Opcode Fuzzy Hash: 56600c4e13ce041046437c19c36af837acb259b7c52d405204ed1b9f4d11d4d3
Instruction Fuzzy Hash: CE012B3650430DABCB14AF98EC1599A7BECDA40310B508835FA18DB551E730E990C795

Function 009363F3 Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,009291F7,00000000,?,00935D79,00000001,00000364,00000000,00000006,000000FF,?,00000000,0092D244,009289C3,009291F7,00000000), ref: 00936435

Memory Dump Source

Source File: 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 0000000A.00000002.3788071906.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788139616.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788476459.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789230368.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789462187.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ed6538af59b8d6954c861b41dd61dcbd42ad8188535711874d61c6bf6d287418
Instruction ID: 5533737820bf65d0da9592118c6ae2488fa901b43e74a8d08f521baaf73876fa
Opcode Fuzzy Hash: ed6538af59b8d6954c861b41dd61dcbd42ad8188535711874d61c6bf6d287418
Instruction Fuzzy Hash: 61F08932D4512576DB226F669C0EB5B7B5D9F81774F15C551EC08961A0CA30D8114EE1

Function 00936E2D Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0093D635,4D88C033,?,0093D635,00000220,?,009357EF,4D88C033), ref: 00936E60

Memory Dump Source

Source File: 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 0000000A.00000002.3788071906.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788139616.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788476459.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789230368.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789462187.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 51525a97cdfee054299a08840aa0bf0cea2da45db8dd4fe4a3d9a86dd9acbe40
Instruction ID: 65baeea477a46991584b586740968249d75433063ac2c00adffe79f7a416b467
Opcode Fuzzy Hash: 51525a97cdfee054299a08840aa0bf0cea2da45db8dd4fe4a3d9a86dd9acbe40
Instruction Fuzzy Hash: A7E0223A140622B6EB3136A5DC00B5B7B5DCFC23B0F048521FD09920E0CB20CC348DE8

Function 05430012 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3794288805.0000000005430000.00000040.00001000.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5430000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50056c9f42d59d9961edcaa0266e154245c15b3f972784dd785e1ef9e4776059
Instruction ID: bdf57e94b693449b2a459fb6a1ccf43f51d20ad6904b41c4666c3e04022328e6
Opcode Fuzzy Hash: 50056c9f42d59d9961edcaa0266e154245c15b3f972784dd785e1ef9e4776059
Instruction Fuzzy Hash: 8C2148E620C264BED703DA11E61B8F63F6FE98B334331828BF04BCD532E251494B9165

Function 05430000 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3794288805.0000000005430000.00000040.00001000.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5430000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3ddb97334cec05e977c7d5d5cb4e953367a23d6aa2889d36dabd35b60f8d55b
Instruction ID: 447e59891947beefe5ec6d2fbf1a72ab9e2197b95613e662292ddfe93df016c3
Opcode Fuzzy Hash: f3ddb97334cec05e977c7d5d5cb4e953367a23d6aa2889d36dabd35b60f8d55b
Instruction Fuzzy Hash: 5E2107E610D215BEE702D911AA0E8F62F2FE98A330330829BF04FC9532E695495B9175

Function 05430040 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3794288805.0000000005430000.00000040.00001000.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5430000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b56c0b6423aa89e4a00039c3acfb5dfb7bf8d8a90402fa51187a2f6010fc569
Instruction ID: ccad19773310cebe8e3597dfb4e0796ade3c146a677af3404920ea8988f9f83b
Opcode Fuzzy Hash: 1b56c0b6423aa89e4a00039c3acfb5dfb7bf8d8a90402fa51187a2f6010fc569
Instruction Fuzzy Hash: 14216EB624C254EFD702D925D94B4F63F6BE94B330334419BE04ACB522E351851A9661

Function 05430089 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3794288805.0000000005430000.00000040.00001000.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5430000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b3e2d26448a7ac06a31732ed922cfd39ed46fd8350151c9c692f499c4f4aeb9
Instruction ID: e75395d96212c086f61fe08fb968834ff19aea517853d1e1328da58edb357ad5
Opcode Fuzzy Hash: 8b3e2d26448a7ac06a31732ed922cfd39ed46fd8350151c9c692f499c4f4aeb9
Instruction Fuzzy Hash: 011127A6148214BEDB02DA55D60E4F73F6FE94B330330425BF04ACA522E792491A9666

Function 05430111 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3794288805.0000000005430000.00000040.00001000.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5430000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12aec323536b3d8aa516fab9fb11b406a3114ac2bf293c4a1fbc868e916c7786
Instruction ID: 96d186be5d7cdf37b7563890f80002721dbae3ade3aecc146d9ed7e961c87753
Opcode Fuzzy Hash: 12aec323536b3d8aa516fab9fb11b406a3114ac2bf293c4a1fbc868e916c7786
Instruction Fuzzy Hash: A0012BA6149114BEDB02D555960F9F72F6FE98A7303308247F04BCC931E79245076561

Function 054300C4 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3794288805.0000000005430000.00000040.00001000.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5430000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f535ef68da3a3b1bff235c8a5397faa949e37bfe13bdaa318d1ff388838085e0
Instruction ID: ce4139242ddd315165b20015037e9f466c754d5aba6080e1b290de9ec8d8cbed
Opcode Fuzzy Hash: f535ef68da3a3b1bff235c8a5397faa949e37bfe13bdaa318d1ff388838085e0
Instruction Fuzzy Hash: 9A0128E7148114BFAB02E599D60F5F76F5FE58B3303308257F44ACE532E297490761A1

Function 054300B6 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3794288805.0000000005430000.00000040.00001000.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5430000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2a95a5679217924f5c31826f4f19e669041e5b4f7a8209d73c9270352fbbf2c
Instruction ID: dfdcb744e4e8e9c78c9079a42cd7167f5b41d0a86ae6d08b9f94bb5c2bf79ab2
Opcode Fuzzy Hash: c2a95a5679217924f5c31826f4f19e669041e5b4f7a8209d73c9270352fbbf2c
Instruction Fuzzy Hash: 0101F2EB149124BEEB02D555DA0F8F72E6FE98A3303308247F04BC9932A792490761B2

Function 054300FD Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3794288805.0000000005430000.00000040.00001000.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5430000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc5b4d7c4eda34cc91b1516743d59fe88df7705a7bec0c96fd77638d13b92cb0
Instruction ID: 4b0821332a1adef856f22d1b3f2b0bfae49347ba8d6ba7b241feb8fd0a0b91c1
Opcode Fuzzy Hash: dc5b4d7c4eda34cc91b1516743d59fe88df7705a7bec0c96fd77638d13b92cb0
Instruction Fuzzy Hash: D8F027E6208060ABDF02E575E64F4FB2E6F94C9220365834BF08EC9831D61789079062

Function 05430166 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3794288805.0000000005430000.00000040.00001000.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5430000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c36fda7927484af142eabace3c78fb21751d830226825c8e98ef7e27ce0ec9b4
Instruction ID: 629df7d245f3142915051be8de69f15e43fd13adc9131ebf18c74616b45043ea
Opcode Fuzzy Hash: c36fda7927484af142eabace3c78fb21751d830226825c8e98ef7e27ce0ec9b4
Instruction Fuzzy Hash: CCE07DE36082A5B5CF00A2B4458FDF6BF4B14DF1523084B6BB80A8DD21C20685078090

Function 0543014D Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3794288805.0000000005430000.00000040.00001000.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5430000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eefb5e78de6df4a08df36e424e8bddd39214c86e682b8389cc5784367b83a441
Instruction ID: 93d7d927c0cc5fac460fb6bfab16719eb866d9178bdaf44d0a529a98c3df1b4b
Opcode Fuzzy Hash: eefb5e78de6df4a08df36e424e8bddd39214c86e682b8389cc5784367b83a441
Instruction Fuzzy Hash: 39D02BD710C000F6CB42D56190CF1F23F9B65591113510247B44E88522C11B42075233

Function 054301B0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3794288805.0000000005430000.00000040.00001000.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5430000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaba4a26adc7dc4abe4b6bf81c44b88321569f2fe4ae8759637cda33a0d08f81
Instruction ID: 7b876e5eeeda9574f0a699e5b9d0b79bdfd5d65de09fda5cb482f9eb2c2b1eef
Opcode Fuzzy Hash: aaba4a26adc7dc4abe4b6bf81c44b88321569f2fe4ae8759637cda33a0d08f81
Instruction Fuzzy Hash: 20D02BD710C010F6CF41D961908F1F22FAB655A111351020BF04FC8532C21780075133

Non-executed Functions

Function 009284A0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 0000000A.00000002.3788071906.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788139616.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788476459.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789230368.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789462187.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction ID: f26c70ce3aed86cf07b44611a973a71378612461d28c71c71a59ea3327ca92e5
Opcode Fuzzy Hash: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction Fuzzy Hash: F5023C75E012299BDF14CFA9D8807AEFBF5FF48314F248269D919E7344DB31A9418B90

Function 008AF810 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 008AF833
std::_Lockit::_Lockit.LIBCPMT ref: 008AF855
std::_Lockit::~_Lockit.LIBCPMT ref: 008AF875
std::_Lockit::~_Lockit.LIBCPMT ref: 008AF89F
std::_Lockit::_Lockit.LIBCPMT ref: 008AF90D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 008AF959
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 008AF973
std::_Lockit::~_Lockit.LIBCPMT ref: 008AFA08
std::_Facet_Register.LIBCPMT ref: 008AFA15

Strings

Ps, xrefs: 008AF96B, 008AF972
bad locale name, xrefs: 008AFA2F

Memory Dump Source

Source File: 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 0000000A.00000002.3788071906.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788139616.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788476459.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789230368.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789462187.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$Ps
API String ID: 3375549084-1174896957
Opcode ID: 8cd6f05cd935d5273b086ae9be41728ed43b2d94433cec5bdb40eadb6bf180cb
Instruction ID: e5581424b11cc0f81d66d611584e52fa869d51cc832bb8b353fb206a7e7eb931
Opcode Fuzzy Hash: 8cd6f05cd935d5273b086ae9be41728ed43b2d94433cec5bdb40eadb6bf180cb
Instruction Fuzzy Hash: 29619FB1E012589BEB10DFE4D885BDEBBB4FF45310F184068E908E7742D739A945CB92

Function 008439F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00843A58
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00843AA4
__Getctype.LIBCPMT ref: 00843ABA
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00843AE6
std::_Lockit::~_Lockit.LIBCPMT ref: 00843B7B

Strings

bad locale name, xrefs: 00843B96

Memory Dump Source

Source File: 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 0000000A.00000002.3788071906.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788139616.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788476459.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789230368.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789462187.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: 387278e1df8929f4a2561618fea9984ba6f5f285b7c0675c2d8eeacf37262bd4
Instruction ID: 3d4092120c6214a17def9e170ec68ea9d3962e8d47d614eb2b2c3d6178e2e1aa
Opcode Fuzzy Hash: 387278e1df8929f4a2561618fea9984ba6f5f285b7c0675c2d8eeacf37262bd4
Instruction Fuzzy Hash: A6514DB1D0125C9BEB10DFA4D885B8EBBB8FF54314F144069E809EB341E778DA04CB61

Function 00922E10 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00922E47
___except_validate_context_record.LIBVCRUNTIME ref: 00922E4F
_ValidateLocalCookies.LIBCMT ref: 00922ED8
__IsNonwritableInCurrentImage.LIBCMT ref: 00922F03
_ValidateLocalCookies.LIBCMT ref: 00922F58

Strings

csm, xrefs: 00922EED

Memory Dump Source

Source File: 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 0000000A.00000002.3788071906.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788139616.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788476459.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789230368.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789462187.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: a7b6e3a58a422ae219933ad32ed89c5205582dbfc3012613d7288395b0cd627b
Instruction ID: 7a29819048d850f37bf1f5af102b429ae91a109b5c37f0b72d23ca51c94515e1
Opcode Fuzzy Hash: a7b6e3a58a422ae219933ad32ed89c5205582dbfc3012613d7288395b0cd627b
Instruction Fuzzy Hash: 74410830A00228BBCF10DF68E881B9EBBB9BF85324F148055F8089B396D735DE55DB90

Function 008ADE70 Relevance: 9.1, APIs: 6, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 008ADE93
std::_Lockit::_Lockit.LIBCPMT ref: 008ADEB6
std::_Lockit::~_Lockit.LIBCPMT ref: 008ADED6
std::_Facet_Register.LIBCPMT ref: 008ADF4B
std::_Lockit::~_Lockit.LIBCPMT ref: 008ADF63
Concurrency::cancel_current_task.LIBCPMT ref: 008ADF7B

Memory Dump Source

Source File: 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 0000000A.00000002.3788071906.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788139616.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788476459.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789230368.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789462187.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 47257f551567a6d89b2b52da553d9d762b762ffae118b379424d3d1a36e63526
Instruction ID: 3e29fe2b18fc0478e142814730a6b86f16a1db45b95c997ce35d1de3c22cf20c
Opcode Fuzzy Hash: 47257f551567a6d89b2b52da553d9d762b762ffae118b379424d3d1a36e63526
Instruction Fuzzy Hash: 0541F272A04219DFDB14DF58D881BABBBB4FB45310F144268E81ADBB51DB31AD84CBD1

Function 00844C50 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 442COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00844F72
___std_exception_destroy.LIBVCRUNTIME ref: 00844FFF
___std_exception_copy.LIBVCRUNTIME ref: 008450C8

Strings

recursive_directory_iterator::operator++, xrefs: 0084504C

Memory Dump Source

Source File: 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 0000000A.00000002.3788071906.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788139616.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788476459.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789230368.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789462187.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$___std_exception_copy
String ID: recursive_directory_iterator::operator++
API String ID: 1206660477-953255998
Opcode ID: 0d7d88e2028e1fa0861b3ab60cfc61286179762284b6b31e49b283ec6d746215
Instruction ID: 3b367bd57a8a9e2154bb8c1d60e4d8dcc418ce8ae6599b505e894c93697e1f4f
Opcode Fuzzy Hash: 0d7d88e2028e1fa0861b3ab60cfc61286179762284b6b31e49b283ec6d746215
Instruction Fuzzy Hash: 95E1F4719006089FDB28DF68D845BAEB7F9FF44710F104A2DE456D3B81DB74A944CBA1

Function 00847820 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0084799A
___std_exception_copy.LIBVCRUNTIME ref: 00847B75

Strings

type_error, xrefs: 0084784A
out_of_range, xrefs: 00847A27

Memory Dump Source

Source File: 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 0000000A.00000002.3788071906.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788139616.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788476459.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789230368.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789462187.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: out_of_range$type_error
API String ID: 2659868963-3702451861
Opcode ID: adadc9d4360c0b8c5f364e6335aa997f8265b042ff1105a2e121385f7685f4f4
Instruction ID: d2a780c3a8278941e1bfbe29ba5ec41b40969a52ff81d1f4b94d264c41bad568
Opcode Fuzzy Hash: adadc9d4360c0b8c5f364e6335aa997f8265b042ff1105a2e121385f7685f4f4
Instruction Fuzzy Hash: 06C146B19042089FDB18CFA8D884B9DFBF5FF48310F14866AE419EB792E7749980CB55

Function 008473B0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 008475BE
___std_exception_destroy.LIBVCRUNTIME ref: 008475CD

Strings

at line , xrefs: 008473F7
, column , xrefs: 00847434, 0084744A

Memory Dump Source

Source File: 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 0000000A.00000002.3788071906.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788139616.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788476459.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789230368.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789462187.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column
API String ID: 4194217158-191570568
Opcode ID: 3bc2eb5c7b8a4db1944cd620a6219d4d30897a5889ab201a67dba66e513701b2
Instruction ID: d294294c7d79fe579f766ee4ae19a1081f9ca948970369a73cf1c131466a3473
Opcode Fuzzy Hash: 3bc2eb5c7b8a4db1944cd620a6219d4d30897a5889ab201a67dba66e513701b2
Instruction Fuzzy Hash: 7661C271A042099FDB18CF68DC94BADBBB6FF84300F24462CF415E7B82D774AA448B91

Function 00843D10 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00843E7F

Strings

ios_base::failbit set, xrefs: 00843D32
ios_base::eofbit set, xrefs: 00843E41, 00843E63
ios_base::badbit set, xrefs: 00843E17

Memory Dump Source

Source File: 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 0000000A.00000002.3788071906.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788139616.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788476459.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789230368.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789462187.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: ef647cb74d4d84cceadce87394d8df28b2c69c7cf9291b1a583e8bc4d3c349d3
Instruction ID: d2eec1a30abd01bb0e3d4405aa92677bf9b67089410fb9708ac104d344a4477e
Opcode Fuzzy Hash: ef647cb74d4d84cceadce87394d8df28b2c69c7cf9291b1a583e8bc4d3c349d3
Instruction Fuzzy Hash: 0641B6B2900209AFCB14DF58D845BAEB7F8FF49710F14852AF919D7781E774AA01CBA1

Function 00843DE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00843E7F

Strings

ios_base::failbit set, xrefs: 00843D32, 00843E1E
ios_base::eofbit set, xrefs: 00843E28, 00843E41, 00843E63
ios_base::badbit set, xrefs: 00843E17

Memory Dump Source

Source File: 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 0000000A.00000002.3788071906.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788139616.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788476459.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789230368.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789462187.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: c3179a82d3864173c9d9aec61c4c1f04234fcd61f0a46a89104b4b5766090831
Instruction ID: b8e314dc99320d143af26644ca1d38df9d0a2b6c6c64e5126c10b0400ca88747
Opcode Fuzzy Hash: c3179a82d3864173c9d9aec61c4c1f04234fcd61f0a46a89104b4b5766090831
Instruction Fuzzy Hash: 8421BBB29047196BC724DF58D805F96B7ECFB44310F18882AFA68C7682E774EA14CB91

Function 00846F40 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 349COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00847340

Strings

parse error, xrefs: 00846FFF, 00847018
parse_error, xrefs: 00846F8B

Memory Dump Source

Source File: 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 0000000A.00000002.3788071906.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788139616.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788476459.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789230368.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789462187.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: parse error$parse_error
API String ID: 2659868963-1820534363
Opcode ID: d84d944e0fce3f7fb29a838fa01b081dc50cbd4fb01a342735e15e6c0cbf4f61
Instruction ID: e988ca25601d639e9184c4238d4913cdee6f27adb7d320ceec597fae1cff9223
Opcode Fuzzy Hash: d84d944e0fce3f7fb29a838fa01b081dc50cbd4fb01a342735e15e6c0cbf4f61
Instruction Fuzzy Hash: BFE15F709042488FDB18CF68C894B9DBBB2FF49304F2482ADE419EB796D7749A85CF51

Function 00846C60 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00846F11
___std_exception_destroy.LIBVCRUNTIME ref: 00846F20

Strings

[json.exception., xrefs: 00846CB8

Memory Dump Source

Source File: 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 0000000A.00000002.3788071906.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788139616.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788476459.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789230368.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789462187.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.
API String ID: 4194217158-791563284
Opcode ID: 19c61378378836136b967a3085c0fbb839c1d52f31a58cc4b1d7e790216d15e2
Instruction ID: 67e5287089578a620677c81c8326136e1ad2975f265a23a32ece0c6f7116c67f
Opcode Fuzzy Hash: 19c61378378836136b967a3085c0fbb839c1d52f31a58cc4b1d7e790216d15e2
Instruction Fuzzy Hash: 23919070A002089FDB18CF68D984B9EBBF6FF45300F20866DE415EB792E775A985CB51

Function 008BE440 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 008BE491

Strings

type must be boolean, but is , xrefs: 008BE582
type must be string, but is , xrefs: 008BE4F8

Memory Dump Source

Source File: 0000000A.00000002.3788139616.0000000000841000.00000040.00000001.01000000.00000006.sdmp, Offset: 00840000, based on PE: true

Associated: 0000000A.00000002.3788071906.0000000000840000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788139616.0000000000973000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788476459.0000000000978000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.000000000097C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3788527005.0000000000C37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789230368.0000000000C38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3789462187.0000000000DDD000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_840000_RageMP131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: type must be boolean, but is $type must be string, but is
API String ID: 118556049-436076039
Opcode ID: b9e13bcfbf9e18d12b45398c7a6cf33444b7e9aa8276037e493634fc3e2c38a1
Instruction ID: c0703da12839f106ff6a90d03eabb195e907171dfe906ca9d328f5bb9202d5d0
Opcode Fuzzy Hash: b9e13bcfbf9e18d12b45398c7a6cf33444b7e9aa8276037e493634fc3e2c38a1
Instruction Fuzzy Hash: F1417CB5D0024CAFDB14EBA8E812BDE77A8FB40310F048674F419D7B82EB35A944C796

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LisectAVT_2403002A_185.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\MPGPH131\MPGPH131.exe

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
LisectAVT_2403002A_185.exe

Function 0083E0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Function 00883A40 Relevance: 2.7, APIs: 2, Instructions: 157
sleepCOMMON

Function 05370822 Relevance: 1.8, APIs: 1, Instructions: 267
COMMON

Function 053708AC Relevance: 1.7, APIs: 1, Instructions: 211
COMMON

Function 00914623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Function 0082A210 Relevance: 1.7, APIs: 1, Instructions: 231
COMMON

Function 05370866 Relevance: 1.7, APIs: 1, Instructions: 223
COMMON

Function 05370898 Relevance: 1.7, APIs: 1, Instructions: 205
COMMON

Function 0091549C Relevance: 1.7, APIs: 1, Instructions: 198
fileCOMMON

Function 053708DA Relevance: 1.7, APIs: 1, Instructions: 185
COMMON

Function 00904942 Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Function 00890560 Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Function 00914B12 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 0090E05C Relevance: 1.6, APIs: 1, Instructions: 54
COMMONLIBRARYCODE