Edit tour

Windows Analysis Report
LisectAVT_2403002A_163.exe

Overview

General Information

Sample name:	LisectAVT_2403002A_163.exe
Analysis ID:	1482474
MD5:	a472afb64b5c6f61ac63639fbd778001
SHA1:	def8afce906aa4094c8a564ae9b9c886955c16b3
SHA256:	9582e561631b18bad3ef23b24a57636ef1d48b05535962dc0b19ab27e9351276
Tags:	exe
Infos:

Detection

RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Yara detected RisePro Stealer

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Potentially malicious time measurement code found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Uses schtasks.exe or at.exe to add and modify task schedules

Abnormal high CPU Usage

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to read the PEB

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

LisectAVT_2403002A_163.exe (PID: 3140 cmdline: "C:\Users\user\Desktop\LisectAVT_2403002A_163.exe" MD5: A472AFB64B5C6F61AC63639FBD778001)

schtasks.exe (PID: 2668 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 2380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 3636 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MPGPH131.exe (PID: 5044 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: A472AFB64B5C6F61AC63639FBD778001)

MPGPH131.exe (PID: 5012 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: A472AFB64B5C6F61AC63639FBD778001)

RageMP131.exe (PID: 7252 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: A472AFB64B5C6F61AC63639FBD778001)

RageMP131.exe (PID: 7568 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: A472AFB64B5C6F61AC63639FBD778001)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000006.00000003.2098792181.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000007.00000003.2097834723.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000008.00000003.2174447764.0000000004A00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000003.2036461002.0000000004A10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000A.00000003.2257587629.0000000004E30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: LisectAVT_2403002A_163.exe PID: 3140	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 5044	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 5012	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 7252	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 7568	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe, ProcessId: 3140, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T23:24:33.785844+0200
SID:	2046269
Source Port:	49705
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T23:24:39.989292+0200
SID:	2046269
Source Port:	49707
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 13.85.23.86 - Destination IP: 192.168.2.5

Timestamp:	2024-07-25T23:25:17.804075+0200
SID:	2022930
Source Port:	443
Destination Port:	49716
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE RisePro TCP Heartbeat Packet - Source IP: 192.168.2.5 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T23:24:37.004080+0200
SID:	2049060
Source Port:	49707
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE RisePro TCP Heartbeat Packet - Source IP: 192.168.2.5 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T23:24:30.824970+0200
SID:	2049060
Source Port:	49705
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T23:24:48.317488+0200
SID:	2046269
Source Port:	49715
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T23:24:33.786068+0200
SID:	2046269
Source Port:	49706
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE RisePro TCP Heartbeat Packet - Source IP: 192.168.2.5 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T23:24:25.287527+0200
SID:	2049060
Source Port:	49704
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 13.85.23.86 - Destination IP: 192.168.2.5

Timestamp:	2024-07-25T23:24:39.689012+0200
SID:	2022930
Source Port:	443
Destination Port:	49708
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE RisePro TCP Heartbeat Packet - Source IP: 192.168.2.5 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T23:24:30.827995+0200
SID:	2049060
Source Port:	49706
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 193.233.132.74

Timestamp:	2024-07-25T23:24:28.254825+0200
SID:	2046269
Source Port:	49704
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: LisectAVT_2403002A_163.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: LisectAVT_2403002A_163.exe

Joe Sandbox ML: detected

Source: LisectAVT_2403002A_163.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 193.233.132.74 ports 0,5,7,8,58709,9

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 193.233.132.74:58709

Source: Joe Sandbox View

IP Address: 193.233.132.74 193.233.132.74

Source: Joe Sandbox View

ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU

Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.74

Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe

Code function: 0_2_0003E0A0 recv,setsockopt,WSAStartup,closesocket,socket,connect,closesocket,

0_2_0003E0A0

Source: LisectAVT_2403002A_163.exe, 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, LisectAVT_2403002A_163.exe, 00000000.00000003.2036461002.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2098792181.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000003.2097834723.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2174447764.0000000004A00000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000003.2257587629.0000000004E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: LisectAVT_2403002A_163.exe, 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, LisectAVT_2403002A_163.exe, 00000000.00000003.2036461002.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2098792181.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000003.2097834723.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2174447764.0000000004A00000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000003.2257587629.0000000004E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: LisectAVT_2403002A_163.exe, 00000000.00000002.4499442748.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.4499466734.00000000015BD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.4499103991.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.4498783291.0000000000B3E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.4499262309.00000000011AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT

System Summary

PE file contains section with special chars

Source: LisectAVT_2403002A_163.exe	Static PE information: section name:
Source: LisectAVT_2403002A_163.exe	Static PE information: section name: .idata
Source: LisectAVT_2403002A_163.exe	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name: .idata
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name: .idata
Source: MPGPH131.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Code function: 0_2_00119824	0_2_00119824
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Code function: 0_2_000A9880	0_2_000A9880
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Code function: 0_2_000950B0	0_2_000950B0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Code function: 0_2_000291A0	0_2_000291A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Code function: 0_2_000973F0	0_2_000973F0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Code function: 0_2_0010646A	0_2_0010646A
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Code function: 0_2_001084A0	0_2_001084A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Code function: 0_2_00102CE0	0_2_00102CE0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Code function: 0_2_000224F0	0_2_000224F0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Code function: 0_2_000A6550	0_2_000A6550
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Code function: 0_2_00028D70	0_2_00028D70
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Code function: 0_2_000A55B0	0_2_000A55B0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Code function: 0_2_0010BEAF	0_2_0010BEAF
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Code function: 0_2_00039F50	0_2_00039F50
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002C9824	6_2_002C9824
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002450B0	6_2_002450B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00259880	6_2_00259880
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_001D91A0	6_2_001D91A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002473F0	6_2_002473F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002B646A	6_2_002B646A
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002B84A0	6_2_002B84A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002B2CE0	6_2_002B2CE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_001D24F0	6_2_001D24F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_001D8D70	6_2_001D8D70
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00256550	6_2_00256550
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002555B0	6_2_002555B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002BBEAF	6_2_002BBEAF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_001E9F50	6_2_001E9F50
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002CF771	6_2_002CF771
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_002C9824	7_2_002C9824
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_002450B0	7_2_002450B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00259880	7_2_00259880
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_001D91A0	7_2_001D91A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_002473F0	7_2_002473F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_002B646A	7_2_002B646A
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_002B84A0	7_2_002B84A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_002B2CE0	7_2_002B2CE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_001D24F0	7_2_001D24F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_001D8D70	7_2_001D8D70
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00256550	7_2_00256550
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_002555B0	7_2_002555B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_002BBEAF	7_2_002BBEAF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_001E9F50	7_2_001E9F50
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_002CF771	7_2_002CF771
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00229824	8_2_00229824
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_001B9880	8_2_001B9880
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_001A50B0	8_2_001A50B0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_001391A0	8_2_001391A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_001A73F0	8_2_001A73F0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_0021646A	8_2_0021646A
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_002184A0	8_2_002184A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00212CE0	8_2_00212CE0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_001324F0	8_2_001324F0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_001B6550	8_2_001B6550
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00138D70	8_2_00138D70
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_001B55B0	8_2_001B55B0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_0021BEAF	8_2_0021BEAF
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00149F50	8_2_00149F50
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_0022F771	8_2_0022F771
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00229824	10_2_00229824
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_001B9880	10_2_001B9880
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_001A50B0	10_2_001A50B0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_001391A0	10_2_001391A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_001A73F0	10_2_001A73F0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_0021646A	10_2_0021646A
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_002184A0	10_2_002184A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00212CE0	10_2_00212CE0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_001324F0	10_2_001324F0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_001B6550	10_2_001B6550
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00138D70	10_2_00138D70
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_001B55B0	10_2_001B55B0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_0021BEAF	10_2_0021BEAF
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00149F50	10_2_00149F50
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_0022F771	10_2_0022F771

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 002AFED0 appears 52 times
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: String function: 0020FED0 appears 52 times

Source: LisectAVT_2403002A_163.exe, 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamefilezilla.exe4 vs LisectAVT_2403002A_163.exe
Source: LisectAVT_2403002A_163.exe, 00000000.00000002.4499034537.0000000000C90000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefilezilla.exe4 vs LisectAVT_2403002A_163.exe
Source: LisectAVT_2403002A_163.exe	Binary or memory string: OriginalFilenamefilezilla.exe4 vs LisectAVT_2403002A_163.exe

Source: LisectAVT_2403002A_163.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: LisectAVT_2403002A_163.exe	Static PE information: Section: ZLIB complexity 0.9988822375541125
Source: LisectAVT_2403002A_163.exe	Static PE information: Section: jgtpuhbl ZLIB complexity 0.9899673103726526
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9988822375541125
Source: RageMP131.exe.0.dr	Static PE information: Section: jgtpuhbl ZLIB complexity 0.9899673103726526
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9988822375541125
Source: MPGPH131.exe.0.dr	Static PE information: Section: jgtpuhbl ZLIB complexity 0.9899673103726526

Source: classification engine

Classification label: mal100.troj.evad.winEXE@11/5@0/1

Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe

File created: C:\Users\user\AppData\Local\RageMP131

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2380:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5800:120:WilError_03

Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe

File created: C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Jump to behavior

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Command line argument: nI-	6_2_002D48C0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Command line argument: nI-	7_2_002D48C0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Command line argument: nI#	8_2_002348C0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Command line argument: nI#	10_2_002348C0

Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: LisectAVT_2403002A_163.exe, 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, LisectAVT_2403002A_163.exe, 00000000.00000003.2036461002.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2098792181.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000003.2097834723.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2174447764.0000000004A00000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000003.2257587629.0000000004E30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: LisectAVT_2403002A_163.exe, 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, LisectAVT_2403002A_163.exe, 00000000.00000003.2036461002.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2098792181.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000003.2097834723.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2174447764.0000000004A00000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000003.2257587629.0000000004E30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

Source: LisectAVT_2403002A_163.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: MPGPH131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: MPGPH131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: RageMP131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: RageMP131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe

File read: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe "C:\Users\user\Desktop\LisectAVT_2403002A_163.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll	Jump to behavior

Source: LisectAVT_2403002A_163.exe

Static file information: File size 2345480 > 1048576

Source: LisectAVT_2403002A_163.exe

Static PE information: Raw size of jgtpuhbl is bigger than: 0x100000 < 0x1aa000

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Unpacked PE file: 0.2.LisectAVT_2403002A_163.exe.20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jgtpuhbl:EW;ikxokzqh:EW; vs :ER;.rsrc:W;.idata :W; :EW;jgtpuhbl:EW;ikxokzqh:EW;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 6.2.MPGPH131.exe.1d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jgtpuhbl:EW;ikxokzqh:EW; vs :ER;.rsrc:W;.idata :W; :EW;jgtpuhbl:EW;ikxokzqh:EW;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 7.2.MPGPH131.exe.1d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jgtpuhbl:EW;ikxokzqh:EW; vs :ER;.rsrc:W;.idata :W; :EW;jgtpuhbl:EW;ikxokzqh:EW;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 8.2.RageMP131.exe.130000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jgtpuhbl:EW;ikxokzqh:EW; vs :ER;.rsrc:W;.idata :W; :EW;jgtpuhbl:EW;ikxokzqh:EW;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 10.2.RageMP131.exe.130000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jgtpuhbl:EW;ikxokzqh:EW; vs :ER;.rsrc:W;.idata :W; :EW;jgtpuhbl:EW;ikxokzqh:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: ikxokzqh

Source: LisectAVT_2403002A_163.exe	Static PE information: real checksum: 0x242f5b should be: 0x242f63
Source: RageMP131.exe.0.dr	Static PE information: real checksum: 0x242f5b should be: 0x242f63
Source: MPGPH131.exe.0.dr	Static PE information: real checksum: 0x242f5b should be: 0x242f63

Source: LisectAVT_2403002A_163.exe	Static PE information: section name:
Source: LisectAVT_2403002A_163.exe	Static PE information: section name: .idata
Source: LisectAVT_2403002A_163.exe	Static PE information: section name:
Source: LisectAVT_2403002A_163.exe	Static PE information: section name: jgtpuhbl
Source: LisectAVT_2403002A_163.exe	Static PE information: section name: ikxokzqh
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name: .idata
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name: jgtpuhbl
Source: RageMP131.exe.0.dr	Static PE information: section name: ikxokzqh
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name: .idata
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name: jgtpuhbl
Source: MPGPH131.exe.0.dr	Static PE information: section name: ikxokzqh

Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Code function: 0_2_005C904D push ebp; mov dword ptr [esp], 3FDD6DE1h	0_2_005C9113
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Code function: 0_2_005C904D push 384CB050h; mov dword ptr [esp], ebx	0_2_005C9149
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Code function: 0_2_005C904D push 5C863602h; mov dword ptr [esp], ebx	0_2_005C918C
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Code function: 0_2_005C904D push 05098334h; mov dword ptr [esp], esi	0_2_005C91BA
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Code function: 0_2_005C9000 push edi; mov dword ptr [esp], 53F78224h	0_2_005C9001
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Code function: 0_2_005C9000 push edi; mov dword ptr [esp], edx	0_2_005C9041
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Code function: 0_2_005C9000 push ebp; mov dword ptr [esp], 3FDD6DE1h	0_2_005C9113
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Code function: 0_2_005C9000 push 384CB050h; mov dword ptr [esp], ebx	0_2_005C9149
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Code function: 0_2_005C9000 push 5C863602h; mov dword ptr [esp], ebx	0_2_005C918C
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Code function: 0_2_005C9000 push 05098334h; mov dword ptr [esp], esi	0_2_005C91BA
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Code function: 0_2_005C91CD push 491E841Dh; mov dword ptr [esp], eax	0_2_005C91F3
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Code function: 0_2_005C91CD push esi; mov dword ptr [esp], eax	0_2_005C92D1
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Code function: 0_2_005C91CD push edi; mov dword ptr [esp], eax	0_2_005C92FA
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Code function: 0_2_000FFA97 push ecx; ret	0_2_000FFAAA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0077904D push ebp; mov dword ptr [esp], 3FDD6DE1h	6_2_00779113
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0077904D push 384CB050h; mov dword ptr [esp], ebx	6_2_00779149
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0077904D push 5C863602h; mov dword ptr [esp], ebx	6_2_0077918C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0077904D push 05098334h; mov dword ptr [esp], esi	6_2_007791BA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00779000 push edi; mov dword ptr [esp], 53F78224h	6_2_00779001
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00779000 push edi; mov dword ptr [esp], edx	6_2_00779041
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00779000 push ebp; mov dword ptr [esp], 3FDD6DE1h	6_2_00779113
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00779000 push 384CB050h; mov dword ptr [esp], ebx	6_2_00779149
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00779000 push 5C863602h; mov dword ptr [esp], ebx	6_2_0077918C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00779000 push 05098334h; mov dword ptr [esp], esi	6_2_007791BA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_007791CD push 491E841Dh; mov dword ptr [esp], eax	6_2_007791F3
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_007791CD push esi; mov dword ptr [esp], eax	6_2_007792D1
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_007791CD push edi; mov dword ptr [esp], eax	6_2_007792FA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002AFA97 push ecx; ret	6_2_002AFAAA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_0077904D push ebp; mov dword ptr [esp], 3FDD6DE1h	7_2_00779113
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_0077904D push 384CB050h; mov dword ptr [esp], ebx	7_2_00779149
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_0077904D push 5C863602h; mov dword ptr [esp], ebx	7_2_0077918C

Source: LisectAVT_2403002A_163.exe	Static PE information: section name: entropy: 7.977067116075123
Source: LisectAVT_2403002A_163.exe	Static PE information: section name: jgtpuhbl entropy: 7.950675403597083
Source: RageMP131.exe.0.dr	Static PE information: section name: entropy: 7.977067116075123
Source: RageMP131.exe.0.dr	Static PE information: section name: jgtpuhbl entropy: 7.950675403597083
Source: MPGPH131.exe.0.dr	Static PE information: section name: entropy: 7.977067116075123
Source: MPGPH131.exe.0.dr	Static PE information: section name: jgtpuhbl entropy: 7.950675403597083

Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe			Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe			Jump to dropped file

Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe

File created: C:\ProgramData\MPGPH131\MPGPH131.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window searched: window name: Regmonclass	Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep	graph_6-18525
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep	graph_8-21688
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep	graph_0-20219

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 1602B5 second address: 1602BF instructions: 0x00000000 rdtsc 0x00000002 jno 00007FFBA56586D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 1602BF second address: 1602C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2E531E second address: 2E5324 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2E5324 second address: 2E5339 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007FFBA4B43D9Bh 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2E44EF second address: 2E44F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2E44F4 second address: 2E44FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2E44FA second address: 2E4500 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2E4684 second address: 2E468E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2E4A9D second address: 2E4AB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007FFBA56586D6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2E4AB9 second address: 2E4AD4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FFBA4B43DA5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2E4AD4 second address: 2E4ADE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FFBA56586D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2DAEE6 second address: 2DAEFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 jmp 00007FFBA4B43D9Dh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2E82BD second address: 2E82D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFBA56586E5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2E82D6 second address: 2E82DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2E82DA second address: 2E82F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FFBA56586E4h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2E82F9 second address: 2E8328 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FFBA4B43D96h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push ecx 0x00000013 push eax 0x00000014 pushad 0x00000015 popad 0x00000016 pop eax 0x00000017 pop ecx 0x00000018 mov eax, dword ptr [eax] 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d jp 00007FFBA4B43D96h 0x00000023 jmp 00007FFBA4B43D9Bh 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2E839E second address: 2E83A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2E83A4 second address: 2E83A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2E84F4 second address: 2E84FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2E84FA second address: 2E84FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2E84FE second address: 2E854C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push edi 0x0000000c call 00007FFBA56586D8h 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], edi 0x00000016 add dword ptr [esp+04h], 0000001Ch 0x0000001e inc edi 0x0000001f push edi 0x00000020 ret 0x00000021 pop edi 0x00000022 ret 0x00000023 mov dx, 734Fh 0x00000027 mov dword ptr [ebp+122D1936h], edx 0x0000002d push 00000000h 0x0000002f mov dword ptr [ebp+122D21C3h], edi 0x00000035 push D79DC504h 0x0000003a push eax 0x0000003b push edx 0x0000003c js 00007FFBA56586D8h 0x00000042 pushad 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2E854C second address: 2E85B8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 28623B7Ch 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007FFBA4B43D98h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 0000001Bh 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 and edi, dword ptr [ebp+122D227Fh] 0x0000002f push 00000003h 0x00000031 push ecx 0x00000032 mov cx, 6852h 0x00000036 pop edi 0x00000037 xor dword ptr [ebp+122D182Ah], ecx 0x0000003d push 00000000h 0x0000003f jmp 00007FFBA4B43DA2h 0x00000044 push 00000003h 0x00000046 or edi, dword ptr [ebp+122D38F2h] 0x0000004c push A696F425h 0x00000051 pushad 0x00000052 push eax 0x00000053 push edx 0x00000054 push ebx 0x00000055 pop ebx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2E85B8 second address: 2E85CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2E85CE second address: 2E8600 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xor dword ptr [esp], 6696F425h 0x0000000e mov edx, esi 0x00000010 lea ebx, dword ptr [ebp+1245C21Ch] 0x00000016 jmp 00007FFBA4B43DA6h 0x0000001b push eax 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2E8600 second address: 2E8604 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 309BBC second address: 309BC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 307A46 second address: 307A51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 307A51 second address: 307A59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 307A59 second address: 307A9D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FFBA56586E7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push esi 0x0000000e jmp 00007FFBA56586DEh 0x00000013 pushad 0x00000014 jmp 00007FFBA56586E3h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 307A9D second address: 307AA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FFBA4B43D96h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 307C24 second address: 307C31 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FFBA56586D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 308188 second address: 308192 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FFBA4B43D96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 308192 second address: 308198 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 308198 second address: 3081B0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FFBA4B43D9Eh 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3081B0 second address: 3081BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FFBA56586D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3089B6 second address: 3089D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA6h 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007FFBA4B43D96h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3089D8 second address: 3089DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3089DC second address: 3089E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 308B10 second address: 308B14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 308B14 second address: 308B18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 308B18 second address: 308B1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2FFC5A second address: 2FFC78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FFBA4B43DA0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2FFC78 second address: 2FFC7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3093F8 second address: 309408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ebx 0x00000007 jg 00007FFBA4B43D9Eh 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 309542 second address: 309546 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 309546 second address: 30954A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 30954A second address: 309578 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBA56586DDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FFBA56586E3h 0x00000010 push eax 0x00000011 push edx 0x00000012 jng 00007FFBA56586D6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 309578 second address: 309584 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 309584 second address: 30959A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FFBA56586D6h 0x0000000a jmp 00007FFBA56586DBh 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 30959A second address: 3095B6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FFBA4B43DA7h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 30AFBC second address: 30AFC6 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FFBA56586D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 30AFC6 second address: 30AFCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 30BF94 second address: 30BF9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2D28D4 second address: 2D28E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FFBA4B43D96h 0x0000000a pushad 0x0000000b popad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f push edi 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2D28E8 second address: 2D28ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 315180 second address: 315191 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FFBA4B43D96h 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 315191 second address: 315195 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 315195 second address: 31519B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 31519B second address: 3151A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pop edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3151A7 second address: 3151AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3151AD second address: 3151B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FFBA56586D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 31455C second address: 314561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 314561 second address: 3145A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FFBA56586E9h 0x0000000a jmp 00007FFBA56586E5h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jnl 00007FFBA56586D6h 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3145A1 second address: 3145BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43D9Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3145BB second address: 3145C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3145C0 second address: 3145C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3145C6 second address: 3145CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 314701 second address: 314712 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FFBA4B43D96h 0x00000009 jng 00007FFBA4B43D96h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 31482C second address: 314831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 31497C second address: 3149CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007FFBA4B43DA9h 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007FFBA4B43DA1h 0x00000017 pop ecx 0x00000018 jmp 00007FFBA4B43DA9h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 314FF9 second address: 315001 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3170EF second address: 317101 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FFBA4B43D9Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 31715F second address: 31717B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 317574 second address: 317579 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 31765D second address: 317686 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007FFBA56586D6h 0x00000009 jmp 00007FFBA56586E6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 317D18 second address: 317D1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 317DF0 second address: 317DF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3186DE second address: 318767 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FFBA4B43D9Eh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e cmc 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007FFBA4B43D98h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b mov dword ptr [ebp+122D29BFh], esi 0x00000031 pushad 0x00000032 mov dword ptr [ebp+122D1A60h], eax 0x00000038 mov dword ptr [ebp+122D277Bh], ebx 0x0000003e popad 0x0000003f push 00000000h 0x00000041 add dword ptr [ebp+122D22E1h], ecx 0x00000047 push eax 0x00000048 pushad 0x00000049 pushad 0x0000004a jnl 00007FFBA4B43D96h 0x00000050 jmp 00007FFBA4B43D9Ch 0x00000055 popad 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007FFBA4B43DA9h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2CA1C7 second address: 2CA21B instructions: 0x00000000 rdtsc 0x00000002 jc 00007FFBA56586D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FFBA56586E2h 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007FFBA56586DDh 0x00000019 popad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d jg 00007FFBA56586E2h 0x00000023 pushad 0x00000024 jo 00007FFBA56586D6h 0x0000002a jnc 00007FFBA56586D6h 0x00000030 push esi 0x00000031 pop esi 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 319018 second address: 319025 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 31A851 second address: 31A855 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 31B8FF second address: 31B95F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp], eax 0x0000000a push eax 0x0000000b mov esi, 48738222h 0x00000010 pop esi 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007FFBA4B43D98h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 0000001Ch 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d mov esi, dword ptr [ebp+122D3966h] 0x00000033 mov di, dx 0x00000036 push 00000000h 0x00000038 mov si, 765Ch 0x0000003c push eax 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007FFBA4B43DA6h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 31B038 second address: 31B041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 31B041 second address: 31B045 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 31C3A5 second address: 31C3BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 31E3AD second address: 31E420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebp 0x0000000a call 00007FFBA4B43D98h 0x0000000f pop ebp 0x00000010 mov dword ptr [esp+04h], ebp 0x00000014 add dword ptr [esp+04h], 00000016h 0x0000001c inc ebp 0x0000001d push ebp 0x0000001e ret 0x0000001f pop ebp 0x00000020 ret 0x00000021 jno 00007FFBA4B43D9Ch 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push eax 0x0000002c call 00007FFBA4B43D98h 0x00000031 pop eax 0x00000032 mov dword ptr [esp+04h], eax 0x00000036 add dword ptr [esp+04h], 0000001Ah 0x0000003e inc eax 0x0000003f push eax 0x00000040 ret 0x00000041 pop eax 0x00000042 ret 0x00000043 movsx edi, ax 0x00000046 push 00000000h 0x00000048 mov edi, dword ptr [ebp+122D3942h] 0x0000004e xchg eax, ebx 0x0000004f push eax 0x00000050 push edx 0x00000051 push ebx 0x00000052 jmp 00007FFBA4B43D9Eh 0x00000057 pop ebx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 31EF14 second address: 31EF18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 31EF18 second address: 31EF52 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007FFBA4B43D98h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 push 00000000h 0x00000026 mov si, FE8Ah 0x0000002a push 00000000h 0x0000002c jl 00007FFBA4B43D97h 0x00000032 cmc 0x00000033 push eax 0x00000034 push esi 0x00000035 pushad 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 323B39 second address: 323B3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 324A14 second address: 324A1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 324A1D second address: 324AB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007FFBA56586D8h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 jmp 00007FFBA56586E0h 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push edx 0x0000002f call 00007FFBA56586D8h 0x00000034 pop edx 0x00000035 mov dword ptr [esp+04h], edx 0x00000039 add dword ptr [esp+04h], 00000014h 0x00000041 inc edx 0x00000042 push edx 0x00000043 ret 0x00000044 pop edx 0x00000045 ret 0x00000046 jmp 00007FFBA56586DFh 0x0000004b mov edi, dword ptr [ebp+122D3205h] 0x00000051 push 00000000h 0x00000053 or ebx, dword ptr [ebp+122D390Eh] 0x00000059 push eax 0x0000005a push edi 0x0000005b pushad 0x0000005c jmp 00007FFBA56586E0h 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 324C4E second address: 324C52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 324C52 second address: 324C58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 324C58 second address: 324C62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FFBA4B43D96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 324C62 second address: 324CEE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b sub dword ptr [ebp+122D1ED9h], ecx 0x00000011 push dword ptr fs:[00000000h] 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b call 00007FFBA56586D8h 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], esi 0x00000025 add dword ptr [esp+04h], 00000014h 0x0000002d inc esi 0x0000002e push esi 0x0000002f ret 0x00000030 pop esi 0x00000031 ret 0x00000032 ja 00007FFBA56586DEh 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f push 00000000h 0x00000041 push ebx 0x00000042 call 00007FFBA56586D8h 0x00000047 pop ebx 0x00000048 mov dword ptr [esp+04h], ebx 0x0000004c add dword ptr [esp+04h], 0000001Ah 0x00000054 inc ebx 0x00000055 push ebx 0x00000056 ret 0x00000057 pop ebx 0x00000058 ret 0x00000059 mov eax, dword ptr [ebp+122D0321h] 0x0000005f jmp 00007FFBA56586DEh 0x00000064 push FFFFFFFFh 0x00000066 push edi 0x00000067 mov di, ax 0x0000006a pop ebx 0x0000006b nop 0x0000006c push edx 0x0000006d push eax 0x0000006e push edx 0x0000006f push ebx 0x00000070 pop ebx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 326BA4 second address: 326BBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBA4B43DA2h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 326BBB second address: 326C45 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnc 00007FFBA56586D6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov bl, cl 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007FFBA56586D8h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 0000001Ah 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d jp 00007FFBA56586DCh 0x00000033 call 00007FFBA56586E2h 0x00000038 xor ebx, dword ptr [ebp+122D1B94h] 0x0000003e pop ebx 0x0000003f push 00000000h 0x00000041 push 00000000h 0x00000043 push esi 0x00000044 call 00007FFBA56586D8h 0x00000049 pop esi 0x0000004a mov dword ptr [esp+04h], esi 0x0000004e add dword ptr [esp+04h], 0000001Bh 0x00000056 inc esi 0x00000057 push esi 0x00000058 ret 0x00000059 pop esi 0x0000005a ret 0x0000005b cld 0x0000005c push eax 0x0000005d pushad 0x0000005e push eax 0x0000005f push edx 0x00000060 js 00007FFBA56586D6h 0x00000066 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 327DB6 second address: 327DBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 326E86 second address: 326E8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 326E8A second address: 326E8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 328DA9 second address: 328DAE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 329C5C second address: 329CF9 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FFBA4B43D9Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007FFBA4B43D98h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push ecx 0x0000002c call 00007FFBA4B43D98h 0x00000031 pop ecx 0x00000032 mov dword ptr [esp+04h], ecx 0x00000036 add dword ptr [esp+04h], 00000018h 0x0000003e inc ecx 0x0000003f push ecx 0x00000040 ret 0x00000041 pop ecx 0x00000042 ret 0x00000043 mov dword ptr [ebp+122D1DF0h], eax 0x00000049 add dword ptr [ebp+1246EAA4h], edi 0x0000004f push 00000000h 0x00000051 push 00000000h 0x00000053 push edi 0x00000054 call 00007FFBA4B43D98h 0x00000059 pop edi 0x0000005a mov dword ptr [esp+04h], edi 0x0000005e add dword ptr [esp+04h], 00000016h 0x00000066 inc edi 0x00000067 push edi 0x00000068 ret 0x00000069 pop edi 0x0000006a ret 0x0000006b and bx, 07D1h 0x00000070 mov edi, 62C3974Bh 0x00000075 push eax 0x00000076 pushad 0x00000077 push eax 0x00000078 push edx 0x00000079 jmp 00007FFBA4B43D9Bh 0x0000007e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 32AB97 second address: 32AB9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 32AD64 second address: 32AE0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FFBA4B43D96h 0x0000000a popad 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007FFBA4B43D98h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 0000001Ch 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 push dword ptr fs:[00000000h] 0x00000030 push 00000000h 0x00000032 push edi 0x00000033 call 00007FFBA4B43D98h 0x00000038 pop edi 0x00000039 mov dword ptr [esp+04h], edi 0x0000003d add dword ptr [esp+04h], 0000001Ah 0x00000045 inc edi 0x00000046 push edi 0x00000047 ret 0x00000048 pop edi 0x00000049 ret 0x0000004a jmp 00007FFBA4B43D9Ch 0x0000004f mov dword ptr fs:[00000000h], esp 0x00000056 mov dword ptr [ebp+122D1895h], eax 0x0000005c mov eax, dword ptr [ebp+122D0AB1h] 0x00000062 sub edi, 47259E6Dh 0x00000068 push FFFFFFFFh 0x0000006a call 00007FFBA4B43DA4h 0x0000006f mov ebx, dword ptr [ebp+122D233Eh] 0x00000075 pop edi 0x00000076 mov bx, dx 0x00000079 nop 0x0000007a pushad 0x0000007b push eax 0x0000007c push edx 0x0000007d jne 00007FFBA4B43D96h 0x00000083 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 32CA86 second address: 32CA90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FFBA56586D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 32CA90 second address: 32CADA instructions: 0x00000000 rdtsc 0x00000002 ja 00007FFBA4B43D96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jng 00007FFBA4B43DA8h 0x00000013 nop 0x00000014 mov dword ptr [ebp+122D2821h], esi 0x0000001a push 00000000h 0x0000001c clc 0x0000001d push 00000000h 0x0000001f sbb edi, 63CCE357h 0x00000025 xchg eax, esi 0x00000026 jmp 00007FFBA4B43D9Ch 0x0000002b push eax 0x0000002c push eax 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 328F27 second address: 328F2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 32BCF5 second address: 32BCFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 32EB5F second address: 32EB64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 32DCB8 second address: 32DCD1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jbe 00007FFBA4B43D96h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 jnl 00007FFBA4B43D96h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 32ECD8 second address: 32ECDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 32ECDC second address: 32ED66 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43D9Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a mov dword ptr [esp], eax 0x0000000d push dword ptr fs:[00000000h] 0x00000014 jp 00007FFBA4B43D9Ch 0x0000001a mov dword ptr fs:[00000000h], esp 0x00000021 push 00000000h 0x00000023 push edx 0x00000024 call 00007FFBA4B43D98h 0x00000029 pop edx 0x0000002a mov dword ptr [esp+04h], edx 0x0000002e add dword ptr [esp+04h], 00000016h 0x00000036 inc edx 0x00000037 push edx 0x00000038 ret 0x00000039 pop edx 0x0000003a ret 0x0000003b mov eax, dword ptr [ebp+122D0191h] 0x00000041 mov bh, D5h 0x00000043 push FFFFFFFFh 0x00000045 push 00000000h 0x00000047 push esi 0x00000048 call 00007FFBA4B43D98h 0x0000004d pop esi 0x0000004e mov dword ptr [esp+04h], esi 0x00000052 add dword ptr [esp+04h], 0000001Bh 0x0000005a inc esi 0x0000005b push esi 0x0000005c ret 0x0000005d pop esi 0x0000005e ret 0x0000005f stc 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007FFBA4B43D9Ah 0x00000068 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 32ED66 second address: 32ED6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 336252 second address: 33625D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 33625D second address: 336263 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 339355 second address: 33935A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 33E9C4 second address: 33E9CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 33E9CA second address: 33E9CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 33E9CF second address: 33E9EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFBA56586E7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 33E9EA second address: 33EA0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43D9Bh 0x00000007 jmp 00007FFBA4B43D9Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 33EA0E second address: 33EA12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 33EA12 second address: 33EA16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2C6AE3 second address: 2C6AF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586DCh 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2C6AF6 second address: 2C6AFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3400B2 second address: 3400D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBA56586E7h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3400D4 second address: 340102 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA3h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f pop eax 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FFBA4B43D9Dh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 340D24 second address: 340D2A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 340D2A second address: 340D35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FFBA4B43D96h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 340F20 second address: 340F25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 347934 second address: 347942 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007FFBA4B43D96h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3470AA second address: 3470AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3470AE second address: 3470C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBA4B43DA0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3470C8 second address: 3470D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FFBA56586D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 347391 second address: 347397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3474C6 second address: 3474E9 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FFBA56586D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FFBA56586DFh 0x00000011 js 00007FFBA56586DEh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 34F7E2 second address: 34F7E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 34F7E8 second address: 34F80B instructions: 0x00000000 rdtsc 0x00000002 jno 00007FFBA56586D6h 0x00000008 jmp 00007FFBA56586E4h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ecx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 34F80B second address: 34F816 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 34F816 second address: 34F834 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FFBA56586E7h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 34F834 second address: 34F866 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA7h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jne 00007FFBA4B43D96h 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FFBA4B43D9Bh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 34FB06 second address: 34FB2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007FFBA56586E2h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 34FB2A second address: 34FB30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 34FFED second address: 34FFFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 35024D second address: 35025F instructions: 0x00000000 rdtsc 0x00000002 jl 00007FFBA4B43D96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jbe 00007FFBA4B43D98h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3503D9 second address: 3503DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3503DD second address: 3503E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3503E8 second address: 3503EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3503EC second address: 3503F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3507E5 second address: 3507EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3507EB second address: 3507F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3507F1 second address: 3507F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 35721C second address: 357233 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFBA4B43DA3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 355D06 second address: 355D12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pushad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 355D12 second address: 355D25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FFBA4B43D9Ah 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 355D25 second address: 355D33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBA56586DAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 35606A second address: 35606E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 35606E second address: 35607E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007FFBA56586D6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 35607E second address: 356082 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 356082 second address: 356095 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007FFBA56586D6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 356095 second address: 3560BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43D9Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jmp 00007FFBA4B43DA8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3560BF second address: 3560C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3560C5 second address: 3560CF instructions: 0x00000000 rdtsc 0x00000002 jc 00007FFBA4B43D9Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 35650A second address: 35650E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 35650E second address: 356516 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3568FD second address: 356903 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 356903 second address: 356923 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 356923 second address: 356927 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 356927 second address: 35692B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 35692B second address: 356931 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2CA207 second address: 2CA21B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jo 00007FFBA4B43D96h 0x0000000b jnc 00007FFBA4B43D96h 0x00000011 push esi 0x00000012 pop esi 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 31594D second address: 315963 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jno 00007FFBA56586D6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jbe 00007FFBA56586D6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 315963 second address: 3159B2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 push esi 0x00000009 mov dword ptr [ebp+122D1BB2h], edx 0x0000000f pop edx 0x00000010 lea eax, dword ptr [ebp+124896CCh] 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007FFBA4B43D98h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 0000001Ch 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 add dword ptr [ebp+122D2A32h], esi 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 jng 00007FFBA4B43D9Ch 0x0000003f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3159B2 second address: 2FFC5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FFBA56586D6h 0x00000009 jc 00007FFBA56586D6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov dword ptr [esp], eax 0x00000015 mov ch, A2h 0x00000017 call dword ptr [ebp+122D1DEBh] 0x0000001d push ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 jp 00007FFBA56586D6h 0x00000026 jne 00007FFBA56586D6h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 315B1A second address: 315B31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFBA4B43DA3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 31605F second address: 31608F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 add dword ptr [esp], 0C07AFBBh 0x0000000d sub dword ptr [ebp+122D1C25h], esi 0x00000013 call 00007FFBA56586D9h 0x00000018 push ecx 0x00000019 jns 00007FFBA56586D8h 0x0000001f pushad 0x00000020 popad 0x00000021 pop ecx 0x00000022 push eax 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 jng 00007FFBA56586D6h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 31608F second address: 316093 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 316093 second address: 31609D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 31609D second address: 3160A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3160A1 second address: 3160B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3160B1 second address: 3160CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jno 00007FFBA4B43D96h 0x0000000d jnp 00007FFBA4B43D96h 0x00000013 popad 0x00000014 popad 0x00000015 mov eax, dword ptr [eax] 0x00000017 push eax 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 316190 second address: 31619A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3165C1 second address: 3165E6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FFBA4B43D9Dh 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e jmp 00007FFBA4B43D9Dh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 35AC67 second address: 35AC6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 35AC6B second address: 35AC71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 35AFCC second address: 35B001 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 je 00007FFBA56586D6h 0x0000000b jno 00007FFBA56586D6h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FFBA56586DDh 0x0000001b jnp 00007FFBA56586E2h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 35B15E second address: 35B198 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBA4B43DA3h 0x00000009 push esi 0x0000000a pop esi 0x0000000b jnc 00007FFBA4B43D96h 0x00000011 popad 0x00000012 je 00007FFBA4B43DAAh 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007FFBA4B43DA2h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 35B198 second address: 35B19D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 35B438 second address: 35B43E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 35B43E second address: 35B444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 35B444 second address: 35B47E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 je 00007FFBA4B43D96h 0x0000000c ja 00007FFBA4B43D96h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pop esi 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 push eax 0x0000001a pop eax 0x0000001b jl 00007FFBA4B43D96h 0x00000021 pushad 0x00000022 popad 0x00000023 popad 0x00000024 jmp 00007FFBA4B43DA6h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 35B47E second address: 35B494 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FFBA56586DAh 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007FFBA56586D6h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 35B723 second address: 35B733 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007FFBA4B43D96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 35EE95 second address: 35EEB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ebx 0x00000007 jng 00007FFBA56586E9h 0x0000000d jmp 00007FFBA56586DDh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 35EEB1 second address: 35EEBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jng 00007FFBA4B43D96h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 35EEBE second address: 35EEE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBA56586E7h 0x00000009 popad 0x0000000a jo 00007FFBA56586DEh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 35EEE2 second address: 35EEEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 35EEEE second address: 35EEF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 35EEF2 second address: 35EEF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3617FA second address: 3617FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 361994 second address: 3619A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007FFBA4B43D96h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 361C47 second address: 361C55 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3643E1 second address: 364459 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jmp 00007FFBA4B43DA7h 0x00000012 popad 0x00000013 pushad 0x00000014 jmp 00007FFBA4B43DA7h 0x00000019 pushad 0x0000001a popad 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d jmp 00007FFBA4B43DA9h 0x00000022 popad 0x00000023 jns 00007FFBA4B43D9Ch 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 364459 second address: 36445D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 363F4E second address: 363F75 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FFBA4B43DADh 0x00000008 jmp 00007FFBA4B43DA1h 0x0000000d jc 00007FFBA4B43D96h 0x00000013 push eax 0x00000014 push edx 0x00000015 ja 00007FFBA4B43D96h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 363F75 second address: 363F79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 368265 second address: 368277 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FFBA4B43D9Dh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 368277 second address: 3682BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jp 00007FFBA56586DCh 0x0000000b jnl 00007FFBA56586D6h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jmp 00007FFBA56586E8h 0x0000001b pushad 0x0000001c popad 0x0000001d push esi 0x0000001e pop esi 0x0000001f jc 00007FFBA56586D6h 0x00000025 popad 0x00000026 jmp 00007FFBA56586DEh 0x0000002b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3682BE second address: 3682CE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 jns 00007FFBA4B43D96h 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3682CE second address: 3682D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3682D4 second address: 3682D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2DE40A second address: 2DE424 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FFBA56586E4h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2DE424 second address: 2DE429 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 367C54 second address: 367C58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 367C58 second address: 367C73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43D9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007FFBA4B43D9Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 367C73 second address: 367C77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 367C77 second address: 367C9B instructions: 0x00000000 rdtsc 0x00000002 jp 00007FFBA4B43D98h 0x00000008 push eax 0x00000009 jmp 00007FFBA4B43DA7h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 367F8C second address: 367F91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 36BD02 second address: 36BD0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FFBA4B43D96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 36BD0C second address: 36BD10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 371D19 second address: 371D28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FFBA4B43D96h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 371D28 second address: 371D38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBA56586DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 371D38 second address: 371D56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007FFBA4B43DA5h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 371D56 second address: 371D65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007FFBA56586D6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 371D65 second address: 371D69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3706A5 second address: 3706AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3706AB second address: 3706AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 370C8F second address: 370C99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FFBA56586D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3160E2 second address: 3160E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3160E6 second address: 3160EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 370E36 second address: 370E3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 370F95 second address: 370F9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 370F9B second address: 370FC4 instructions: 0x00000000 rdtsc 0x00000002 js 00007FFBA4B43D96h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 jmp 00007FFBA4B43DA9h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 370FC4 second address: 370FC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3780B3 second address: 3780C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43D9Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a pushad 0x0000000b popad 0x0000000c push edx 0x0000000d pop edx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3780C7 second address: 3780D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586DDh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3787A6 second address: 3787B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FFBA4B43D96h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3787B1 second address: 3787CB instructions: 0x00000000 rdtsc 0x00000002 jns 00007FFBA56586DCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push edx 0x0000000c jg 00007FFBA56586D6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 378D0E second address: 378D17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 378D17 second address: 378D1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 378D1D second address: 378D31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBA4B43D9Fh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 37908F second address: 379095 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 37E04C second address: 37E052 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2C86C0 second address: 2C86C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 386948 second address: 386964 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43D9Ch 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jp 00007FFBA4B43D96h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 386964 second address: 386968 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 385A8C second address: 385A9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 385A9C second address: 385AA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 385C43 second address: 385C61 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FFBA4B43D96h 0x00000008 jno 00007FFBA4B43D96h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 js 00007FFBA4B43D98h 0x00000016 push edi 0x00000017 pop edi 0x00000018 push eax 0x00000019 push edx 0x0000001a push edx 0x0000001b pop edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 385EF9 second address: 385F02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 385F02 second address: 385F1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBA4B43DA4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 385F1A second address: 385F26 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 385F26 second address: 385F2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 38609A second address: 3860A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 386204 second address: 386208 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3865FD second address: 386602 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 386602 second address: 386607 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 38D5EA second address: 38D5EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 38D5EF second address: 38D5F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 38D5F4 second address: 38D608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBA56586DCh 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 38DC96 second address: 38DC9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 38F0D2 second address: 38F0D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 38F0D6 second address: 38F0DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 38D04B second address: 38D05D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edx 0x00000006 jmp 00007FFBA56586DAh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 395D0C second address: 395D12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 395D12 second address: 395D22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007FFBA56586D6h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 395D22 second address: 395D2C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FFBA4B43D96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 2DFF52 second address: 2DFF5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FFBA56586D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 39568C second address: 3956B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FFBA4B43DA1h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3956B6 second address: 3956D7 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FFBA56586EBh 0x00000008 jmp 00007FFBA56586E5h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3956D7 second address: 3956DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 39582E second address: 39585A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007FFBA56586D8h 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 je 00007FFBA56586D6h 0x00000019 push edx 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3959A6 second address: 3959CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43D9Ah 0x00000007 jmp 00007FFBA4B43DA4h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3959CB second address: 3959D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3A146D second address: 3A149A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FFBA4B43DA6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jbe 00007FFBA4B43DA1h 0x00000011 jmp 00007FFBA4B43D9Bh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3A149A second address: 3A14E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586E8h 0x00000007 jmp 00007FFBA56586E4h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jnp 00007FFBA56586F9h 0x00000014 jmp 00007FFBA56586E1h 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3A14E4 second address: 3A14EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3A1660 second address: 3A167B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBA56586E6h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3A545F second address: 3A5492 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jl 00007FFBA4B43D96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jno 00007FFBA4B43D9Ch 0x00000012 pushad 0x00000013 jo 00007FFBA4B43D96h 0x00000019 jnl 00007FFBA4B43D96h 0x0000001f push edi 0x00000020 pop edi 0x00000021 pushad 0x00000022 popad 0x00000023 popad 0x00000024 push ecx 0x00000025 jnp 00007FFBA4B43D96h 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3A5492 second address: 3A549C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3B08BF second address: 3B08C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3B08C6 second address: 3B08CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3B5737 second address: 3B573B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3BF94A second address: 3BF950 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3BE6D0 second address: 3BE6DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FFBA4B43D96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3BE9C8 second address: 3BE9EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBA56586E6h 0x00000009 jbe 00007FFBA56586D6h 0x0000000f push edx 0x00000010 pop edx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3BE9EB second address: 3BEA04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FFBA4B43DA4h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3BEA04 second address: 3BEA12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnp 00007FFBA56586D6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3BEB93 second address: 3BEBA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FFBA4B43D96h 0x0000000a popad 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3BEBA4 second address: 3BEBC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FFBA56586D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FFBA56586E5h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3BEBC8 second address: 3BEBCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3BEBCC second address: 3BEBD2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3C32AE second address: 3C32B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3C32B2 second address: 3C32EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jc 00007FFBA56586D6h 0x0000000b jmp 00007FFBA56586DDh 0x00000010 popad 0x00000011 jmp 00007FFBA56586E7h 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push edx 0x0000001b jg 00007FFBA56586D6h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3C32EF second address: 3C32F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3C2E03 second address: 3C2E07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3C2F99 second address: 3C2FA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FFBA4B43D9Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3C2FA9 second address: 3C2FDC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pop ecx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jng 00007FFBA56586DCh 0x00000015 push eax 0x00000016 push edx 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 jmp 00007FFBA56586E4h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3C2FDC second address: 3C2FE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3C2FE0 second address: 3C2FEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3C57B5 second address: 3C57E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBA4B43DA2h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FFBA4B43DA6h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3C57E6 second address: 3C57EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3C57EA second address: 3C57F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3C57F0 second address: 3C57F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3C57F6 second address: 3C57FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3D7416 second address: 3D7427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 ja 00007FFBA56586DEh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3D8A03 second address: 3D8A19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBA4B43DA2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3D8A19 second address: 3D8A28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586DBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3D34F9 second address: 3D34FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3D34FD second address: 3D3503 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3D3503 second address: 3D3510 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jg 00007FFBA4B43D96h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3E574E second address: 3E5775 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586DEh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007FFBA56586E0h 0x00000014 jmp 00007FFBA56586DAh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3E5775 second address: 3E5790 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FFBA4B43D96h 0x00000009 jmp 00007FFBA4B43DA0h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3E84B0 second address: 3E84BE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 3E84BE second address: 3E84C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 40C957 second address: 40C967 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FFBA56586D6h 0x00000008 jnl 00007FFBA56586D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 40C967 second address: 40C985 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43D9Dh 0x00000007 pushad 0x00000008 jne 00007FFBA4B43D96h 0x0000000e js 00007FFBA4B43D96h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 40C985 second address: 40C99C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a jng 00007FFBA56586D6h 0x00000010 jne 00007FFBA56586D6h 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 40C99C second address: 40C9A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007FFBA4B43D96h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 40CC50 second address: 40CC65 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586DFh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 40CC65 second address: 40CC6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 40CFA9 second address: 40CFB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 40CFB4 second address: 40CFBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FFBA4B43D96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 40D169 second address: 40D175 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FFBA56586D6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 40D175 second address: 40D17A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 40D2FC second address: 40D302 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 411B63 second address: 411B80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43D9Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FFBA4B43D9Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 411F46 second address: 411F4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 41372D second address: 413739 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FFBA4B43D96h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 413739 second address: 41373D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4B9003C second address: 4B90060 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FFBA4B43D9Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4B90060 second address: 4B90099 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 5A64h 0x00000007 mov edx, 0D8CB8D0h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 movsx edi, si 0x00000014 mov cl, DBh 0x00000016 popad 0x00000017 mov ebp, esp 0x00000019 jmp 00007FFBA56586E9h 0x0000001e pop ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4B90099 second address: 4B9009D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4B9009D second address: 4B900A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4B900A1 second address: 4B900A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4B900A7 second address: 4B900AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C00606 second address: 4C0060C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C0060C second address: 4C00610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4B80CB5 second address: 4B80CC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFBA4B43D9Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4B80CC7 second address: 4B80CE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FFBA56586DFh 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4B80CE5 second address: 4B80D26 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FFBA4B43D9Ch 0x00000013 and cl, 00000038h 0x00000016 jmp 00007FFBA4B43D9Bh 0x0000001b popfd 0x0000001c push eax 0x0000001d push edx 0x0000001e mov al, 1Fh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4B80D26 second address: 4B80D3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FFBA56586DAh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4B80D3B second address: 4B80D41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4B80D41 second address: 4B80D45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4B80D45 second address: 4B80D78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43D9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+04h] 0x0000000e pushad 0x0000000f movzx ecx, di 0x00000012 mov ebx, 340EBF0Ch 0x00000017 popad 0x00000018 push dword ptr [ebp+0Ch] 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FFBA4B43D9Eh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4B80DC0 second address: 4B80DC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4B80DC6 second address: 4B80DCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C003A2 second address: 4C003BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C003BF second address: 4C003DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BD0BE4 second address: 4BD0BFE instructions: 0x00000000 rdtsc 0x00000002 mov cx, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FFBA56586DFh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BD0BFE second address: 4BD0C22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BD0C22 second address: 4BD0C26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BD0C26 second address: 4BD0C2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BD0C2C second address: 4BD0C87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push esi 0x0000000c movsx ebx, si 0x0000000f pop ecx 0x00000010 pushfd 0x00000011 jmp 00007FFBA56586E5h 0x00000016 sbb esi, 7D3783C6h 0x0000001c jmp 00007FFBA56586E1h 0x00000021 popfd 0x00000022 popad 0x00000023 mov ebp, esp 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 mov si, di 0x0000002b mov ax, di 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C202FB second address: 4C20301 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C20301 second address: 4C20379 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FFBA56586DCh 0x00000008 pop esi 0x00000009 mov ch, dh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 pushad 0x00000011 jmp 00007FFBA56586E6h 0x00000016 mov ax, D1F1h 0x0000001a popad 0x0000001b mov dh, ch 0x0000001d popad 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 call 00007FFBA56586E5h 0x00000027 pop esi 0x00000028 pushfd 0x00000029 jmp 00007FFBA56586E1h 0x0000002e and ah, FFFFFFE6h 0x00000031 jmp 00007FFBA56586E1h 0x00000036 popfd 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C20379 second address: 4C20389 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFBA4B43D9Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C20389 second address: 4C2038D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C2038D second address: 4C203CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FFBA4B43D9Dh 0x00000010 xor ecx, 1306F5F6h 0x00000016 jmp 00007FFBA4B43DA1h 0x0000001b popfd 0x0000001c mov bh, ah 0x0000001e popad 0x0000001f mov ebp, esp 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 mov edi, ecx 0x00000026 pushad 0x00000027 popad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C203CA second address: 4C20402 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 19h 0x00000005 jmp 00007FFBA56586E6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FFBA56586E7h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C00DB1 second address: 4C00DB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C00DB5 second address: 4C00DBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C00DBB second address: 4C00DC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C00DC1 second address: 4C00DFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FFBA56586E5h 0x00000012 or al, FFFFFFC6h 0x00000015 jmp 00007FFBA56586E1h 0x0000001a popfd 0x0000001b mov ebx, ecx 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C00DFB second address: 4C00E9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43D9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FFBA4B43DA7h 0x00000011 xor eax, 0E85C5AEh 0x00000017 jmp 00007FFBA4B43DA9h 0x0000001c popfd 0x0000001d pushfd 0x0000001e jmp 00007FFBA4B43DA0h 0x00000023 adc esi, 67B00728h 0x00000029 jmp 00007FFBA4B43D9Bh 0x0000002e popfd 0x0000002f popad 0x00000030 xchg eax, ebp 0x00000031 jmp 00007FFBA4B43DA6h 0x00000036 mov ebp, esp 0x00000038 jmp 00007FFBA4B43DA0h 0x0000003d pop ebp 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C00E9A second address: 4C00EA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C00EA0 second address: 4C00EA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4B90751 second address: 4B90757 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4B90757 second address: 4B9075D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4B9075D second address: 4B9078D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FFBA56586E2h 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 call 00007FFBA56586DCh 0x00000017 pop esi 0x00000018 movsx ebx, ax 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4B9078D second address: 4B907F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43D9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FFBA4B43D9Ch 0x00000011 adc al, FFFFFF88h 0x00000014 jmp 00007FFBA4B43D9Bh 0x00000019 popfd 0x0000001a jmp 00007FFBA4B43DA8h 0x0000001f popad 0x00000020 mov ebp, esp 0x00000022 jmp 00007FFBA4B43DA0h 0x00000027 pop ebp 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FFBA4B43D9Ah 0x00000031 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4B907F6 second address: 4B90805 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C004A0 second address: 4C004A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C00B4C second address: 4C00B52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C00B52 second address: 4C00B86 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FFBA4B43DA7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C00B86 second address: 4C00BB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov ah, bl 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007FFBA56586E9h 0x00000014 movzx eax, bx 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C00BB2 second address: 4C00C22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, 9C3Fh 0x00000007 pushfd 0x00000008 jmp 00007FFBA4B43DA4h 0x0000000d and ecx, 32EA6128h 0x00000013 jmp 00007FFBA4B43D9Bh 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov eax, dword ptr [ebp+08h] 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007FFBA4B43D9Bh 0x00000028 jmp 00007FFBA4B43DA3h 0x0000002d popfd 0x0000002e jmp 00007FFBA4B43DA8h 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C00C22 second address: 4C00C67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FFBA56586E1h 0x00000008 mov si, D5D7h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f and dword ptr [eax], 00000000h 0x00000012 jmp 00007FFBA56586DAh 0x00000017 and dword ptr [eax+04h], 00000000h 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FFBA56586E7h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BD0B1C second address: 4BD0B6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 7741E6FAh 0x00000008 pushfd 0x00000009 jmp 00007FFBA4B43D9Bh 0x0000000e sub cl, FFFFFF9Eh 0x00000011 jmp 00007FFBA4B43DA9h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b jmp 00007FFBA4B43DA1h 0x00000020 xchg eax, ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 mov cx, bx 0x00000027 mov dl, 1Dh 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BB07F5 second address: 4BB0804 instructions: 0x00000000 rdtsc 0x00000002 movsx edx, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BB0804 second address: 4BB0808 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BB0808 second address: 4BB080E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C10C32 second address: 4C10C38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C10C38 second address: 4C10C3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C10C3C second address: 4C10D4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43D9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FFBA4B43DA6h 0x00000011 push eax 0x00000012 jmp 00007FFBA4B43D9Bh 0x00000017 xchg eax, ebp 0x00000018 jmp 00007FFBA4B43DA6h 0x0000001d mov ebp, esp 0x0000001f pushad 0x00000020 call 00007FFBA4B43D9Eh 0x00000025 jmp 00007FFBA4B43DA2h 0x0000002a pop ecx 0x0000002b call 00007FFBA4B43D9Bh 0x00000030 movzx eax, di 0x00000033 pop edi 0x00000034 popad 0x00000035 xchg eax, ecx 0x00000036 pushad 0x00000037 pushfd 0x00000038 jmp 00007FFBA4B43D9Eh 0x0000003d add ch, 00000038h 0x00000040 jmp 00007FFBA4B43D9Bh 0x00000045 popfd 0x00000046 jmp 00007FFBA4B43DA8h 0x0000004b popad 0x0000004c push eax 0x0000004d jmp 00007FFBA4B43D9Bh 0x00000052 xchg eax, ecx 0x00000053 jmp 00007FFBA4B43DA6h 0x00000058 mov eax, dword ptr [76FA65FCh] 0x0000005d jmp 00007FFBA4B43DA0h 0x00000062 test eax, eax 0x00000064 jmp 00007FFBA4B43DA0h 0x00000069 je 00007FFC16E569BEh 0x0000006f push eax 0x00000070 push edx 0x00000071 push eax 0x00000072 push edx 0x00000073 push eax 0x00000074 push edx 0x00000075 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C10D4A second address: 4C10D4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C10D4E second address: 4C10D54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C10262 second address: 4C1028B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FFBA56586E4h 0x00000009 or al, 00000028h 0x0000000c jmp 00007FFBA56586DBh 0x00000011 popfd 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C1028B second address: 4C102A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FFBA4B43D9Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C102A5 second address: 4C102B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C102B4 second address: 4C102E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FFBA4B43D9Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C102E2 second address: 4C102F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFBA56586DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C102F2 second address: 4C1034D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebp+08h] 0x0000000b jmp 00007FFBA4B43DA7h 0x00000010 and dword ptr [eax], 00000000h 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FFBA4B43DA4h 0x0000001a xor cx, 8CD8h 0x0000001f jmp 00007FFBA4B43D9Bh 0x00000024 popfd 0x00000025 pushad 0x00000026 mov ebx, esi 0x00000028 popad 0x00000029 popad 0x0000002a pop ebp 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e movzx esi, dx 0x00000031 push edx 0x00000032 pop ecx 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C1034D second address: 4C10353 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C10353 second address: 4C10357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BD0068 second address: 4BD0079 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, eax 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BD0079 second address: 4BD007D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BD007D second address: 4BD008C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BD008C second address: 4BD00D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FFBA4B43D9Eh 0x00000010 and esp, FFFFFFF8h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FFBA4B43DA7h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BD00D5 second address: 4BD00DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BD00DB second address: 4BD00DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BD00DF second address: 4BD00FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FFBA56586E3h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BD00FD second address: 4BD018E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 4370E17Ah 0x00000008 pushfd 0x00000009 jmp 00007FFBA4B43D9Bh 0x0000000e adc si, CD1Eh 0x00000013 jmp 00007FFBA4B43DA9h 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov dword ptr [esp], ecx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007FFBA4B43DA3h 0x00000028 and ah, 0000002Eh 0x0000002b jmp 00007FFBA4B43DA9h 0x00000030 popfd 0x00000031 pushfd 0x00000032 jmp 00007FFBA4B43DA0h 0x00000037 sub eax, 2788ACA8h 0x0000003d jmp 00007FFBA4B43D9Bh 0x00000042 popfd 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BD018E second address: 4BD0194 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BD0194 second address: 4BD0198 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BD0198 second address: 4BD01DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b call 00007FFBA56586E8h 0x00000010 pop esi 0x00000011 mov dx, 4776h 0x00000015 popad 0x00000016 movsx edi, si 0x00000019 popad 0x0000001a mov dword ptr [esp], ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FFBA56586E5h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BD01DF second address: 4BD0257 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FFBA4B43DA7h 0x00000009 sbb ch, 0000005Eh 0x0000000c jmp 00007FFBA4B43DA9h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007FFBA4B43DA0h 0x00000018 or esi, 7431D958h 0x0000001e jmp 00007FFBA4B43D9Bh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 mov ebx, dword ptr [ebp+10h] 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FFBA4B43DA5h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BD0257 second address: 4BD0314 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FFBA56586E7h 0x00000009 or ah, 0000007Eh 0x0000000c jmp 00007FFBA56586E9h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007FFBA56586E0h 0x00000018 or esi, 26B10878h 0x0000001e jmp 00007FFBA56586DBh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 xchg eax, esi 0x00000028 jmp 00007FFBA56586E6h 0x0000002d push eax 0x0000002e pushad 0x0000002f pushad 0x00000030 mov bl, 68h 0x00000032 mov di, si 0x00000035 popad 0x00000036 mov ebx, ecx 0x00000038 popad 0x00000039 xchg eax, esi 0x0000003a jmp 00007FFBA56586DEh 0x0000003f mov esi, dword ptr [ebp+08h] 0x00000042 jmp 00007FFBA56586E0h 0x00000047 xchg eax, edi 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007FFBA56586E7h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BD0314 second address: 4BD03AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FFBA4B43D9Fh 0x00000009 sub esi, 1F45685Eh 0x0000000f jmp 00007FFBA4B43DA9h 0x00000014 popfd 0x00000015 mov di, cx 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c pushad 0x0000001d call 00007FFBA4B43DA3h 0x00000022 mov ebx, esi 0x00000024 pop ecx 0x00000025 pushfd 0x00000026 jmp 00007FFBA4B43DA5h 0x0000002b and si, F7F6h 0x00000030 jmp 00007FFBA4B43DA1h 0x00000035 popfd 0x00000036 popad 0x00000037 xchg eax, edi 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b call 00007FFBA4B43DA6h 0x00000040 pop esi 0x00000041 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BD03AE second address: 4BD03DE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 test esi, esi 0x00000009 pushad 0x0000000a push eax 0x0000000b movsx ebx, ax 0x0000000e pop ecx 0x0000000f popad 0x00000010 je 00007FFC179A692Dh 0x00000016 jmp 00007FFBA56586DDh 0x0000001b cmp dword ptr [esi+08h], DDEEDDEEh 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BD03DE second address: 4BD03E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BD03E2 second address: 4BD03F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BE002E second address: 4BE0071 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FFBA4B43D9Fh 0x00000008 or si, 6FEEh 0x0000000d jmp 00007FFBA4B43DA9h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FFBA4B43D9Ch 0x0000001e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BE0071 second address: 4BE00C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FFBA56586E1h 0x00000009 and cx, A6D6h 0x0000000e jmp 00007FFBA56586E1h 0x00000013 popfd 0x00000014 mov cx, 5A47h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushad 0x00000020 popad 0x00000021 call 00007FFBA56586E5h 0x00000026 pop eax 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BE00C1 second address: 4BE00D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFBA4B43D9Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BE00D2 second address: 4BE0103 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b call 00007FFBA56586DFh 0x00000010 mov edi, eax 0x00000012 pop esi 0x00000013 popad 0x00000014 and esp, FFFFFFF8h 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FFBA56586DEh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BE0103 second address: 4BE019E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop eax 0x00000005 movsx edx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c pushad 0x0000000d pushad 0x0000000e mov dx, ax 0x00000011 pushfd 0x00000012 jmp 00007FFBA4B43D9Ch 0x00000017 sbb ax, FB48h 0x0000001c jmp 00007FFBA4B43D9Bh 0x00000021 popfd 0x00000022 popad 0x00000023 pushfd 0x00000024 jmp 00007FFBA4B43DA8h 0x00000029 add si, BDA8h 0x0000002e jmp 00007FFBA4B43D9Bh 0x00000033 popfd 0x00000034 popad 0x00000035 push eax 0x00000036 jmp 00007FFBA4B43DA9h 0x0000003b xchg eax, ebx 0x0000003c pushad 0x0000003d movzx ecx, bx 0x00000040 jmp 00007FFBA4B43DA9h 0x00000045 popad 0x00000046 xchg eax, esi 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b pushad 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BE019E second address: 4BE01A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BE01A2 second address: 4BE01A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BE01A8 second address: 4BE021A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov si, dx 0x0000000e call 00007FFBA56586DDh 0x00000013 call 00007FFBA56586E0h 0x00000018 pop esi 0x00000019 pop edx 0x0000001a popad 0x0000001b xchg eax, esi 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007FFBA56586E3h 0x00000025 sub al, 0000006Eh 0x00000028 jmp 00007FFBA56586E9h 0x0000002d popfd 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BE021A second address: 4BE021F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BE021F second address: 4BE022D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFBA56586DAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BE022D second address: 4BE0265 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43D9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, dword ptr [ebp+08h] 0x0000000e pushad 0x0000000f mov ax, 02FBh 0x00000013 mov cx, D3D7h 0x00000017 popad 0x00000018 sub ebx, ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FFBA4B43DA6h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BE0265 second address: 4BE029F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b pushad 0x0000000c mov bx, cx 0x0000000f mov si, CEA7h 0x00000013 popad 0x00000014 je 00007FFC1798E7E5h 0x0000001a jmp 00007FFBA56586DAh 0x0000001f cmp dword ptr [esi+08h], DDEEDDEEh 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 push edx 0x0000002a pop eax 0x0000002b mov si, bx 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BE029F second address: 4BE0327 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, esi 0x0000000b pushad 0x0000000c call 00007FFBA4B43D9Eh 0x00000011 pushfd 0x00000012 jmp 00007FFBA4B43DA2h 0x00000017 add eax, 47E8B898h 0x0000001d jmp 00007FFBA4B43D9Bh 0x00000022 popfd 0x00000023 pop esi 0x00000024 jmp 00007FFBA4B43DA9h 0x00000029 popad 0x0000002a je 00007FFC16E79E33h 0x00000030 jmp 00007FFBA4B43D9Eh 0x00000035 test byte ptr [76FA6968h], 00000002h 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BE0327 second address: 4BE0344 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BE0344 second address: 4BE03D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FFBA4B43DA7h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007FFC16E79DEBh 0x00000011 jmp 00007FFBA4B43DA5h 0x00000016 mov edx, dword ptr [ebp+0Ch] 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007FFBA4B43D9Ch 0x00000020 adc eax, 2497A148h 0x00000026 jmp 00007FFBA4B43D9Bh 0x0000002b popfd 0x0000002c popad 0x0000002d xchg eax, ebx 0x0000002e jmp 00007FFBA4B43DA2h 0x00000033 push eax 0x00000034 jmp 00007FFBA4B43D9Bh 0x00000039 xchg eax, ebx 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007FFBA4B43DA5h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BE03D7 second address: 4BE047B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, bx 0x00000006 jmp 00007FFBA56586E3h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebx 0x0000000f pushad 0x00000010 mov eax, 60C31F8Bh 0x00000015 pushfd 0x00000016 jmp 00007FFBA56586E0h 0x0000001b sub ecx, 12494B98h 0x00000021 jmp 00007FFBA56586DBh 0x00000026 popfd 0x00000027 popad 0x00000028 push eax 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007FFBA56586DFh 0x00000030 add ecx, 691E6C5Eh 0x00000036 jmp 00007FFBA56586E9h 0x0000003b popfd 0x0000003c pushfd 0x0000003d jmp 00007FFBA56586E0h 0x00000042 add ecx, 4B805058h 0x00000048 jmp 00007FFBA56586DBh 0x0000004d popfd 0x0000004e popad 0x0000004f xchg eax, ebx 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BE047B second address: 4BE0496 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BE0496 second address: 4BE049C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BE049C second address: 4BE04A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BE04A0 second address: 4BE04A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BE04A4 second address: 4BE04CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+14h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FFBA4B43DA9h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BE04CC second address: 4BE04D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BE04D2 second address: 4BE04E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, 4Dh 0x00000005 mov bx, FDEAh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push dword ptr [ebp+10h] 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BE04E7 second address: 4BE04EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BE04EB second address: 4BE04F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BE04F1 second address: 4BE04F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4BE04F7 second address: 4BE04FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C418A3 second address: 4C418FA instructions: 0x00000000 rdtsc 0x00000002 mov ax, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 push esp 0x00000009 jmp 00007FFBA56586E4h 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 pushfd 0x00000017 jmp 00007FFBA56586E3h 0x0000001c adc al, FFFFFFBEh 0x0000001f jmp 00007FFBA56586E9h 0x00000024 popfd 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C418FA second address: 4C4195E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, si 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FFBA4B43DA2h 0x00000012 sub eax, 7EACABE8h 0x00000018 jmp 00007FFBA4B43D9Bh 0x0000001d popfd 0x0000001e mov eax, 01A277DFh 0x00000023 popad 0x00000024 push 0000007Fh 0x00000026 pushad 0x00000027 mov ecx, 55FD83D7h 0x0000002c popad 0x0000002d push 00000001h 0x0000002f jmp 00007FFBA4B43DA9h 0x00000034 push dword ptr [ebp+08h] 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C4195E second address: 4C41962 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C41962 second address: 4C41968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C41991 second address: 4C41997 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C41997 second address: 4C418A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov ah, FCh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FFBA4B43D9Bh 0x00000012 sub si, 434Eh 0x00000017 jmp 00007FFBA4B43DA9h 0x0000001c popfd 0x0000001d pushad 0x0000001e push eax 0x0000001f pop ebx 0x00000020 mov eax, 3B722529h 0x00000025 popad 0x00000026 popad 0x00000027 retn 0004h 0x0000002a lea eax, dword ptr [ebp-10h] 0x0000002d push eax 0x0000002e call ebx 0x00000030 mov edi, edi 0x00000032 pushad 0x00000033 pushfd 0x00000034 jmp 00007FFBA4B43D9Ch 0x00000039 jmp 00007FFBA4B43DA5h 0x0000003e popfd 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 31B320 second address: 31B337 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007FFBA56586DCh 0x0000000b popad 0x0000000c push eax 0x0000000d push ebx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 31B526 second address: 31B52A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C00788 second address: 4C0078C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C0078C second address: 4C00792 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C60140 second address: 4C60146 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C60146 second address: 4C60158 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 5ECEh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C60158 second address: 4C6015C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C6015C second address: 4C60160 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C60160 second address: 4C60166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C60166 second address: 4C601DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FFBA4B43D9Fh 0x00000009 jmp 00007FFBA4B43DA3h 0x0000000e popfd 0x0000000f pushfd 0x00000010 jmp 00007FFBA4B43DA8h 0x00000015 adc cx, 29A8h 0x0000001a jmp 00007FFBA4B43D9Bh 0x0000001f popfd 0x00000020 popad 0x00000021 pop edx 0x00000022 pop eax 0x00000023 push dword ptr [ebp+0Ch] 0x00000026 jmp 00007FFBA4B43DA6h 0x0000002b push dword ptr [ebp+08h] 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 mov cx, F27Fh 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C106D4 second address: 4C106D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C106D8 second address: 4C106F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C106F4 second address: 4C10706 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFBA56586DEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C10706 second address: 4C1070A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C1070A second address: 4C10771 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FFBA56586E7h 0x0000000e mov ebp, esp 0x00000010 jmp 00007FFBA56586E6h 0x00000015 and esp, FFFFFFF0h 0x00000018 jmp 00007FFBA56586E0h 0x0000001d sub esp, 44h 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FFBA56586E7h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C10771 second address: 4C10797 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov esi, 7C695AA9h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C10797 second address: 4C107C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 mov edi, 1D0E2F06h 0x0000000c pop ebx 0x0000000d popad 0x0000000e push eax 0x0000000f jmp 00007FFBA56586DDh 0x00000014 xchg eax, ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FFBA56586DDh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C107C3 second address: 4C107EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edi 0x00000005 push edx 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebp 0x0000000b jmp 00007FFBA4B43DA2h 0x00000010 mov dword ptr [esp], esi 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C107EB second address: 4C10831 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FFBA56586DEh 0x00000011 add ch, FFFFFF98h 0x00000014 jmp 00007FFBA56586DBh 0x00000019 popfd 0x0000001a mov di, ax 0x0000001d popad 0x0000001e push eax 0x0000001f pushad 0x00000020 mov eax, ebx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C10831 second address: 4C10835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C10835 second address: 4C10864 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, edi 0x00000008 jmp 00007FFBA56586E5h 0x0000000d mov edi, dword ptr [ebp+08h] 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FFBA56586DDh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C10864 second address: 4C1087D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, bh 0x00000005 mov ax, EB0Fh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+24h], 00000000h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C1087D second address: 4C10883 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C10883 second address: 4C10888 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C10888 second address: 4C108AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lock bts dword ptr [edi], 00000000h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C108AF second address: 4C108B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C108B3 second address: 4C108B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C108B7 second address: 4C108BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C108BD second address: 4C10918 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007FFC1790A234h 0x0000000f jmp 00007FFBA56586E0h 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007FFBA56586DDh 0x0000001e sub eax, 3CF43366h 0x00000024 jmp 00007FFBA56586E1h 0x00000029 popfd 0x0000002a push eax 0x0000002b pop edi 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C10918 second address: 4C10934 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFBA4B43DA8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C10934 second address: 4C1096C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushfd 0x0000000f jmp 00007FFBA56586E6h 0x00000014 add ecx, 110FB098h 0x0000001a jmp 00007FFBA56586DBh 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C1096C second address: 4C1099E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a jmp 00007FFBA4B43D9Eh 0x0000000f mov esp, ebp 0x00000011 pushad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C10393 second address: 4C10399 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C10399 second address: 4C103C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, al 0x00000005 movsx edx, si 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FFBA4B43DA7h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C103C0 second address: 4C103C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C103C6 second address: 4C103CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C103CA second address: 4C10413 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007FFBA56586E7h 0x0000000f xchg eax, ebx 0x00000010 jmp 00007FFBA56586E6h 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FFBA56586DEh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C10413 second address: 4C1042F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43D9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov edx, 2B8104B6h 0x00000012 mov si, dx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C1042F second address: 4C10496 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FFBA56586E6h 0x00000009 or esi, 15801FD8h 0x0000000f jmp 00007FFBA56586DBh 0x00000014 popfd 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, esi 0x0000001b jmp 00007FFBA56586E4h 0x00000020 push eax 0x00000021 jmp 00007FFBA56586DBh 0x00000026 xchg eax, esi 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FFBA56586E0h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C10496 second address: 4C1049A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C1049A second address: 4C104A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C104A0 second address: 4C104A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C104A6 second address: 4C104BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FFBA56586DBh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C104BE second address: 4C10524 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub ecx, ecx 0x0000000b jmp 00007FFBA4B43DA7h 0x00000010 xchg eax, edi 0x00000011 jmp 00007FFBA4B43DA6h 0x00000016 push eax 0x00000017 pushad 0x00000018 push eax 0x00000019 pop edi 0x0000001a popad 0x0000001b xchg eax, edi 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FFBA4B43DA1h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C10524 second address: 4C1052A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C1052A second address: 4C1052E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C1052E second address: 4C10545 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, 00000001h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov cx, ABC7h 0x00000014 mov cl, 3Dh 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C10545 second address: 4C1055E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFBA4B43DA5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C1055E second address: 4C1062C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA56586E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b lock cmpxchg dword ptr [esi], ecx 0x0000000f pushad 0x00000010 push ecx 0x00000011 pushfd 0x00000012 jmp 00007FFBA56586DFh 0x00000017 add esi, 74EDFD9Eh 0x0000001d jmp 00007FFBA56586E9h 0x00000022 popfd 0x00000023 pop eax 0x00000024 popad 0x00000025 mov ecx, eax 0x00000027 jmp 00007FFBA56586E7h 0x0000002c cmp ecx, 01h 0x0000002f jmp 00007FFBA56586E6h 0x00000034 jne 00007FFC1790A6C5h 0x0000003a jmp 00007FFBA56586E0h 0x0000003f pop edi 0x00000040 pushad 0x00000041 pushfd 0x00000042 jmp 00007FFBA56586DEh 0x00000047 and si, FC58h 0x0000004c jmp 00007FFBA56586DBh 0x00000051 popfd 0x00000052 movzx ecx, dx 0x00000055 popad 0x00000056 pop esi 0x00000057 push eax 0x00000058 push edx 0x00000059 jmp 00007FFBA56586DEh 0x0000005e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C1062C second address: 4C10666 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FFBA4B43DA1h 0x00000009 adc ax, 5AA6h 0x0000000e jmp 00007FFBA4B43DA1h 0x00000013 popfd 0x00000014 mov ax, 4DD7h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b pop ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C10666 second address: 4C1066A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C1066A second address: 4C10670 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4C10670 second address: 4C10681 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFBA56586DDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4B70834 second address: 4B70858 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBA4B43DA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4B70858 second address: 4B7085C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	RDTSC instruction interceptor: First address: 4B7085C second address: 4B70862 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Special instruction interceptor: First address: 15FAE8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Special instruction interceptor: First address: 15D362 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Special instruction interceptor: First address: 315AA2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Special instruction interceptor: First address: 39AD00 instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: 30FAE8 instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: 30D362 instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: 4C5AA2 instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: 54AD00 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: 26FAE8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: 26D362 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: 425AA2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: 4AAD00 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe

Code function: 0_2_04C50833 rdtsc

0_2_04C50833

Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Window / User API: threadDelayed 1870	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Window / User API: threadDelayed 1674	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 1145	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 1124	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 726	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 1161	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 1087	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 728	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1107	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1080	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1045	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1147	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1150	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe TID: 3208	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe TID: 1788	Thread sleep count: 1870 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe TID: 1788	Thread sleep time: -3741870s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe TID: 6976	Thread sleep count: 81 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe TID: 6976	Thread sleep count: 241 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe TID: 6184	Thread sleep count: 241 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe TID: 6188	Thread sleep count: 1674 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe TID: 6188	Thread sleep time: -3349674s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3184	Thread sleep count: 94 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3184	Thread sleep time: -188094s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3192	Thread sleep count: 119 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3192	Thread sleep time: -238119s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1164	Thread sleep count: 86 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1164	Thread sleep count: 1145 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1164	Thread sleep time: -115645s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7236	Thread sleep count: 1124 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7236	Thread sleep count: 726 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7236	Thread sleep time: -72600s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3172	Thread sleep count: 86 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3172	Thread sleep time: -172086s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6204	Thread sleep count: 118 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6204	Thread sleep time: -236118s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4448	Thread sleep count: 125 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4448	Thread sleep time: -250125s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3748	Thread sleep count: 124 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3748	Thread sleep time: -248124s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 320	Thread sleep count: 88 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 320	Thread sleep count: 1161 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 320	Thread sleep time: -117261s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7232	Thread sleep count: 1087 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7232	Thread sleep count: 728 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7232	Thread sleep time: -72800s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6780	Thread sleep count: 87 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6780	Thread sleep time: -174087s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 760	Thread sleep count: 130 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 760	Thread sleep time: -260130s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4268	Thread sleep count: 124 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4268	Thread sleep time: -248124s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7300	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7280	Thread sleep count: 1107 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7280	Thread sleep time: -2215107s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7276	Thread sleep count: 1080 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7276	Thread sleep time: -2161080s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7256	Thread sleep count: 249 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7376	Thread sleep count: 246 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7292	Thread sleep count: 1045 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7292	Thread sleep time: -2091045s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7612	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7592	Thread sleep count: 1147 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7592	Thread sleep time: -2295147s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7572	Thread sleep count: 282 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7700	Thread sleep count: 250 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7584	Thread sleep count: 1150 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7584	Thread sleep time: -2301150s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed

Source: RageMP131.exe, RageMP131.exe, 0000000A.00000002.4497054948.00000000003FC000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: RageMP131.exe, 0000000A.00000002.4499262309.00000000011AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: MPGPH131.exe, 00000007.00000002.4499103991.0000000000C25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}DPRm
Source: LisectAVT_2403002A_163.exe, 00000000.00000002.4499442748.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}g
Source: MPGPH131.exe, 00000006.00000002.4499466734.00000000015F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&T
Source: RageMP131.exe, 0000000A.00000002.4499262309.00000000011E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 3c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_57359524
Source: MPGPH131.exe, 00000007.00000002.4499103991.0000000000C11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: RageMP131.exe, 00000008.00000002.4498783291.0000000000B73000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: RageMP131.exe, 0000000A.00000002.4498642794.0000000000EFD000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 00000007.00000002.4499103991.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}a
Source: MPGPH131.exe, 00000006.00000002.4499466734.00000000015BD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}.e
Source: RageMP131.exe, 0000000A.00000002.4499262309.00000000011AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}^
Source: MPGPH131.exe, 00000006.00000002.4498818545.000000000133D000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}[
Source: MPGPH131.exe, 00000007.00000002.4499103991.0000000000C1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_57359524
Source: MPGPH131.exe, 00000007.00000002.4499103991.0000000000C11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllT
Source: RageMP131.exe, 0000000A.00000003.2270670697.00000000011E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 00000007.00000002.4499103991.0000000000C11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&fQRNhy
Source: LisectAVT_2403002A_163.exe, 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.4497069031.000000000049C000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000002.4497101175.000000000049C000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.4497056945.00000000003FC000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000002.4497054948.00000000003FC000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: MPGPH131.exe, 00000006.00000003.2125439054.0000000001604000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}v
Source: RageMP131.exe, 0000000A.00000002.4499262309.00000000011AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}N
Source: LisectAVT_2403002A_163.exe, 00000000.00000002.4499442748.0000000000EB5000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.4498783291.0000000000B73000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.4499262309.00000000011AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: MPGPH131.exe, 00000006.00000002.4499466734.00000000015F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllzz
Source: MPGPH131.exe, 00000006.00000003.2125439054.0000000001604000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}l

Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Thread information set: HideFromDebugger	Jump to behavior

Potentially malicious time measurement code found

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_04D40545 Start: 04D40530 End: 04D4051B	7_2_04D40545
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_04D40207 Start: 04D40235 End: 04D4023F	7_2_04D40207
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_04C80699 Start: 04C80749 End: 04C806FD	8_2_04C80699

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe

Code function: 0_2_04C50833 rdtsc

0_2_04C50833

Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Code function: 0_2_00083A40 mov eax, dword ptr fs:[00000030h]	0_2_00083A40
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Code function: 0_2_00083A40 mov eax, dword ptr fs:[00000030h]	0_2_00083A40
Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Code function: 0_2_00034100 mov eax, dword ptr fs:[00000030h]	0_2_00034100
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00233A40 mov eax, dword ptr fs:[00000030h]	6_2_00233A40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00233A40 mov eax, dword ptr fs:[00000030h]	6_2_00233A40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_001E4100 mov eax, dword ptr fs:[00000030h]	6_2_001E4100
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00233A40 mov eax, dword ptr fs:[00000030h]	7_2_00233A40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00233A40 mov eax, dword ptr fs:[00000030h]	7_2_00233A40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_001E4100 mov eax, dword ptr fs:[00000030h]	7_2_001E4100
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00193A40 mov eax, dword ptr fs:[00000030h]	8_2_00193A40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00193A40 mov eax, dword ptr fs:[00000030h]	8_2_00193A40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 8_2_00144100 mov eax, dword ptr fs:[00000030h]	8_2_00144100
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00193A40 mov eax, dword ptr fs:[00000030h]	10_2_00193A40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00193A40 mov eax, dword ptr fs:[00000030h]	10_2_00193A40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 10_2_00144100 mov eax, dword ptr fs:[00000030h]	10_2_00144100

Source: MPGPH131.exe, MPGPH131.exe, 00000007.00000002.4497101175.000000000049C000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, RageMP131.exe, 0000000A.00000002.4497054948.00000000003FC000.00000040.00000001.01000000.00000006.sdmp

Binary or memory string: :Program Manager

Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe

Code function: 0_2_000FF26A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_000FF26A

Source: C:\Users\user\Desktop\LisectAVT_2403002A_163.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected RisePro Stealer

Source: Yara match	File source: 00000006.00000003.2098792181.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2097834723.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2174447764.0000000004A00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2036461002.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2257587629.0000000004E30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_163.exe PID: 3140, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 5044, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 5012, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7252, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7568, type: MEMORYSTR

Remote Access Functionality

Yara detected RisePro Stealer

Source: Yara match	File source: 00000006.00000003.2098792181.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2097834723.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2174447764.0000000004A00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2036461002.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2257587629.0000000004E30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_163.exe PID: 3140, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 5044, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 5012, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7252, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7568, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Command and Scripting Interpreter	1 Scheduled Task/Job	2 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	24 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	2 Process Injection	Security Account Manager	24 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	214 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
LisectAVT_2403002A_163.exe	100%	Avira	TR/Crypt.TPM.Gen
LisectAVT_2403002A_163.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.winimage.com/zLibDll	0%	URL Reputation	safe
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORT	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	LisectAVT_2403002A_163.exe, 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, LisectAVT_2403002A_163.exe, 00000000.00000003.2036461002.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2098792181.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000003.2097834723.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2174447764.0000000004A00000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000003.2257587629.0000000004E30000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDll	LisectAVT_2403002A_163.exe, 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, LisectAVT_2403002A_163.exe, 00000000.00000003.2036461002.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2098792181.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000003.2097834723.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2174447764.0000000004A00000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000A.00000003.2257587629.0000000004E30000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://t.me/RiseProSUPPORT	LisectAVT_2403002A_163.exe, 00000000.00000002.4499442748.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.4499466734.00000000015BD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.4499103991.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.4498783291.0000000000B3E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.4499262309.00000000011AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.233.132.74	unknown	Russian Federation		2895	FREE-NET-ASFREEnetEU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1482474
Start date and time:	2024-07-25 23:23:31 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LisectAVT_2403002A_163.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@11/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: LisectAVT_2403002A_163.exe

Simulations

Behavior and APIs

Time	Type	Description
17:24:50	API Interceptor	3225003x Sleep call for process: LisectAVT_2403002A_163.exe modified
17:24:56	API Interceptor	5485x Sleep call for process: MPGPH131.exe modified
17:25:04	API Interceptor	4828450x Sleep call for process: RageMP131.exe modified
23:24:25	Task Scheduler	Run new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
23:24:25	Task Scheduler	Run new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
23:24:25	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
23:24:34	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
193.233.132.74	LisectAVT_2403002A_185.exe	Get hash	malicious	RisePro Stealer	Browse
	LisectAVT_2403002A_218.exe	Get hash	malicious	RisePro Stealer	Browse
	LisectAVT_2403002A_228.exe	Get hash	malicious	RisePro Stealer	Browse
	LisectAVT_2403002A_376.exe	Get hash	malicious	RisePro Stealer	Browse
	LisectAVT_2403002B_242.exe	Get hash	malicious	RisePro Stealer	Browse
	LisectAVT_2403002A_224.exe	Get hash	malicious	RisePro Stealer	Browse
	80OrFCsz0u.exe	Get hash	malicious	GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse
	SecuriteInfo.com.Win64.Evo-gen.28136.30716.exe	Get hash	malicious	GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse
	file.exe	Get hash	malicious	RisePro Stealer	Browse
	vGDqFBB1Jz.exe	Get hash	malicious	RisePro Stealer	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FREE-NET-ASFREEnetEU	LisectAVT_2403002A_185.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.74
	LisectAVT_2403002A_191.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.62
	LisectAVT_2403002A_218.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.74
	LisectAVT_2403002A_228.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.74
	LisectAVT_2403002A_30.exe	Get hash	malicious	Amadey	Browse	193.233.132.56
	LisectAVT_2403002A_33.exe	Get hash	malicious	Amadey	Browse	193.233.132.56
	LisectAVT_2403002A_376.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.74
	LisectAVT_2403002A_389.exe	Get hash	malicious	Amadey	Browse	193.233.132.56
	LisectAVT_2403002A_419.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.67
	LisectAVT_2403002A_419.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.67

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_163.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2345480
Entropy (8bit):	7.96694468702243
Encrypted:	false
SSDEEP:	49152:UggqhA+wMc8HC0LjwBEBNctGy5iKxAGgWwTMn0CVWDWpj:tgwNXiuwBJ5ZxAGgWwq0Fqp
MD5:	A472AFB64B5C6F61AC63639FBD778001
SHA1:	DEF8AFCE906AA4094C8A564AE9B9C886955C16B3
SHA-256:	9582E561631B18BAD3EF23B24A57636EF1D48B05535962DC0B19AB27E9351276
SHA-512:	B7247C1F896565F25B0BC51619233EEEA52DCFEA594A7ACA618F1FE1EE81FFBE07F301A6E20BA4395931A05FC9E5382059A4EFBB2D125F43C71A45C8D4A328EF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$......."...f.{Tf.{Tf.{T-.xUk.{T-.~U..{T-.\|Ug.{T)..Tb.{T)..Ut.{T).xUq.{T).~U3.{T-..U..{T-.}Ug.{T-.zU}.{Tf.zT@.{T..rUz.{T..{Ug.{T...Tg.{Tf..Tg.{T..yUg.{TRichf.{T................PE..L....b.e...............".....0........Z...........@...........................Z.....[/$...@.........................XeZ.L...U...i.......X+.......................................................................................................... . .p..........................@....rsrc...X+..........................@....idata ............."..............@... .0,..........$..............@...jgtpuhbl......?......&..............@...ikxokzqh......Z.......#.............@...........................................................................................................................................................................................................................

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_163.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_163.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2345480
Entropy (8bit):	7.96694468702243
Encrypted:	false
SSDEEP:	49152:UggqhA+wMc8HC0LjwBEBNctGy5iKxAGgWwTMn0CVWDWpj:tgwNXiuwBJ5ZxAGgWwq0Fqp
MD5:	A472AFB64B5C6F61AC63639FBD778001
SHA1:	DEF8AFCE906AA4094C8A564AE9B9C886955C16B3
SHA-256:	9582E561631B18BAD3EF23B24A57636EF1D48B05535962DC0B19AB27E9351276
SHA-512:	B7247C1F896565F25B0BC51619233EEEA52DCFEA594A7ACA618F1FE1EE81FFBE07F301A6E20BA4395931A05FC9E5382059A4EFBB2D125F43C71A45C8D4A328EF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$......."...f.{Tf.{Tf.{T-.xUk.{T-.~U..{T-.\|Ug.{T)..Tb.{T)..Ut.{T).xUq.{T).~U3.{T-..U..{T-.}Ug.{T-.zU}.{Tf.zT@.{T..rUz.{T..{Ug.{T...Tg.{Tf..Tg.{T..yUg.{TRichf.{T................PE..L....b.e...............".....0........Z...........@...........................Z.....[/$...@.........................XeZ.L...U...i.......X+.......................................................................................................... . .p..........................@....rsrc...X+..........................@....idata ............."..............@... .0,..........$..............@...jgtpuhbl......?......&..............@...ikxokzqh......Z.......#.............@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_163.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_163.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:LETUd:GE
MD5:	CCF0035598D762198DCDA75F7E009B2E
SHA1:	D0E7B17A5C927A1EE5C98D381F00DC6281789B3B
SHA-256:	235ABA94D759DF94FE8C966BC86B4191CF49BBFB5F8FA1B0E1E0770BB7AF25C8
SHA-512:	DE0A70C550131593CCBAA36C0383C82E3A2B695174F54560972BAF76B6EBC0626DADC7F2B1059820ED410136BCE46496C471406D05D4C6715305A0011EBC0ADA
Malicious:	false
Preview:	1721949373918

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.96694468702243
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	LisectAVT_2403002A_163.exe
File size:	2'345'480 bytes
MD5:	a472afb64b5c6f61ac63639fbd778001
SHA1:	def8afce906aa4094c8a564ae9b9c886955c16b3
SHA256:	9582e561631b18bad3ef23b24a57636ef1d48b05535962dc0b19ab27e9351276
SHA512:	b7247c1f896565f25b0bc51619233eeea52dcfea594a7aca618f1fe1ee81ffbe07f301a6e20ba4395931a05fc9e5382059a4efbb2d125f43c71a45c8d4a328ef
SSDEEP:	49152:UggqhA+wMc8HC0LjwBEBNctGy5iKxAGgWwTMn0CVWDWpj:tgwNXiuwBJ5ZxAGgWwq0Fqp
TLSH:	1CB533A29E25A777DE524BF000E1C85F3DC0F9A494217F1C07E87C63FA7ABB19A85580
File Content Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$......."...f.{Tf.{Tf.{T-.xUk.{T-.~U..{T-.\|Ug.{T)..Tb.{T)..Ut.{T).xUq.{T).~U3.{T-..U..{T-.}Ug.{T-.zU}.{Tf.zT@.{T..rUz.{T..{Ug.{T...Tg.{

File Icon


Icon Hash:	c769eccc64f6e2bb

Static PE Info

General

Entrypoint:	0x9a9000
Entrypoint Section:	ikxokzqh
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x65FD62AE [Fri Mar 22 10:51:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
push edi
mov dword ptr [esp], 53F78224h
or dword ptr [esp], 7AD4FD19h
add dword ptr [esp], 094EA9F2h
sub dword ptr [esp], 7EDDB306h
xor dword ptr [esp], 36D6C656h
mov dword ptr [esp], esi
push esi
mov esi, esp
add esi, 00000004h
sub esi, 00000004h
xchg dword ptr [esp], esi
pop esp
mov dword ptr [esp], ebx
mov dword ptr [esp], eax
push edi
mov dword ptr [esp], edx
mov dword ptr [esp], ebx
call 00007FFBA4C27AA6h
int3
push dword ptr [esp]
mov eax, dword ptr [esp]
add esp, 04h
add esp, 00000004h
push eax
mov ebx, dword ptr [esp]
push edi
mov edi, esp
add edi, 00000004h
add edi, 04h
xchg dword ptr [esp], edi
pop esp
push ebp
mov ebp, 00000001h
add eax, ebp
mov ebp, dword ptr [esp]
add esp, 04h
push ebx
push ecx
push 5FE358F9h
pop ecx
shl ecx, 05h
xor ecx, 8704BB84h
push ecx
sub dword ptr [esp], 4AE90521h
pop ebx
add ebx, 4AE90521h
pop ecx
and ebx, 7EFFEAC0h
or ebx, 77FF4FAFh
add ebx, 7FFA94F5h
sub ebx, FFDFE4A4h
sub eax, ebx
pop ebx
sub eax, 0E6E004Dh
add eax, 0E6E0000h
cmp byte ptr [ebx], FFFFFFCCh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x5a6558	0x4c	jgtpuhbl
IMAGE_DIRECTORY_ENTRY_IMPORT	0x13b055	0x69	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x138000	0x2b58	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x13b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x137000	0x90600	9b46898171af12ae8f817b7b5eb30aed	False	0.9988822375541125	data	7.977067116075123	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x138000	0x2b58	0xc00	adc75844984f0b50333f31ea9c306356	False	0.83984375	data	7.036235070221089	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x13b000	0x1000	0x200	745dea56938759dccaf9e183aa01b020	False	0.146484375	data	0.998472215956371	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x13c000	0x2c3000	0x200	710cac2f137cecb62b5cb37aac1060d4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jgtpuhbl	0x3ff000	0x1aa000	0x1aa000	d9a39297acb29345d8359a749d8bd3b1	False	0.9899673103726526	data	7.950675403597083	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ikxokzqh	0x5a9000	0x1000	0x400	41bee5a50a13964c9c82fe7780e23faf	False	0.7890625	data	6.155091484572297	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x5a65a4	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Russian	Russia	0.1892116182572614
RT_GROUP_ICON	0x5a8b4c	0x14	data	Russian	Russia	1.15
RT_VERSION	0x5a8b60	0x2e4	data	Russian	Russia	0.4689189189189189
RT_MANIFEST	0x5a8e44	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Exports

Name	Ordinal	Address
Start	1	0x466e80

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-25T23:24:33.785844+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49705	58709	192.168.2.5	193.233.132.74
2024-07-25T23:24:39.989292+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49707	58709	192.168.2.5	193.233.132.74
2024-07-25T23:25:17.804075+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49716	13.85.23.86	192.168.2.5
2024-07-25T23:24:37.004080+0200	TCP	2049060	ET MALWARE RisePro TCP Heartbeat Packet	49707	58709	192.168.2.5	193.233.132.74
2024-07-25T23:24:30.824970+0200	TCP	2049060	ET MALWARE RisePro TCP Heartbeat Packet	49705	58709	192.168.2.5	193.233.132.74
2024-07-25T23:24:48.317488+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49715	58709	192.168.2.5	193.233.132.74
2024-07-25T23:24:33.786068+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49706	58709	192.168.2.5	193.233.132.74
2024-07-25T23:24:25.287527+0200	TCP	2049060	ET MALWARE RisePro TCP Heartbeat Packet	49704	58709	192.168.2.5	193.233.132.74
2024-07-25T23:24:39.689012+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49708	13.85.23.86	192.168.2.5
2024-07-25T23:24:30.827995+0200	TCP	2049060	ET MALWARE RisePro TCP Heartbeat Packet	49706	58709	192.168.2.5	193.233.132.74
2024-07-25T23:24:28.254825+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49704	58709	192.168.2.5	193.233.132.74

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 23:24:25.245265007 CEST	49704	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 23:24:25.250415087 CEST	58709	49704	193.233.132.74	192.168.2.5
Jul 25, 2024 23:24:25.250529051 CEST	49704	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 23:24:25.287527084 CEST	49704	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 23:24:25.292727947 CEST	58709	49704	193.233.132.74	192.168.2.5
Jul 25, 2024 23:24:28.254825115 CEST	49704	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 23:24:28.261090994 CEST	58709	49704	193.233.132.74	192.168.2.5
Jul 25, 2024 23:24:30.783601046 CEST	49705	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 23:24:30.785963058 CEST	49706	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 23:24:30.789261103 CEST	58709	49705	193.233.132.74	192.168.2.5
Jul 25, 2024 23:24:30.789341927 CEST	49705	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 23:24:30.790797949 CEST	58709	49706	193.233.132.74	192.168.2.5
Jul 25, 2024 23:24:30.790855885 CEST	49706	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 23:24:30.824970007 CEST	49705	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 23:24:30.827995062 CEST	49706	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 23:24:30.830615044 CEST	58709	49705	193.233.132.74	192.168.2.5
Jul 25, 2024 23:24:30.833266973 CEST	58709	49706	193.233.132.74	192.168.2.5
Jul 25, 2024 23:24:33.785844088 CEST	49705	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 23:24:33.786067963 CEST	49706	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 23:24:33.944892883 CEST	58709	49705	193.233.132.74	192.168.2.5
Jul 25, 2024 23:24:33.944935083 CEST	58709	49706	193.233.132.74	192.168.2.5
Jul 25, 2024 23:24:36.977360010 CEST	49707	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 23:24:36.985902071 CEST	58709	49707	193.233.132.74	192.168.2.5
Jul 25, 2024 23:24:36.986036062 CEST	49707	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 23:24:37.004080057 CEST	49707	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 23:24:37.009527922 CEST	58709	49707	193.233.132.74	192.168.2.5
Jul 25, 2024 23:24:39.989291906 CEST	49707	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 23:24:40.106304884 CEST	58709	49707	193.233.132.74	192.168.2.5
Jul 25, 2024 23:24:45.324544907 CEST	49715	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 23:24:45.329530001 CEST	58709	49715	193.233.132.74	192.168.2.5
Jul 25, 2024 23:24:45.329615116 CEST	49715	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 23:24:45.346700907 CEST	49715	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 23:24:45.351624966 CEST	58709	49715	193.233.132.74	192.168.2.5
Jul 25, 2024 23:24:46.661643982 CEST	58709	49704	193.233.132.74	192.168.2.5
Jul 25, 2024 23:24:46.661739111 CEST	49704	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 23:24:48.317487955 CEST	49715	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 23:24:48.322757959 CEST	58709	49715	193.233.132.74	192.168.2.5
Jul 25, 2024 23:24:52.172631025 CEST	58709	49706	193.233.132.74	192.168.2.5
Jul 25, 2024 23:24:52.172768116 CEST	49706	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 23:24:52.194489956 CEST	58709	49705	193.233.132.74	192.168.2.5
Jul 25, 2024 23:24:52.194577932 CEST	49705	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 23:24:58.369255066 CEST	58709	49707	193.233.132.74	192.168.2.5
Jul 25, 2024 23:24:58.369420052 CEST	49707	58709	192.168.2.5	193.233.132.74
Jul 25, 2024 23:25:06.741308928 CEST	58709	49715	193.233.132.74	192.168.2.5
Jul 25, 2024 23:25:06.741446972 CEST	49715	58709	192.168.2.5	193.233.132.74

Target ID:	0
Start time:	17:24:19
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\LisectAVT_2403002A_163.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LisectAVT_2403002A_163.exe"
Imagebase:	0x20000
File size:	2'345'480 bytes
MD5 hash:	A472AFB64B5C6F61AC63639FBD778001
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000003.2036461002.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	17:24:24
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0x4a0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:24:24
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:24:24
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0x4a0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:24:24
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:24:25
Start date:	25/07/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x1d0000
File size:	2'345'480 bytes
MD5 hash:	A472AFB64B5C6F61AC63639FBD778001
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000006.00000003.2098792181.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	17:24:25
Start date:	25/07/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x1d0000
File size:	2'345'480 bytes
MD5 hash:	A472AFB64B5C6F61AC63639FBD778001
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000003.2097834723.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	17:24:34
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x130000
File size:	2'345'480 bytes
MD5 hash:	A472AFB64B5C6F61AC63639FBD778001
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000008.00000003.2174447764.0000000004A00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	17:24:42
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x130000
File size:	2'345'480 bytes
MD5 hash:	A472AFB64B5C6F61AC63639FBD778001
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000000A.00000003.2257587629.0000000004E30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	1.7%
Signature Coverage:	4.3%
Total number of Nodes:	348
Total number of Limit Nodes:	55

Executed Functions

Function 0003E0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 0003E0CA
socket.WS2_32(?,?,?), ref: 0003E17E
connect.WS2_32(00000000,?,?), ref: 0003E192
closesocket.WS2_32(00000000), ref: 0003E19E

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: c01d161537f89b2f65af89b2e7abdf9b800bc31fc2f7822ad0b49fa9542325e3
Instruction ID: 2826e0844d2f9c981b14b264102de5aa149e430c7131163122bb864bb4509011
Opcode Fuzzy Hash: c01d161537f89b2f65af89b2e7abdf9b800bc31fc2f7822ad0b49fa9542325e3
Instruction Fuzzy Hash: 2B31C172605301ABD7229F24DC45B2BB7E8EB85734F115F1DF9A4972E0D33198048B92

Function 00083A40 Relevance: 2.7, APIs: 2, Instructions: 157
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E9,?,00000001,00000000,?,?,?,?,?,?,?,?,00083DB6), ref: 00083B08
Sleep.KERNELBASE(00000001,?,00000001,00000000,?,?,?,?,?,?,?,?,00083DB6), ref: 00083BBA

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: b0a80ffd53dd6ad1679ddcbe5a81991d5e4b5f203168415f2a2909aa4bc4b911
Instruction ID: e4789f9bf0c6cf28f641e5f09603e3232ec3e342b7b9338d13ab2cf3eb9c877a
Opcode Fuzzy Hash: b0a80ffd53dd6ad1679ddcbe5a81991d5e4b5f203168415f2a2909aa4bc4b911
Instruction Fuzzy Hash: 6E51BC35A041158FCB28DF58C4D0EAAB7F1FF84B04B294599D585AB351D731EE45CB80

Function 04C50833 Relevance: 1.7, APIs: 1, Instructions: 203COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C5092A

Memory Dump Source

Source File: 00000000.00000002.4505464326.0000000004C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c50000_LisectAVT_2403002A_163.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: d9ce1af4ddefd995d81e95e473cc1470629fc03b27749242c0b5d0803d9f6eca
Instruction ID: 9b50a9593f7ea21f61dd41038399a6c360ce17b18a587843cf6a9cc88e01dbd4
Opcode Fuzzy Hash: d9ce1af4ddefd995d81e95e473cc1470629fc03b27749242c0b5d0803d9f6eca
Instruction Fuzzy Hash: 113127EB34C125BCB10281432B64EFF57AEE2D6B307388826FC07D1516F3846AC9647A

Function 04C506E0 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 334
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_$4|, xrefs: 04C507E1

Memory Dump Source

Source File: 00000000.00000002.4505464326.0000000004C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c50000_LisectAVT_2403002A_163.jbxd

Similarity

API ID: CurrentProfile
String ID: _$4|
API String ID: 2104809126-1878515764
Opcode ID: 246996ede7f617b61a337492c8f3c2f3a8f74304a52d0397e68f2452785af8ca
Instruction ID: a5740ea8ea83b845bf1ce36b61b55613ca32ed2af840aae0d29af6e96069ed0e
Opcode Fuzzy Hash: 246996ede7f617b61a337492c8f3c2f3a8f74304a52d0397e68f2452785af8ca
Instruction Fuzzy Hash: AA516AEB20C121BDB10195436B64EFF676EE6D2B70738882AFC07D1516F3942EC9643A

Function 04C506C8 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_$4|, xrefs: 04C507E1

Memory Dump Source

Source File: 00000000.00000002.4505464326.0000000004C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c50000_LisectAVT_2403002A_163.jbxd

Similarity

API ID: CurrentProfile
String ID: _$4|
API String ID: 2104809126-1878515764
Opcode ID: d7a65a6718027e12feeee6bda61e21930e6e8c3400c595e5f95400c97c0d3754
Instruction ID: 2c16fcb8c1729fd047ee08756f3521901212019c8425f6da36c9466ad9d3bf32
Opcode Fuzzy Hash: d7a65a6718027e12feeee6bda61e21930e6e8c3400c595e5f95400c97c0d3754
Instruction Fuzzy Hash: 975136EB20C121BDB10285432F64EFF576EE6D2B70738882AFD07D5516F3942AC9643A

Function 04C506D5 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 328
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_$4|, xrefs: 04C507E1

Memory Dump Source

Source File: 00000000.00000002.4505464326.0000000004C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c50000_LisectAVT_2403002A_163.jbxd

Similarity

API ID: CurrentProfile
String ID: _$4|
API String ID: 2104809126-1878515764
Opcode ID: c20bbb7fe7d45e98e3b0aeea4f1e861d93335b7ad628632aee104da5dddbe8c8
Instruction ID: 44ac6443fa9d8232f938258fb28901a95f5e96da3781ac76d6cc5d616047d595
Opcode Fuzzy Hash: c20bbb7fe7d45e98e3b0aeea4f1e861d93335b7ad628632aee104da5dddbe8c8
Instruction Fuzzy Hash: 7A5149EB20C125BDB10185432F64EFF576EE6D2B70738882AFC07D1516F3942AC9643A

Function 04C506F8 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 320
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_$4|, xrefs: 04C507E1

Memory Dump Source

Source File: 00000000.00000002.4505464326.0000000004C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c50000_LisectAVT_2403002A_163.jbxd

Similarity

API ID: CurrentProfile
String ID: _$4|
API String ID: 2104809126-1878515764
Opcode ID: 240e7a9c83e62ea0460cec2b178b3677852f298a9acbd014d2f8e314d28e2d37
Instruction ID: 2b05c09971438bc94f49f4ea19fe7b0f2a7eb280594e1b92d65a5eb0ed8d10b5
Opcode Fuzzy Hash: 240e7a9c83e62ea0460cec2b178b3677852f298a9acbd014d2f8e314d28e2d37
Instruction Fuzzy Hash: 14514AEB20C111BDB10285432B64EFF576EE6D2770738882AFD07D1516F3942EC9643A

Function 04C50745 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 302
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_$4|, xrefs: 04C507E1

Memory Dump Source

Source File: 00000000.00000002.4505464326.0000000004C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c50000_LisectAVT_2403002A_163.jbxd

Similarity

API ID:
String ID: _$4|
API String ID: 0-1878515764
Opcode ID: 9686d742fffeb5e5947d805e7581cc8052951e0d8be3a6c6a2ed6a80faa88e04
Instruction ID: 4f927c3b9ef2ba98afa71cc5f9d8a08f2af44faff600d7d7c3c994a4250b6e79
Opcode Fuzzy Hash: 9686d742fffeb5e5947d805e7581cc8052951e0d8be3a6c6a2ed6a80faa88e04
Instruction Fuzzy Hash: 44516CEB30C111BDB10195532B64EFF57AEE6D2770738882AFD07D2516F3946AC9603A

Function 04C50729 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 299
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_$4|, xrefs: 04C507E1

Memory Dump Source

Source File: 00000000.00000002.4505464326.0000000004C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c50000_LisectAVT_2403002A_163.jbxd

Similarity

API ID: CurrentProfile
String ID: _$4|
API String ID: 2104809126-1878515764
Opcode ID: e8865bd2d7933f1be8a3792bf8f192d26e7432d79d8a7e8b7a3dfade4ccadf71
Instruction ID: 729d76aa563f3df02e66ee1d12b1617e19dfab8f0f959f34f2e9ac47547f75b8
Opcode Fuzzy Hash: e8865bd2d7933f1be8a3792bf8f192d26e7432d79d8a7e8b7a3dfade4ccadf71
Instruction Fuzzy Hash: 9F516AEB20C111BDB10295532B64EFF57AEE6D2770738882AFD07D2516F3946AC9603A

Function 04C50760 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 285
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_$4|, xrefs: 04C507E1

Memory Dump Source

Source File: 00000000.00000002.4505464326.0000000004C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c50000_LisectAVT_2403002A_163.jbxd

Similarity

API ID:
String ID: _$4|
API String ID: 0-1878515764
Opcode ID: ffa7130626d9f3a9d67a0805a3656356514b3030e1c72ce8fd02b48d046ab860
Instruction ID: d9c5097d38689f816befba03dbe8816e4ac30374b801bd0cd18a92c2ca7d30f3
Opcode Fuzzy Hash: ffa7130626d9f3a9d67a0805a3656356514b3030e1c72ce8fd02b48d046ab860
Instruction Fuzzy Hash: 76517CEB20C115BCB10281432B64EFF57AEE6D27707388836FD07D2516F2942EC9647A

Function 04C50769 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 281
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_$4|, xrefs: 04C507E1

Memory Dump Source

Source File: 00000000.00000002.4505464326.0000000004C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c50000_LisectAVT_2403002A_163.jbxd

Similarity

API ID: CurrentProfile
String ID: _$4|
API String ID: 2104809126-1878515764
Opcode ID: 14ee203a0b24db369d8fb530147515552971e4f1cb66d7e62b1bc0078bdab333
Instruction ID: c5eae8bff92d213489ad0a04b7113cdf3336234dcf4b27193dc3d97050480542
Opcode Fuzzy Hash: 14ee203a0b24db369d8fb530147515552971e4f1cb66d7e62b1bc0078bdab333
Instruction Fuzzy Hash: 1C516AEB20C115BCB10285436B64EFF676EE6D27707388826FD07D2516F3942AC9647A

Function 04C507A5 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_$4|, xrefs: 04C507E1

Memory Dump Source

Source File: 00000000.00000002.4505464326.0000000004C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c50000_LisectAVT_2403002A_163.jbxd

Similarity

API ID: CurrentProfile
String ID: _$4|
API String ID: 2104809126-1878515764
Opcode ID: c5a4f84f99467a79031931f1a9f0c162ceedc19b7402a7cc6c8fda3ff59cbac3
Instruction ID: f7eb50d7a07ba89e442cade0e8a88266783c90eabdce447d7ff7c4ea5b26a598
Opcode Fuzzy Hash: c5a4f84f99467a79031931f1a9f0c162ceedc19b7402a7cc6c8fda3ff59cbac3
Instruction Fuzzy Hash: 66518EEB24C1117CB10285436B54EFF6B6EE6D27707388826FC07D5116F2846EC9617A

Function 04C507C3 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 247
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_$4|, xrefs: 04C507E1

Memory Dump Source

Source File: 00000000.00000002.4505464326.0000000004C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c50000_LisectAVT_2403002A_163.jbxd

Similarity

API ID: CurrentProfile
String ID: _$4|
API String ID: 2104809126-1878515764
Opcode ID: aaaeb8968f96ba5febdcdd6b755d6479d9fea8622aa0b712809aed48be602db8
Instruction ID: de15f3ffa7a51e69714eee93fe4f52f19e6c89001ee10a0620d5beb5ed2c2e5e
Opcode Fuzzy Hash: aaaeb8968f96ba5febdcdd6b755d6479d9fea8622aa0b712809aed48be602db8
Instruction Fuzzy Hash: 6C415BEB24C115BCB10285432B64EFF676EE6D2730738883AFD07D1526F2946EC9607A

Function 04C507B1 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 246
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_$4|, xrefs: 04C507E1

Memory Dump Source

Source File: 00000000.00000002.4505464326.0000000004C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c50000_LisectAVT_2403002A_163.jbxd

Similarity

API ID: CurrentProfile
String ID: _$4|
API String ID: 2104809126-1878515764
Opcode ID: cfa317993fff8397aa323c612ba5f12ebf24f9c58382a9ff56814567f0fdae4f
Instruction ID: 4846cb5ac9f7188514198cf887931f46eaf29892ef21ad9a3fdfdc332ee04e1c
Opcode Fuzzy Hash: cfa317993fff8397aa323c612ba5f12ebf24f9c58382a9ff56814567f0fdae4f
Instruction Fuzzy Hash: 43414BEB24C115BCB10281432B64EFF576EE6D67707388436FD07D1526F2846EC9607A

Function 00114623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df5df6b3ff81df0ffd754a9702fb2e35624b70e591c6be74f7bfe7d42bd2f573
Instruction ID: c704f0c6f2771019082144b51c8e4ef4d14fbcdfc16ea98c2b87cc4d953729fc
Opcode Fuzzy Hash: df5df6b3ff81df0ffd754a9702fb2e35624b70e591c6be74f7bfe7d42bd2f573
Instruction Fuzzy Hash: EFB1E670E04249AFDB19DFE8E841BEEBBB1AF59704F144168E5549B292C770AD81CBA0

Function 0002A210 Relevance: 1.7, APIs: 1, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 0002A343

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 38dc4b22c3d6ed092849930564b76598d965698d032374d7aa7c8cf016f6fd9b
Instruction ID: ae9ef950b8e0da575611d6ed28f13e89748a7bdebbddb70b49ce1ca457aff34c
Opcode Fuzzy Hash: 38dc4b22c3d6ed092849930564b76598d965698d032374d7aa7c8cf016f6fd9b
Instruction Fuzzy Hash: 8F717C70A00214AFDB14DF68DC49BAFB7E8EF42710F10856DF8059B682DBB5DA41C7A2

Function 04C507EF Relevance: 1.7, APIs: 1, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4505464326.0000000004C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c50000_LisectAVT_2403002A_163.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 454989915328d72f930a1881ab2f9d0471a69508614fa7a0f72529abfabf70b9
Instruction ID: 23fba6a41b570d23051e3df7a3bf33b45552c5fb015532eac85c6313a07e5b1f
Opcode Fuzzy Hash: 454989915328d72f930a1881ab2f9d0471a69508614fa7a0f72529abfabf70b9
Instruction Fuzzy Hash: 2F412CEB24C115BCB10185436B64EFF676EE6D6B307388826FD07D1516F3846EC96079

Function 04C50810 Relevance: 1.7, APIs: 1, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4505464326.0000000004C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c50000_LisectAVT_2403002A_163.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 32fab0d0cfd7ab06342f8d6672489ed1bcfdaebe19e80076a5bad6ed79d375e0
Instruction ID: 31dbd3a22b49845d99a3d13a55a67496dde6e98436720fa832207012893b2142
Opcode Fuzzy Hash: 32fab0d0cfd7ab06342f8d6672489ed1bcfdaebe19e80076a5bad6ed79d375e0
Instruction Fuzzy Hash: 0A414BEB30C125BCB11185432B60EFF57AEE2D67307388826FC07D1526F3846AC9607A

Function 04C5083E Relevance: 1.7, APIs: 1, Instructions: 203COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C5092A

Memory Dump Source

Source File: 00000000.00000002.4505464326.0000000004C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c50000_LisectAVT_2403002A_163.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 2e7171376ffd36bf3c7b54570031714496f56467e1cd7096eaec9cd81eac1f51
Instruction ID: 77cdf3dd632dd0c91e1b09bfdf5c73cd4184c27b587872afb0fe19d03919065c
Opcode Fuzzy Hash: 2e7171376ffd36bf3c7b54570031714496f56467e1cd7096eaec9cd81eac1f51
Instruction Fuzzy Hash: 49413BEB30C165BCB10285532B54EFF67AEE6D2B307388826FD07D1516F3842A89617A

Function 04C50859 Relevance: 1.7, APIs: 1, Instructions: 201COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C5092A

Memory Dump Source

Source File: 00000000.00000002.4505464326.0000000004C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c50000_LisectAVT_2403002A_163.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 45b16287e7d32b8a8fbad7c8872e03350a2916f16ea484a09d1f1a6655099e8d
Instruction ID: 5b9e045fd61897521384bda92e7058364cd494694d6e16971aa9428577e89149
Opcode Fuzzy Hash: 45b16287e7d32b8a8fbad7c8872e03350a2916f16ea484a09d1f1a6655099e8d
Instruction Fuzzy Hash: 0D311AEB34C125BDB11185432B64EFF67AEE6D2730738882AFC07D1516F3856AC9603A

Function 0011549C Relevance: 1.7, APIs: 1, Instructions: 198fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000000,00109087,?,00000000,00000000,00000000,?,00000000,?,0002A3EB,00109087,00000000,0002A3EB,?,?), ref: 00115621

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d7728ba1009a5c66eae4e9d6c42b3c0da45566ab53f5e138a08c6776a881c38c
Instruction ID: d2c801e467a1c1fe0f6b5c54fab927f8b9a40b7606fa9a0c8cc0c2cad9cdc476
Opcode Fuzzy Hash: d7728ba1009a5c66eae4e9d6c42b3c0da45566ab53f5e138a08c6776a881c38c
Instruction Fuzzy Hash: F061C171D04519EFDF19DFA8C884EEEBBBBAF99304F540169E800A7256D371D981CBA0

Function 04C50905 Relevance: 1.7, APIs: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C5092A

Memory Dump Source

Source File: 00000000.00000002.4505464326.0000000004C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c50000_LisectAVT_2403002A_163.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: be7d9828af38bff367a033df40cb834a71798f72c82c99ff9d9c5255c5f76250
Instruction ID: 83873a174b84bf0beff651c7882805e2b41a8cc972d15c988cf1298fdccd6974
Opcode Fuzzy Hash: be7d9828af38bff367a033df40cb834a71798f72c82c99ff9d9c5255c5f76250
Instruction Fuzzy Hash: D6313BEB30C115BCB11185432B60EFE57AFE6D27307388826FD07D551AF3856AC9607A

Function 04C50890 Relevance: 1.7, APIs: 1, Instructions: 181COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C5092A

Memory Dump Source

Source File: 00000000.00000002.4505464326.0000000004C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c50000_LisectAVT_2403002A_163.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 56a94cdb14f2a5e00e42cd84e6fb1d16e0a92ef498efba253b7bbd09d39535f2
Instruction ID: 1695950836b40b30acc88aea96e59e13f2946d239bb85d03545881fb4dc3a641
Opcode Fuzzy Hash: 56a94cdb14f2a5e00e42cd84e6fb1d16e0a92ef498efba253b7bbd09d39535f2
Instruction Fuzzy Hash: EF3107EB30C121BCB10185432B64EFF57AEE6D2B307388826FC07D151AF3856A89607A

Function 04C508C9 Relevance: 1.7, APIs: 1, Instructions: 175COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C5092A

Memory Dump Source

Source File: 00000000.00000002.4505464326.0000000004C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c50000_LisectAVT_2403002A_163.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: ac5be39bd8b0705b9787082c414ac7596d8f4a0b9c3cc807dce92ec5b021dcb9
Instruction ID: c3a8f838fab4ebb199bc150ab12094ee66a5482d4178f506c9019b27cdeb3c6b
Opcode Fuzzy Hash: ac5be39bd8b0705b9787082c414ac7596d8f4a0b9c3cc807dce92ec5b021dcb9
Instruction Fuzzy Hash: FF314BEB30C125BDB10181832B64EFF57AEE6D6730338882AFC07D511AF3855A89603A

Function 04C508B7 Relevance: 1.7, APIs: 1, Instructions: 173COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C5092A

Memory Dump Source

Source File: 00000000.00000002.4505464326.0000000004C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c50000_LisectAVT_2403002A_163.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 7fc601990c48629fcb18232598bae7df8e4512166f257728ec572fdd3f582b58
Instruction ID: 890ae30ae0f24b1cbde32c1500c00d406430838a590c8391746af41440e93785
Opcode Fuzzy Hash: 7fc601990c48629fcb18232598bae7df8e4512166f257728ec572fdd3f582b58
Instruction Fuzzy Hash: 38311AEB34C121BCB10185432B64EFF57AEE6D27307388826FC07D151AF3846A89643A

Function 04C508E9 Relevance: 1.7, APIs: 1, Instructions: 170COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C5092A

Memory Dump Source

Source File: 00000000.00000002.4505464326.0000000004C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c50000_LisectAVT_2403002A_163.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: fcf85ae936254f6aa7b12d961b2bdc203ee1e96d042eb8ddfbc84bbaa97f6fca
Instruction ID: 094cff802be3afe56d6e39592e3f8af2ffc670ee537ddff85b372f5e72938e17
Opcode Fuzzy Hash: fcf85ae936254f6aa7b12d961b2bdc203ee1e96d042eb8ddfbc84bbaa97f6fca
Instruction Fuzzy Hash: 84315EE730C151BCB14285432F50EFF67AED5D2730338846AFC07D5115F3941A89613A

Function 00104942 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5680664d298a5cf4d142bf44778696749a1fbb439eaa4d61aa2b2e804439b3fb
Instruction ID: ba233d524002e889bc2fad20444506d2d844de01dbefec968e0307d9a42a42a1
Opcode Fuzzy Hash: 5680664d298a5cf4d142bf44778696749a1fbb439eaa4d61aa2b2e804439b3fb
Instruction Fuzzy Hash: D451C8B4B00108EFDF14DF58CCC1AAA7BB1EF59354F258158F98A5B292D3B19E41CB90

Function 00090560 Relevance: 1.6, APIs: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000906AE

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction ID: 28fb4cf4c10eace556036a502cf5ac0f93eab2d7ca73d8923a30892687505022
Opcode Fuzzy Hash: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction Fuzzy Hash: 3341D472A001189FCF15DF68D8806AE7BE5AF89350F150169FC45EB342D770DD60ABE1

Function 00114B12 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,001149F9,00000000,CF830579,00151140,0000000C,00114AB5,00108BBD,?), ref: 00114B68

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: cb44ae0f01028549c9c96333b1c67ec12c57c7dcd662576b835122e962c087ff
Instruction ID: d6e963730decad545ac22abb027e7b7ad2a74c99b108baaef99d3e6d5d527d7a
Opcode Fuzzy Hash: cb44ae0f01028549c9c96333b1c67ec12c57c7dcd662576b835122e962c087ff
Instruction Fuzzy Hash: 6311483264921417D62C22746801FFE6B8A8F92BB4F3A0279F8549B1C2EF60E8C1819D

Function 0010E05C Relevance: 1.6, APIs: 1, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00150DF8,0002A3EB,00000002,0002A3EB,00000000,?,?,?,0010E166,00000000,?,0002A3EB,00000002,00150DF8), ref: 0010E098

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 11a31a49a7d000fa43c68fbcf4cc219b87308b615e50134bf18913a3da644f46
Instruction ID: 7d02c6388e74c275cddb58488702e4bedf9059c134eb2e2fca7303924a52682d
Opcode Fuzzy Hash: 11a31a49a7d000fa43c68fbcf4cc219b87308b615e50134bf18913a3da644f46
Instruction Fuzzy Hash: E701D632714115AFCF199F5ADC05D9E3BAADF81324B250249F8909B2D1EBB2ED419BD0

Function 000FF290 Relevance: 1.6, APIs: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0002220E

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 1125459d3e5761901e290a3259a531ffd300e40fad3cb3d5e7db945a87cd0ec8
Instruction ID: 387f39860ffb1a63e469a098416edf93c7b403ef64935046e8e26742352a4316
Opcode Fuzzy Hash: 1125459d3e5761901e290a3259a531ffd300e40fad3cb3d5e7db945a87cd0ec8
Instruction Fuzzy Hash: 28012B3540030DBBCB24AF98F8019B977EC9F00320F408439FB58DB991E7B0E9649790

Function 001163F3 Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,001091F7,00000000,?,00115D79,00000001,00000364,00000000,00000006,000000FF,?,00000000,0010D244,001089C3,001091F7,00000000), ref: 00116435

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4d25b5ebf20d549e2ad9e7f5391648d1e5c2c1f542172cef05b0d0e94e400e4f
Instruction ID: 86ac2cb51e25eb995a9d605ce5c6e834559027cb9ca252c5fa8125ee6972bc37
Opcode Fuzzy Hash: 4d25b5ebf20d549e2ad9e7f5391648d1e5c2c1f542172cef05b0d0e94e400e4f
Instruction Fuzzy Hash: 84F0E932500224A6DB2D6B62AC02BEB7B489F41760F158031FC08969C0CB32E89182F1

Function 00116E2D Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0011D635,4D88C033,?,0011D635,00000220,?,001157EF,4D88C033), ref: 00116E5F

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4697d1b24e80cb33c329d45a4eb898a77d12f93164795edd45cd44ffe78760dd
Instruction ID: 5b4c8d43957fdc9e5a92baff4a54fd95909f28c0715b6b58cbe2d67be2228a7e
Opcode Fuzzy Hash: 4697d1b24e80cb33c329d45a4eb898a77d12f93164795edd45cd44ffe78760dd
Instruction Fuzzy Hash: ECE02B3A14362166DF386265ED017DB768C8F517B0F160330FC44960D0DF12CCC045E5

Function 04C60119 Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

vL<, xrefs: 04C601E1

Memory Dump Source

Source File: 00000000.00000002.4505584049.0000000004C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c60000_LisectAVT_2403002A_163.jbxd

Similarity

API ID:
String ID: vL<
API String ID: 0-3483418118
Opcode ID: faf49ec15b74a125d314485ec565e6f08de29f5068a69b84966295707c16de16
Instruction ID: d9626c6944f1e378f5dd3d910239f7c4087248b276cc69dc98183e0b047d6206
Opcode Fuzzy Hash: faf49ec15b74a125d314485ec565e6f08de29f5068a69b84966295707c16de16
Instruction Fuzzy Hash: FE11E7EB24C204BDA60395536AD49FB2B6BEAC3734335C467F403E1506F2E41B4AA532

Function 04C600FC Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

vL<, xrefs: 04C601E1

Memory Dump Source

Source File: 00000000.00000002.4505584049.0000000004C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c60000_LisectAVT_2403002A_163.jbxd

Similarity

API ID:
String ID: vL<
API String ID: 0-3483418118
Opcode ID: 1c977d2c40772a29b30a916cedd3dd8b9c086208f31b2151469ea58571387d5d
Instruction ID: c4cf9f53cc2ea95a8d328e645631434829c5ad77fef29e54599dabaa7a2cc76e
Opcode Fuzzy Hash: 1c977d2c40772a29b30a916cedd3dd8b9c086208f31b2151469ea58571387d5d
Instruction Fuzzy Hash: BA11E3EB34C214BDA102D9435ED49FB2B6FEAC2330338C466F403E2006F2A01B4A7472

Function 04C60109 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

vL<, xrefs: 04C601E1

Memory Dump Source

Source File: 00000000.00000002.4505584049.0000000004C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c60000_LisectAVT_2403002A_163.jbxd

Similarity

API ID:
String ID: vL<
API String ID: 0-3483418118
Opcode ID: f98c94b2aa2bf138fcbeb74322f7229bc8a67cda2848043145d711c240820462
Instruction ID: 53c5c0f2217c94a562e242e7e510d76d09ed5bcd85499c3bba4ebaf5b7c51667
Opcode Fuzzy Hash: f98c94b2aa2bf138fcbeb74322f7229bc8a67cda2848043145d711c240820462
Instruction Fuzzy Hash: EE11CAEB34C204BDA502D9576ED49FB276FEAC2730334C556F403E5506F2A4574A7472

Function 04C60135 Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

vL<, xrefs: 04C601E1

Memory Dump Source

Source File: 00000000.00000002.4505584049.0000000004C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c60000_LisectAVT_2403002A_163.jbxd

Similarity

API ID:
String ID: vL<
API String ID: 0-3483418118
Opcode ID: 7aaba766e6cf0c6c3d8bab9af99edce71c69d59e7becc5b58524ddadc2adb523
Instruction ID: 8a30b723ea2a4e0dda9eaada0f0c33cce61f8974b43335b54a83c97ed9c96229
Opcode Fuzzy Hash: 7aaba766e6cf0c6c3d8bab9af99edce71c69d59e7becc5b58524ddadc2adb523
Instruction Fuzzy Hash: 7D01D6AB30C204BDB502D9576AD49FB2B6BEAC2730338C566F403E5506E3A4164AA532

Function 04C60193 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

vL<, xrefs: 04C601E1

Memory Dump Source

Source File: 00000000.00000002.4505584049.0000000004C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c60000_LisectAVT_2403002A_163.jbxd

Similarity

API ID:
String ID: vL<
API String ID: 0-3483418118
Opcode ID: a9cb4a83c9c0f5d4e0635e7a0c8f2e70f2d7596c29d71ee0048e25c54b94a627
Instruction ID: 825971fa5f15fbbd900c0a06ec091f843de41f6e3ee1a4d9b41c040d5c270c35
Opcode Fuzzy Hash: a9cb4a83c9c0f5d4e0635e7a0c8f2e70f2d7596c29d71ee0048e25c54b94a627
Instruction Fuzzy Hash: 4A0140A714C344AFEA029B535DD55FD7B67FF93334338809AE083B6112D6701B479612

Function 04C60180 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

vL<, xrefs: 04C601E1

Memory Dump Source

Source File: 00000000.00000002.4505584049.0000000004C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c60000_LisectAVT_2403002A_163.jbxd

Similarity

API ID:
String ID: vL<
API String ID: 0-3483418118
Opcode ID: c32e31f0870355e122ce024ee6d2f96d5c253018ffee583983e303ba7ee6c079
Instruction ID: 43ca99aa272e9bccf5cf92e189ce2fb5297fbc026d0b4ca81eb502db4667b3fe
Opcode Fuzzy Hash: c32e31f0870355e122ce024ee6d2f96d5c253018ffee583983e303ba7ee6c079
Instruction Fuzzy Hash: 77F050AB208308EDD602DE9399D0AFA3B67EF86230378C142F547B4401F2702746A953

Function 04C6021F Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

vL<, xrefs: 04C601E1

Memory Dump Source

Source File: 00000000.00000002.4505584049.0000000004C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c60000_LisectAVT_2403002A_163.jbxd

Similarity

API ID:
String ID: vL<
API String ID: 0-3483418118
Opcode ID: 3a5df1f8b07f7c733f3b4b969a135bef95e759d7de1e0f0e5c0b1f16a030f343
Instruction ID: dad71d4ba5dcc4c352ba505cdb77625aaefd3fbc22d45fc3f13507f0047f241c
Opcode Fuzzy Hash: 3a5df1f8b07f7c733f3b4b969a135bef95e759d7de1e0f0e5c0b1f16a030f343
Instruction Fuzzy Hash: 35F0C6975452489EC702EDB744D07FD7BD79FC1730338C156D48376405F16057439952

Function 04C60189 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

vL<, xrefs: 04C601E1

Memory Dump Source

Source File: 00000000.00000002.4505584049.0000000004C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c60000_LisectAVT_2403002A_163.jbxd

Similarity

API ID:
String ID: vL<
API String ID: 0-3483418118
Opcode ID: fc63f88710f15e423fea381f14abd2d76aec056a08592edc808e75ed0d022670
Instruction ID: bd6586041984c9a766dca32ccf8a6d7211ebf20e2592a61916c24b0a8e4640ff
Opcode Fuzzy Hash: fc63f88710f15e423fea381f14abd2d76aec056a08592edc808e75ed0d022670
Instruction Fuzzy Hash: D1F0E96B208308EAEA02EE9799D49BA2767EF92330338C552F543B4005E2706646A953

Function 04C601C2 Relevance: 1.3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

Strings

vL<, xrefs: 04C601E1

Memory Dump Source

Source File: 00000000.00000002.4505584049.0000000004C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c60000_LisectAVT_2403002A_163.jbxd

Similarity

API ID:
String ID: vL<
API String ID: 0-3483418118
Opcode ID: 254c8ee6ffa43474a0a640775e4d1a04492a0464269871aac0317e6fe6e2ec0b
Instruction ID: 4df8124b4a2d4e0ca88d2d951d5e61733d514a2907dcdd737079e8ef92face32
Opcode Fuzzy Hash: 254c8ee6ffa43474a0a640775e4d1a04492a0464269871aac0317e6fe6e2ec0b
Instruction Fuzzy Hash: 73F05CD360834CAB9702B6F655E42BD2B8B9F83330338C196E843B6006F1611A42D593

Function 04C6020A Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4505584049.0000000004C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c60000_LisectAVT_2403002A_163.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e07b5f21aadede5ef43eb1985b6436cfaf6cb7907d9e65d9a9be613a4c8435e
Instruction ID: ea0f66dbef2aa0b73f57efd4b67c9fd3acd978c71f36b352395e47fb70db0c19
Opcode Fuzzy Hash: 3e07b5f21aadede5ef43eb1985b6436cfaf6cb7907d9e65d9a9be613a4c8435e
Instruction Fuzzy Hash: 35D02B458190C059D602E37864DC6FD2F4F5FC3128B4891C4D191B140DD184A143C101

Non-executed Functions

Function 00039F50 Relevance: 18.6, Strings: 13, Instructions: 2331COMMON

Download Yara Rule

Strings

,, xrefs: 0003A6AF
131, xrefs: 0003A178, 0003A17F, 0003A190
$, xrefs: 0003BD6D
:, xrefs: 0003A097
irvl, xrefs: 0003A527
arqt, xrefs: 0003A4C7
., xrefs: 0003AB30
., xrefs: 0003B0E2
,, xrefs: 0003A5D2
type must be boolean, but is , xrefs: 0003BF3C, 0003BF6D, 0003C02B
er, xrefs: 0003A659
v|, xrefs: 0003A52E
%s|%s, xrefs: 0003A198

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID:
String ID: $$%s|%s$,$,$.$.$131$:$arqt$er$irvl$type must be boolean, but is $v|
API String ID: 0-4208100968
Opcode ID: c49450e55ee90d85b7c8becbb8583e32486b43ae90da9b5006a9b472a199e0de
Instruction ID: 60c121c4adc8250e6b975baea5afc368c4d1429b36b7e15de1b8682bcefe35ba
Opcode Fuzzy Hash: c49450e55ee90d85b7c8becbb8583e32486b43ae90da9b5006a9b472a199e0de
Instruction Fuzzy Hash: 1023B170D002588FDB66DF68C858BEDBBF8FF06304F148199E549AB292DB359A84CF51

Function 00028D70 Relevance: 9.1, Strings: 7, Instructions: 327COMMON

Download Yara Rule

Strings

eHlW, xrefs: 00028FA2
p, xrefs: 00028DBE
t, xrefs: 00028E37
File, xrefs: 00028F73
lwcf, xrefs: 00028FA9
l, xrefs: 00028FB0
bkg`, xrefs: 00028DB7

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID:
String ID: File$bkg`$eHlW$l$lwcf$p$t
API String ID: 0-3184506882
Opcode ID: dfd9583070a348031dc7588126a4d3ae53c2708e794dc4965957c4e2bb16d6c5
Instruction ID: dc3a98511f9b5112ac668a2e51b89535bf72484f758ad52b78e648d6c0555c2b
Opcode Fuzzy Hash: dfd9583070a348031dc7588126a4d3ae53c2708e794dc4965957c4e2bb16d6c5
Instruction Fuzzy Hash: F5C1CF70D0026DAEEF24DFA4DC85BEEBBB9FF05304F104069E504AB291DBB19A45CB65

Function 000973F0 Relevance: 7.9, APIs: 3, Strings: 1, Instructions: 897COMMON

Download Yara Rule

Strings

unordered_map/set too long, xrefs: 000978C7

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID:
String ID: unordered_map/set too long
API String ID: 0-306623848
Opcode ID: 1d777b36eb0410ee21f0131a301b6142232b75d60e541ff4f5493636f4147767
Instruction ID: efb887b5a1a39a5c2f5c9f9f481dd9a84341a77962dc3b07c018f8efc3be5d30
Opcode Fuzzy Hash: 1d777b36eb0410ee21f0131a301b6142232b75d60e541ff4f5493636f4147767
Instruction Fuzzy Hash: C2626176E046199FCF14DF68C8846AEFBF5FF48310F248269E819AB395D730A951CB90

Function 001084A0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction ID: 0d59089133143de85db3d0dcd91ab35c300338eb5e1ee36cb7234661192a340d
Opcode Fuzzy Hash: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction Fuzzy Hash: CE024C71E042199BDF14CFA8C8806AEFBF1FF48314F25826AD599E7381DB71A941CB90

Function 000950B0 Relevance: 5.3, Strings: 4, Instructions: 268COMMON

Download Yara Rule

Strings

type must be string, but is , xrefs: 00095114
/Kim, xrefs: 000952C2
/Kim, xrefs: 000952A9
type must be number, but is , xrefs: 00095241

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID:
String ID: /Kim$/Kim$type must be number, but is $type must be string, but is
API String ID: 0-1144537432
Opcode ID: 3d632a8fa34c5cc2c817aef7d77c5f0fc1112215f14c5fbf828e2739d4cc2844
Instruction ID: c70e2dce686a067ecaccf7f049cc9fe62509ad45643b385d64a5180fd35dbe50
Opcode Fuzzy Hash: 3d632a8fa34c5cc2c817aef7d77c5f0fc1112215f14c5fbf828e2739d4cc2844
Instruction Fuzzy Hash: 7C911472E006189FCB08CF6DDC917DDBBA9EB89310F14826EE819D7391EB759905CB80

Function 000291A0 Relevance: 4.9, Strings: 3, Instructions: 1146COMMON

Download Yara Rule

Strings

/\/, xrefs: 0002956A, 0002959C
\, xrefs: 00029528
/, xrefs: 000294E2

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID:
String ID: /$/\/$\
API String ID: 0-1523196992
Opcode ID: 7835f2f5f22b533d0f2f922c88bcc4156f0bfd30c9fb3c424b6b4cd009d572e9
Instruction ID: 8fc32ea1e2afa308cec51f572ab46672763e2dd9d7983da0b58bf73e449fcc00
Opcode Fuzzy Hash: 7835f2f5f22b533d0f2f922c88bcc4156f0bfd30c9fb3c424b6b4cd009d572e9
Instruction Fuzzy Hash: 7292F371D002688FDF19CFA8D894BEEBBF5BF45314F1442ADD445AB282E7315A46CBA0

Function 000A55B0 Relevance: 3.9, Strings: 3, Instructions: 187COMMON

Download Yara Rule

Strings

eIcm, xrefs: 000A5835
yNrw, xrefs: 000A5764
`ic, xrefs: 000A583C

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID:
String ID: `ic$eIcm$yNrw
API String ID: 0-2666854388
Opcode ID: c25348e252f3a17523f23c823acedce5b114ebd6b3e5deacde7f95df2974087e
Instruction ID: 5c6b1f6592eaf51e201e4e739093f91584922bb4a9ec01486ef8ff42fdf1dac0
Opcode Fuzzy Hash: c25348e252f3a17523f23c823acedce5b114ebd6b3e5deacde7f95df2974087e
Instruction Fuzzy Hash: D9815CB0C1834CAEDF04CFA4D8456EEBBB9EF56304F50809ED841AB691D779434ACBA5

Function 0010BEAF Relevance: 1.5, Strings: 1, Instructions: 293COMMON

Download Yara Rule

Strings

0, xrefs: 0010C01F

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 77aeccf53a57f23641d3bbd2b494d74b55016c6c4c27fe50736ad374174d3ced
Instruction ID: 939b9e01ccf7081555e4ca82a4bea82efde8ad3cb7a68e3ee61920ba0137ba98
Opcode Fuzzy Hash: 77aeccf53a57f23641d3bbd2b494d74b55016c6c4c27fe50736ad374174d3ced
Instruction Fuzzy Hash: 16B1AD74A0464ACFCB28CF68C880ABAB7B1EF15310F144719E9E6972D2C7B1A945CF91

Function 000FF26A Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,?,000FEC78,?,?,?,?,000340EB,?,00083C2E), ref: 000FF283

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: f8373770fbbeddc4dd18691d2a88d346c97d7bca29e86187cb16acaf10901583
Instruction ID: d3c60642193a093c63de0aedfc9c257ca45a7a9e60c04214f58130d8d9536380
Opcode Fuzzy Hash: f8373770fbbeddc4dd18691d2a88d346c97d7bca29e86187cb16acaf10901583
Instruction Fuzzy Hash: 59D0223358113CA38AF13BC4EC0087DBB689F09BD0340403FEA0957924DA116C01EBD4

Function 000A9880 Relevance: .7, Instructions: 748COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 324fda5de72cdb788e34d7d190746c0adaacdca038c6445bc5913a83b91f1e5c
Instruction ID: dea53d8f96d02d2017452ee06d24a3b684f505b8fc47b2cff9abb4816e2f6041
Opcode Fuzzy Hash: 324fda5de72cdb788e34d7d190746c0adaacdca038c6445bc5913a83b91f1e5c
Instruction Fuzzy Hash: 7E6291B0F002049FDB54CF99C5846ADBBF1AF8A304F2881ADD815AB386D735D946CF91

Function 00119824 Relevance: .3, Instructions: 270COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70b6451b1101287022d949ea5f9bf951cba9cb87a621b2f59f215e4123a75e60
Instruction ID: 039758f842f05305be446597890d1d007348298fc392b787f415941a1d82d108
Opcode Fuzzy Hash: 70b6451b1101287022d949ea5f9bf951cba9cb87a621b2f59f215e4123a75e60
Instruction Fuzzy Hash: 27B12A316106089FD719CF28C496BA57BE0FF45364F29866CE8AACF2A1C335E995CB40

Function 000224F0 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fde1f246163c47add8a3364d6f64b4200d21ac24ad19db63412b45619989ae58
Instruction ID: 57acb74c9f0583a3822c541722dc33f1d0c7d45481964a6521d1839b7109ce6d
Opcode Fuzzy Hash: fde1f246163c47add8a3364d6f64b4200d21ac24ad19db63412b45619989ae58
Instruction Fuzzy Hash: 7B7143B5E04666AFDB14CFA8E8D47FEBBB4EB19304F000169D86497743C734894AC7A0

Function 000A6550 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24ce66532752490cfd0a468724e13a769b1c9c2c8f166097e0f946ec8cf0c7c9
Instruction ID: 0ca513c7bf9cca891e54a338d25068266848b70d6de2d3781651051fcd32e4f4
Opcode Fuzzy Hash: 24ce66532752490cfd0a468724e13a769b1c9c2c8f166097e0f946ec8cf0c7c9
Instruction Fuzzy Hash: DF6180716141648FD718CF5EECC05263361A78A32138A422AEBC0DB7A6D735E966D7E0

Function 00034100 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df384dc6599e5ee047282731b178ead84372e094354c22c40a7728cb85e9aa1a
Instruction ID: c85d106914a5301e018f54ebd34c657cffc61528e0ca633cc430d0667ac6d409
Opcode Fuzzy Hash: df384dc6599e5ee047282731b178ead84372e094354c22c40a7728cb85e9aa1a
Instruction Fuzzy Hash: 9E51BC71E002099FCB19DF98D881AEEBBB9FB88310F14456DE419BB351D730AA44CBA0

Function 0010646A Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 920c44e739ca4d08db5b5969fbc7a5a158caad0a814d8dad7807257cb044add9
Instruction ID: b30cacc571e6b2c8896a61230ba7ab40531f15dbcc63e0843f11c13f4e9fb5b2
Opcode Fuzzy Hash: 920c44e739ca4d08db5b5969fbc7a5a158caad0a814d8dad7807257cb044add9
Instruction Fuzzy Hash: B5518D72E00219EFDF14CF98CD41AEEBBB2FF88350F198458E955AB241D774AA50CB90

Function 00102CE0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 763b3e2c8dca7185d9998ba1807563b591b4a0c2a9c9e0d90d18f6c40c299f8a
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: EE1108B724048243D6148AADD8BC6B6A395EAD632472D836AD0C14B6D8E3F2DD459700

Function 0008F810 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0008F833
std::_Lockit::_Lockit.LIBCPMT ref: 0008F855
std::_Lockit::~_Lockit.LIBCPMT ref: 0008F875
std::_Lockit::~_Lockit.LIBCPMT ref: 0008F89F
std::_Lockit::_Lockit.LIBCPMT ref: 0008F90D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0008F959
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0008F973
std::_Lockit::~_Lockit.LIBCPMT ref: 0008FA08
std::_Facet_Register.LIBCPMT ref: 0008FA15

Strings

Ps, xrefs: 0008F96B, 0008F972
bad locale name, xrefs: 0008FA2F

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$Ps
API String ID: 3375549084-1174896957
Opcode ID: 7cc65533d950c0cd34bbe87c433f160ad0065744080068234088ee791846f120
Instruction ID: 12ce321211f8447f6149fa1bd6ff6eadf106f7650ca40f2ecbe65fc813fec00d
Opcode Fuzzy Hash: 7cc65533d950c0cd34bbe87c433f160ad0065744080068234088ee791846f120
Instruction Fuzzy Hash: 88618071D00249DBEF10EFA4D845BAEBBF4BF14314F144069E885AB792EB74E905CBA1

Function 0008DE70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0008DE93
std::_Lockit::_Lockit.LIBCPMT ref: 0008DEB6
std::_Lockit::~_Lockit.LIBCPMT ref: 0008DED6
std::_Facet_Register.LIBCPMT ref: 0008DF4B
std::_Lockit::~_Lockit.LIBCPMT ref: 0008DF63
Concurrency::cancel_current_task.LIBCPMT ref: 0008DF7B

Strings

hm, xrefs: 0008DEA5, 0008DF5A

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID: hm
API String ID: 2081738530-3525250708
Opcode ID: ca7711a7e8fbc4c52d2f849bc38bf480b75aaa2bf5992295dfbdffe95344060d
Instruction ID: e243d82b781a64157f7661f62a7e5908cd684a48009b0d846fbf15cbe258150f
Opcode Fuzzy Hash: ca7711a7e8fbc4c52d2f849bc38bf480b75aaa2bf5992295dfbdffe95344060d
Instruction Fuzzy Hash: F2410271900219DFCB14EF54E845AAEBBB4FB10320F14436AEA569B793DB30AD40CBD1

Function 000239F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00023A58
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00023AA4
__Getctype.LIBCPMT ref: 00023ABA
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00023AE6
std::_Lockit::~_Lockit.LIBCPMT ref: 00023B7B

Strings

bad locale name, xrefs: 00023B96

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: c540fabe29e89354eb2240eaffc56894b4a634dfd6691ce2e83d3a573bc52e53
Instruction ID: e47ff28aca9175646f0d56e44b22a691088a7339977b30f1a6c910f682cda059
Opcode Fuzzy Hash: c540fabe29e89354eb2240eaffc56894b4a634dfd6691ce2e83d3a573bc52e53
Instruction Fuzzy Hash: E65140B1D002589BDF10DFE4E985B9EBBF8BF14314F144069E909AB382E779DA04CB51

Function 00102E10 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00102E47
___except_validate_context_record.LIBVCRUNTIME ref: 00102E4F
_ValidateLocalCookies.LIBCMT ref: 00102ED8
__IsNonwritableInCurrentImage.LIBCMT ref: 00102F03
_ValidateLocalCookies.LIBCMT ref: 00102F58

Strings

csm, xrefs: 00102EED

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 96a27c5d08a4a18fb9b179a9d56e417c50f78688f7b412b5cb4bfebfe5aa2f1c
Instruction ID: d70ab83d7f3904795edc366e872ac9f0354f2ff350e059ec5bbb29faebe5246a
Opcode Fuzzy Hash: 96a27c5d08a4a18fb9b179a9d56e417c50f78688f7b412b5cb4bfebfe5aa2f1c
Instruction Fuzzy Hash: 36410430A00209ABCF10DF68C889A9EBBB5BF55324F148055F858AB3D2D7B1EE55CB91

Function 00024C50 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 442COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00024F72
___std_exception_destroy.LIBVCRUNTIME ref: 00024FFF
___std_exception_copy.LIBVCRUNTIME ref: 000250C8

Strings

recursive_directory_iterator::operator++, xrefs: 0002504C

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$___std_exception_copy
String ID: recursive_directory_iterator::operator++
API String ID: 1206660477-953255998
Opcode ID: 83b2a088aa5cf887b54c6a86321f062eccacc4edddd22b3d3d067cb800747faf
Instruction ID: 465f2ecad87e1cf914c7820e0cd4132a1a13f6daf4da0e26a26b8e4260d06f50
Opcode Fuzzy Hash: 83b2a088aa5cf887b54c6a86321f062eccacc4edddd22b3d3d067cb800747faf
Instruction Fuzzy Hash: 86E138719006149FDB18DF68E885BAEFBF9FF44700F10462DE45693B82D774A944CBA1

Function 00027820 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0002799A
___std_exception_copy.LIBVCRUNTIME ref: 00027B75

Strings

type_error, xrefs: 0002784A
out_of_range, xrefs: 00027A27

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: out_of_range$type_error
API String ID: 2659868963-3702451861
Opcode ID: 35b43859bca95f19c59053b7e7f109b027ad4dd5c699de015503e54003f9b2c2
Instruction ID: 665fa572f021aa8e90b36eddeec85d18aa92e3f256b39c7afee1328650dc5af1
Opcode Fuzzy Hash: 35b43859bca95f19c59053b7e7f109b027ad4dd5c699de015503e54003f9b2c2
Instruction Fuzzy Hash: F3C17AB19002188FDB18CFA8E98479DFBF5FF49310F14866AE459EB792E7749980CB50

Function 000273B0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 000275BE
___std_exception_destroy.LIBVCRUNTIME ref: 000275CD

Strings

, column , xrefs: 00027434, 0002744A
at line , xrefs: 000273F7

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column
API String ID: 4194217158-191570568
Opcode ID: 76394e7db44b8b91f74c9989c411f38b6d1d9cf59f88cb8e671838acf4e8a886
Instruction ID: ef11812bae594b725c23b89678522c4542c9e83889b90886aad57fbc144ff94c
Opcode Fuzzy Hash: 76394e7db44b8b91f74c9989c411f38b6d1d9cf59f88cb8e671838acf4e8a886
Instruction Fuzzy Hash: 3361E671A046159FDB08DF68ED85BADFBB6FF44300F24462CE419A7B82D774AA40CB91

Function 00023D10 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00023E7F

Strings

ios_base::badbit set, xrefs: 00023E17
ios_base::eofbit set, xrefs: 00023E41, 00023E63
ios_base::failbit set, xrefs: 00023D32

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: a056969ac364957b564a10176372a702c34e9cf9fcef845235f4b1d29bb6f724
Instruction ID: 59f4acd7fc59ead70ae572470676cc3cda3be9050b5d3fee6c4a22715e00e8af
Opcode Fuzzy Hash: a056969ac364957b564a10176372a702c34e9cf9fcef845235f4b1d29bb6f724
Instruction Fuzzy Hash: EE4108B2500218AFCB14DF58E845BEEB7F8EF08710F14852EF955E7781E774AA158BA0

Function 00023DE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00023E7F

Strings

ios_base::badbit set, xrefs: 00023E17
ios_base::eofbit set, xrefs: 00023E28, 00023E41, 00023E63
ios_base::failbit set, xrefs: 00023D32, 00023E1E

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: 5bfcc646f8349681080598651170d3b91f3974fcee62c8dad18919aba16fa9c0
Instruction ID: e9b922844ea076c70ebc84cd8048119d2c07dc87bac1a9888801da6e004e5512
Opcode Fuzzy Hash: 5bfcc646f8349681080598651170d3b91f3974fcee62c8dad18919aba16fa9c0
Instruction Fuzzy Hash: 1021EEB25003146FC714DF54E805B96B7ECAF18310F14883EFA6897681E7B4E924CB91

Function 00026F40 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 349COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00027340

Strings

parse error, xrefs: 00026FFF, 00027018
parse_error, xrefs: 00026F8B

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: parse error$parse_error
API String ID: 2659868963-1820534363
Opcode ID: bbc4cb21e1fcd34999e8ab6ef87ce7308c33ed9acb671ec825fbf0d597b10568
Instruction ID: cbe93095b75fde0a0e8ca53e336a2d7189429c55a3136fb73931167ceca29fae
Opcode Fuzzy Hash: bbc4cb21e1fcd34999e8ab6ef87ce7308c33ed9acb671ec825fbf0d597b10568
Instruction Fuzzy Hash: 35E16E70904218CFDB18CF68D985BADBBB1FF49300F248269E418EB792D7749A85CF91

Function 00026C60 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00026F11
___std_exception_destroy.LIBVCRUNTIME ref: 00026F20

Strings

[json.exception., xrefs: 00026CB8

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.
API String ID: 4194217158-791563284
Opcode ID: 1de25360a1277695d9e931091b64b934356468cca6032ebed38c6de5bb01297d
Instruction ID: ab70f7dc87957bca8a2d7328e0298ed495019134233c4099a61e945c70dbee15
Opcode Fuzzy Hash: 1de25360a1277695d9e931091b64b934356468cca6032ebed38c6de5bb01297d
Instruction Fuzzy Hash: D591D670A002189FDB18CF68E984BAEFBF6FF45300F20856DE455AB792D775A981CB50

Function 0009B450 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 190COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0009B612

Strings

Px, xrefs: 0009B456, 0009B5BA, 0009B5F3, 0009B54A, 0009B4F1
invalid hash bucket count, xrefs: 0009B60D

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_
String ID: Px$invalid hash bucket count
API String ID: 909987262-389788087
Opcode ID: e4ac8d967d98b3bafb97c98fdb250f8470ed05c350d17f7ba64dafae2b59cb07
Instruction ID: 9c626dc29e5458a32a8e307ec2a022b6eb59cf5d15700aae939493b2767dc15e
Opcode Fuzzy Hash: e4ac8d967d98b3bafb97c98fdb250f8470ed05c350d17f7ba64dafae2b59cb07
Instruction Fuzzy Hash: CE7112B4A00A09DFCB14CF49D280969FBF5FF88310725C5AAD8599B356D731EA41DF90

Function 0009E440 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0009E491

Strings

type must be string, but is , xrefs: 0009E4F8
type must be boolean, but is , xrefs: 0009E582

Memory Dump Source

Source File: 00000000.00000002.4496519840.0000000000021000.00000040.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.4496419036.0000000000020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496519840.0000000000153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4496955708.0000000000158000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000002EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.0000000000411000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4497020630.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498082086.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4498439642.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_LisectAVT_2403002A_163.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: type must be boolean, but is $type must be string, but is
API String ID: 118556049-436076039
Opcode ID: 973f6e62bb7736b0556e918a3b33da03a3717bb4e6114da2e926b484851c48e4
Instruction ID: 2bebb9e394723ab979d9c6477d9aa6d598cfe81bfcd3bafd386a8decac498aed
Opcode Fuzzy Hash: 973f6e62bb7736b0556e918a3b33da03a3717bb4e6114da2e926b484851c48e4
Instruction Fuzzy Hash: F5414DB1900288AFDB14EBA4E802BEE77A8EB14310F144679F515D7783EB35EE54C792

Analysis Process: MPGPH131.exePID: 5044, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	4.4%
Signature Coverage:	0%
Total number of Nodes:	684
Total number of Limit Nodes:	68

Executed Functions

Function 00233A40 Relevance: 2.7, APIs: 2, Instructions: 157
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E9,?,00000001,00000000,?,?,?,?,?,?,?,?,00233DB6), ref: 00233B08
Sleep.KERNELBASE(00000001,?,00000001,00000000,?,?,?,?,?,?,?,?,00233DB6), ref: 00233BBA

Memory Dump Source

Source File: 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000006.00000002.4496423630.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496522566.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496985101.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498257150.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498654718.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: cbd2b23227c764163b82e565c730d7ba753fdfafe39d21a207f76f9d9eaa47c1
Instruction ID: 58d5852b723b6fdec65a74df0628abc1d573342b87fb31bf3977db330849752b
Opcode Fuzzy Hash: cbd2b23227c764163b82e565c730d7ba753fdfafe39d21a207f76f9d9eaa47c1
Instruction Fuzzy Hash: A0519675A1421A8FCB24CF58C8D0EAAB3B2EF44708F29459AD485AB251D731EF55CB80

Function 001EE0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 001EE0CB
socket.WS2_32(?,?,?), ref: 001EE17F
connect.WS2_32(00000000,?,?), ref: 001EE193
closesocket.WS2_32(00000000), ref: 001EE19E

Memory Dump Source

Source File: 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000006.00000002.4496423630.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496522566.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496985101.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498257150.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498654718.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: 9b8e2b9f8ccdf9c5a564572cf346d5f70fc44e7ee85e290a615afeddcc7e8f3b
Instruction ID: dc1f3863cb5e9b841858c2b9ce61eb8309fc2f6e8c0407ceba41b320d2aab978
Opcode Fuzzy Hash: 9b8e2b9f8ccdf9c5a564572cf346d5f70fc44e7ee85e290a615afeddcc7e8f3b
Instruction Fuzzy Hash: 9D31C171605701AFDB209F298C89B2FB7E4EB85334F015F1DF9A8962E0D33198588B92

Function 002B4942 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

O+, xrefs: 002B4A93, 002B4A61, 002B4AAB, 002B4AC7

Memory Dump Source

Source File: 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000006.00000002.4496423630.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496522566.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496985101.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498257150.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498654718.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID: O+
API String ID: 0-697038414
Opcode ID: e021ecfa5ae017e001fb840f4414eb879ae0bf42ed5c1816f6b4ffe798e2c149
Instruction ID: 3d59fa5a25dffccc328096298d04b9be64e953d814d56c4d2afc959d9de2488e
Opcode Fuzzy Hash: e021ecfa5ae017e001fb840f4414eb879ae0bf42ed5c1816f6b4ffe798e2c149
Instruction Fuzzy Hash: F451E530A10108AFDB14EF58CCD5AEABBB5EF49394F248159F8499B253D371AE61CB90

Function 002C4623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000006.00000002.4496423630.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496522566.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496985101.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498257150.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498654718.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbce2af66386c4f071460924e1e42ed86b4ab3c8bcd8bbaa8e3d6c0f0084af9a
Instruction ID: 1eec5694859d31e97e17caa79805bfb6e964844960e34c4e010c58581e0cc330
Opcode Fuzzy Hash: cbce2af66386c4f071460924e1e42ed86b4ab3c8bcd8bbaa8e3d6c0f0084af9a
Instruction Fuzzy Hash: E2B1EF70A24286AFDB11EFA8D861FEFBBB5AF45310F14435DE844A7286C7709961CF60

Function 001DA210 Relevance: 1.7, APIs: 1, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 001DA343

Memory Dump Source

Source File: 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000006.00000002.4496423630.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496522566.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496985101.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498257150.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498654718.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: d94903c21dad1e32ad96972abe475de2cd049062c9e2d6094e54a5041463c5f3
Instruction ID: f6fc30bbc52a47073bc3d09f67c4d993488205b205a52b07a0ab8d25065d111f
Opcode Fuzzy Hash: d94903c21dad1e32ad96972abe475de2cd049062c9e2d6094e54a5041463c5f3
Instruction Fuzzy Hash: 39716971910204AFDB14DF68CC49BAEB7E9EF41340F54856EF8089B382D7B5DA41CB92

Function 055505E2 Relevance: 1.7, APIs: 1, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.4505887367.0000000005550000.00000040.00001000.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5550000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ede16bad1e53b09965d13fd1d0e9205211c4d9b0fc451735c7a7c60449aba505
Instruction ID: 772010e2aa013a85d0a9e771347a198dda59ef75fe8e3f16edf3c974dbff6166
Opcode Fuzzy Hash: ede16bad1e53b09965d13fd1d0e9205211c4d9b0fc451735c7a7c60449aba505
Instruction Fuzzy Hash: 2841F3F724C211BDA212D5511B7CAFA276FF6D27307308C2BFC03C65A2E2940A4E55B1

Function 05550644 Relevance: 1.7, APIs: 1, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.4505887367.0000000005550000.00000040.00001000.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5550000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a4d4fb69204f39f3a39e9d0901973500c8e18f551b3397f4d7f9f722c048b9f
Instruction ID: ecd238f1915baab819f46807a5bb6f5af2d95c74631d2a4e9960336b57aa8941
Opcode Fuzzy Hash: 5a4d4fb69204f39f3a39e9d0901973500c8e18f551b3397f4d7f9f722c048b9f
Instruction Fuzzy Hash: 985129B724C211BEA211D551577CAF6676FFBD23307308C2BFC03C65A2E2944A4E55B1

Function 055505DD Relevance: 1.7, APIs: 1, Instructions: 221
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.4505887367.0000000005550000.00000040.00001000.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5550000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 781348ef2e2a893dac87d9f9756827b190d25ca30cb69a6b0d6cf044aa2a3e3c
Instruction ID: 302a8f846235402e27be5334d9832c603eb0c4a030c2ffa2d5361e65b8fcf60a
Opcode Fuzzy Hash: 781348ef2e2a893dac87d9f9756827b190d25ca30cb69a6b0d6cf044aa2a3e3c
Instruction Fuzzy Hash: 4941C0B724C211BEA211D5526A7CAFA676FF6D27307308C2BFC03C65A2E2940A4E55B1

Function 055505FE Relevance: 1.7, APIs: 1, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.4505887367.0000000005550000.00000040.00001000.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5550000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 361b5c81c8be573c0b40275af569d56f07e683eb2b8d2d66e509e2fd6191a1fa
Instruction ID: 913114036b2a9786269faecbf9e711c4ec4b8054501a538715e102aacb68a3dc
Opcode Fuzzy Hash: 361b5c81c8be573c0b40275af569d56f07e683eb2b8d2d66e509e2fd6191a1fa
Instruction Fuzzy Hash: 0E412AB724C211BEA201D5615B7CAFA676FFBD27307308C2BFC03C65A2E2944A4E55B1

Function 05550625 Relevance: 1.7, APIs: 1, Instructions: 209
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.4505887367.0000000005550000.00000040.00001000.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5550000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e52fa6dfb70e007e3df0601ee701cf31ae249c38dd199b84c2eeffcf8d9c8f3
Instruction ID: ec01e972e56a12b690cf7854bbb56a76726009c4cd8abb47d41c6cb269b8ddee
Opcode Fuzzy Hash: 5e52fa6dfb70e007e3df0601ee701cf31ae249c38dd199b84c2eeffcf8d9c8f3
Instruction Fuzzy Hash: 7F41E4B724C211BEA211D5516B7CAFA676FFBD27307308C2BF803C65A2E2944A4E55B1

Function 05550631 Relevance: 1.7, APIs: 1, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.4505887367.0000000005550000.00000040.00001000.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5550000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33bd0dfb3ad8e1745c86becead827ea34579c7c16914eb405d2aa99838b2b3f7
Instruction ID: 222bd5e671c3da26496bdf142f1ce15f1d04f374c5f2da992dbac3a5457e53eb
Opcode Fuzzy Hash: 33bd0dfb3ad8e1745c86becead827ea34579c7c16914eb405d2aa99838b2b3f7
Instruction Fuzzy Hash: 8D41E5B724C211BEA211D5515B7CAFA676FFBD27307308C2BFC03C65A2E2944A4E55B1

Function 002C549C Relevance: 1.7, APIs: 1, Instructions: 198
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000000,002B9087,?,00000000,00000000,00000000,?,00000000,?,001DA3EB,002B9087,00000000,001DA3EB,?,?), ref: 002C5621

Memory Dump Source

Source File: 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000006.00000002.4496423630.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496522566.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496985101.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498257150.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498654718.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: b6a3f53bd7ffe5a7867a8cb4df4a9c5db8ae7d68f96da61d61ca155b4e33a6eb
Instruction ID: 0b2bf8ecbf409e0eff72e725c6d0b3b100a44fc7f8e8ebd2977f33dae01c085e
Opcode Fuzzy Hash: b6a3f53bd7ffe5a7867a8cb4df4a9c5db8ae7d68f96da61d61ca155b4e33a6eb
Instruction Fuzzy Hash: 8961C871D2052AAFDF15DFA8C844FEEBBB9AF05344F54024DE804A7215D371E9A1CBA0

Function 05550672 Relevance: 1.7, APIs: 1, Instructions: 190
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.4505887367.0000000005550000.00000040.00001000.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5550000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f426e69c676a455771f671be96908f92c798c3e3867c3eaf4e1436ac50cb991f
Instruction ID: e0a05e04cf8be2e0b00582b4033fa11684a052aa8379e58635262a4a1bd64c89
Opcode Fuzzy Hash: f426e69c676a455771f671be96908f92c798c3e3867c3eaf4e1436ac50cb991f
Instruction Fuzzy Hash: 8741E5B754C211BDB211D5515B7CAFA676FF7D2330730882BF803C5592E3940A4E55B1

Function 055506B8 Relevance: 1.7, APIs: 1, Instructions: 174
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.4505887367.0000000005550000.00000040.00001000.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5550000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05b87d5cce0a668ca9655c9bc5b7b995d60e8a9a0bfa47a2ed5d29611650dd64
Instruction ID: 04238e435f0c198f72a12cea910f772d3fb2b70ee9d9f1c8b06366977507106f
Opcode Fuzzy Hash: 05b87d5cce0a668ca9655c9bc5b7b995d60e8a9a0bfa47a2ed5d29611650dd64
Instruction Fuzzy Hash: 1031E0B7148214BDB211C5516B68EFA67AFF6D6730730882BF803D66A2E3900A8D59B1

Function 05550688 Relevance: 1.7, APIs: 1, Instructions: 173
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(0000D31D), ref: 05550867

Memory Dump Source

Source File: 00000006.00000002.4505887367.0000000005550000.00000040.00001000.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5550000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 0604a58f7497522961b0274baed858a7f7ec0899675d411b3c937c1c880b80ec
Instruction ID: b3309e682fad6350996e3c07b1185fa13d609f3691e1cfc811ac99d0e4ae8c09
Opcode Fuzzy Hash: 0604a58f7497522961b0274baed858a7f7ec0899675d411b3c937c1c880b80ec
Instruction Fuzzy Hash: 8231DDFB14C211BDB102D1922B3CEFA676FF6D67307308C2BB803D56A2E2940A8D55B1

Function 055506C0 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(0000D31D), ref: 05550867

Memory Dump Source

Source File: 00000006.00000002.4505887367.0000000005550000.00000040.00001000.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5550000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 2b215db421f43e1036faf4446dafc861bc29a30f8dbf45af031e26a99b64afee
Instruction ID: 94499797a1b7cfea4a44290d695585cecbec624ae5b7a2488d9dfc4e59d32fb7
Opcode Fuzzy Hash: 2b215db421f43e1036faf4446dafc861bc29a30f8dbf45af031e26a99b64afee
Instruction Fuzzy Hash: 5331F3B7148214BDB201C6515B68EFA677FF7D67307308C2BF803D6292E7900A8D59B1

Function 055506A6 Relevance: 1.7, APIs: 1, Instructions: 170COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(0000D31D), ref: 05550867

Memory Dump Source

Source File: 00000006.00000002.4505887367.0000000005550000.00000040.00001000.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5550000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 9154d203c6d0216083319044c0c5aaf05de5db5dfe158868868589aaea9abb13
Instruction ID: 2cf6b63f89464e71493d2fb2c57bfab9b8acafc6b35e6cc0a314636ff7b08fae
Opcode Fuzzy Hash: 9154d203c6d0216083319044c0c5aaf05de5db5dfe158868868589aaea9abb13
Instruction Fuzzy Hash: D231DDBB248215BDB101D1512B7CEFB676FF6D67307308C2BB803D5592E2940A8E55B1

Function 05550705 Relevance: 1.7, APIs: 1, Instructions: 160COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(0000D31D), ref: 05550867

Memory Dump Source

Source File: 00000006.00000002.4505887367.0000000005550000.00000040.00001000.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5550000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: e06343ec7c84e728df3f004f538834d5442749688ba010a3655d5e2f0f1b7ff4
Instruction ID: 63af3bf57b4040807cbcb9f4cb3054bdc5e2cb1cb944a9652fcf6445f49dfd5d
Opcode Fuzzy Hash: e06343ec7c84e728df3f004f538834d5442749688ba010a3655d5e2f0f1b7ff4
Instruction Fuzzy Hash: AF31E4BB24C211BDB111C5916B6CEF6677FF7D6730730882BF803D6192E3940A8A95B1

Function 05550724 Relevance: 1.7, APIs: 1, Instructions: 151COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(0000D31D), ref: 05550867

Memory Dump Source

Source File: 00000006.00000002.4505887367.0000000005550000.00000040.00001000.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5550000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 6deafdff27f1b21310d240fbdc2395d86742d58605fd8f2adc54c11f50252dc1
Instruction ID: e91e0514406852cbf9ab1d5ac920c68184c0cce505752f77ccd8d88586513268
Opcode Fuzzy Hash: 6deafdff27f1b21310d240fbdc2395d86742d58605fd8f2adc54c11f50252dc1
Instruction Fuzzy Hash: F1319EFB248215BDB112D1912B6CEFA676FF6D2730730882BF803D5592E6940A8E55B2

Function 0555074E Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(0000D31D), ref: 05550867

Memory Dump Source

Source File: 00000006.00000002.4505887367.0000000005550000.00000040.00001000.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5550000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 609018f123b3e59c1ed13f7f1ae6237e76af3949c8da8f60ee42529aff2de1ef
Instruction ID: 4e5488b3481429994bbb3de1fbbe7ae433db8a7bd24b7d7536b0a65fd99765f1
Opcode Fuzzy Hash: 609018f123b3e59c1ed13f7f1ae6237e76af3949c8da8f60ee42529aff2de1ef
Instruction Fuzzy Hash: 7A21AEFB248211BDB102D5916B6CEFB676FF7D2730B30882BF803C6552E7944A8A55B1

Function 05550737 Relevance: 1.6, APIs: 1, Instructions: 142COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(0000D31D), ref: 05550867

Memory Dump Source

Source File: 00000006.00000002.4505887367.0000000005550000.00000040.00001000.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5550000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 85a34fdac45f8793d1edf6221de23be727bd34adb87cfe2c54d9304f87f0f544
Instruction ID: 294bea5d726db3d2484ad3ad2d76f43a0bb126bcba79e5fcb6deab821aea14c3
Opcode Fuzzy Hash: 85a34fdac45f8793d1edf6221de23be727bd34adb87cfe2c54d9304f87f0f544
Instruction Fuzzy Hash: 1C21CEBB24C211BDB111C5912B28EFA676FF7D2730B30882BF803C6192E7940A8E55B1

Function 05550799 Relevance: 1.6, APIs: 1, Instructions: 142COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(0000D31D), ref: 05550867

Memory Dump Source

Source File: 00000006.00000002.4505887367.0000000005550000.00000040.00001000.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5550000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 51d3835c3a866390caa36e6b8745df0e95dac44a08c7a8f6f1882b5a6f2df0ef
Instruction ID: b194168e2d5a4b9f35cb1bac5085ec9c7415acac25b184607e97703c7267fd31
Opcode Fuzzy Hash: 51d3835c3a866390caa36e6b8745df0e95dac44a08c7a8f6f1882b5a6f2df0ef
Instruction Fuzzy Hash: 1721C0F7248215BDB102C5912B2CEF7676FF7D2730B30882BF803D6592E7940A8A55B1

Function 00240560 Relevance: 1.6, APIs: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 002406AE

Memory Dump Source

Source File: 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000006.00000002.4496423630.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496522566.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496985101.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498257150.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498654718.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction ID: a1c8e622623835b998cf8cc06c1d61e46e000331704331033eb58043c80a4e0b
Opcode Fuzzy Hash: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction Fuzzy Hash: FD41E372A101149BCB19EF68D9C06AE7BA9EF89350F550169FD05DB302DB70DDB08BE1

Function 0555078E Relevance: 1.6, APIs: 1, Instructions: 105COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(0000D31D), ref: 05550867

Memory Dump Source

Source File: 00000006.00000002.4505887367.0000000005550000.00000040.00001000.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5550000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 24495979f93ac82e5ecfe14a69feac6bc80abfc33fb83e7d76f0ee177e84ee6e
Instruction ID: b766f8e30a26bb8b880a76895f1171aae37a9850bff8fa8c27f6a68da758fbfd
Opcode Fuzzy Hash: 24495979f93ac82e5ecfe14a69feac6bc80abfc33fb83e7d76f0ee177e84ee6e
Instruction Fuzzy Hash: A711F3B7248215BDB102D1501B78EF627AFF7D6730B304827B803C6591E6900A8A95F0

Function 055507AF Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(0000D31D), ref: 05550867

Memory Dump Source

Source File: 00000006.00000002.4505887367.0000000005550000.00000040.00001000.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5550000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: a365dd5e0c7b74639ac24d03c1d50e2fbc889400aa19f8de137c2f72637b967b
Instruction ID: 0d5e79ebf637772bdba049e21fe7c370b3760aab31b17b3f8a015fd550bca51a
Opcode Fuzzy Hash: a365dd5e0c7b74639ac24d03c1d50e2fbc889400aa19f8de137c2f72637b967b
Instruction Fuzzy Hash: E51108B724C215ADE602C5901768EF6676FFBD3730B304877E803D6551E6D00A4A95F1

Function 055507E2 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(0000D31D), ref: 05550867

Memory Dump Source

Source File: 00000006.00000002.4505887367.0000000005550000.00000040.00001000.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5550000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 9c2a3eaa5b7dabe3480c3fe42b0f788ca997219131a8736c006af78139af7057
Instruction ID: e9e76098ea3d7fb4dbf799964dc6f30ecc1c014e0de806f4d8fc32ac6940477b
Opcode Fuzzy Hash: 9c2a3eaa5b7dabe3480c3fe42b0f788ca997219131a8736c006af78139af7057
Instruction Fuzzy Hash: 5D0108B7148215FDA502D1501A78EF667BFFBD7730B304C27B803D6291F6904A8945F1

Function 055507FD Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(0000D31D), ref: 05550867

Memory Dump Source

Source File: 00000006.00000002.4505887367.0000000005550000.00000040.00001000.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5550000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: cc41b91bbc9440f96f26537c2d7f2a1e74e88aa89b6bebeac3df8c31d0d03250
Instruction ID: a1b6f5ad02514c6525f03c1bb58c935dc0d674b3494454c512fa6b204416a325
Opcode Fuzzy Hash: cc41b91bbc9440f96f26537c2d7f2a1e74e88aa89b6bebeac3df8c31d0d03250
Instruction Fuzzy Hash: 810104A7148215BDA502D1901A78EF667BFFBD7730B304827B803D6691E6900A8949F1

Function 0555081A Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(0000D31D), ref: 05550867

Memory Dump Source

Source File: 00000006.00000002.4505887367.0000000005550000.00000040.00001000.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5550000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 975ed612c5140f979ad8140793e74765ffee90ee10bba111169baaaf75fba771
Instruction ID: d6842e38345e8090a011f9bfb3bb69d8a91cee3d6c6170dc97eac1264bec9470
Opcode Fuzzy Hash: 975ed612c5140f979ad8140793e74765ffee90ee10bba111169baaaf75fba771
Instruction Fuzzy Hash: 9701DFE7248215FDA10295901B78EF667BFFBE77307304827B803C6692E7900A8995F2

Function 002C4B12 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,002C49F9,00000000,CF830579,00301140,0000000C,002C4AB5,002B8BBD,?), ref: 002C4B68

Memory Dump Source

Source File: 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000006.00000002.4496423630.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496522566.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496985101.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498257150.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498654718.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 0dd8eeca34b2adc6eb0708bdb9b346fbb430cdae37e7a17d049a979942e43588
Instruction ID: 95ef94dfea4a1b9e4e5e878531ea005bd6ec76b0a59cd306d42995e6d7ffdec0
Opcode Fuzzy Hash: 0dd8eeca34b2adc6eb0708bdb9b346fbb430cdae37e7a17d049a979942e43588
Instruction Fuzzy Hash: 26114832E7112816DB297A356826FBF679D8B8277CF39030EFC089B0C2EE61DC614155

Function 0555089C Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(0000D31D), ref: 05550867

Memory Dump Source

Source File: 00000006.00000002.4505887367.0000000005550000.00000040.00001000.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5550000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: dab0b0b7d4b35f853bb8030539d7b40786e3c20fc947daa6b79c5f199553cf6e
Instruction ID: c0361f66e6beff4eb05c47cbc9430afc20a770fb2a32b385821de64dcd938dc3
Opcode Fuzzy Hash: dab0b0b7d4b35f853bb8030539d7b40786e3c20fc947daa6b79c5f199553cf6e
Instruction Fuzzy Hash: 9E014CB650C315EEDA12D6504A38EF67B7ABB837307300857AC43961D1E6900A49C6F1

Function 05550838 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(0000D31D), ref: 05550867

Memory Dump Source

Source File: 00000006.00000002.4505887367.0000000005550000.00000040.00001000.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5550000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: b34a445e6b92bbd67cd8380cf19e348ee2e6f2259c3e911ffa21c1657eda3847
Instruction ID: 7b1fbb13942787d67a597735ab9943af8b5abcf946bd1826d180fb3bf071633d
Opcode Fuzzy Hash: b34a445e6b92bbd67cd8380cf19e348ee2e6f2259c3e911ffa21c1657eda3847
Instruction Fuzzy Hash: EC012BF6508315EEE602D6604A78EFA7B7ABB977307200867A843D72C2E7900A4586F1

Function 002BE05C Relevance: 1.6, APIs: 1, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00300DF8,001DA3EB,00000002,001DA3EB,00000000,?,?,?,002BE166,00000000,?,001DA3EB,00000002,00300DF8), ref: 002BE098

Memory Dump Source

Source File: 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000006.00000002.4496423630.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496522566.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496985101.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498257150.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498654718.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 8eb8ffe171fd2b27d908991b4441584507ec3e3dedece62d444d193ea6598438
Instruction ID: d10d34f5a02a0c7582e0f93b519f0a188808c780a09b9f55ad3075c0c863677a
Opcode Fuzzy Hash: 8eb8ffe171fd2b27d908991b4441584507ec3e3dedece62d444d193ea6598438
Instruction Fuzzy Hash: 8A012632620119AFCF05AF19CC05CDE3B6ADB81360F350209F850AB2D1EAB2ED618BD0

Function 002AF290 Relevance: 1.6, APIs: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 001D220E

Memory Dump Source

Source File: 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000006.00000002.4496423630.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496522566.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496985101.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498257150.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498654718.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: dc230ebe102efb051326ae556abab537d7f128e004c28a2706078cc2e29e7cfa
Instruction ID: f6c265f93404b6fbafc7c157f7a985d444585bc0bb31918bd4848bbf0e1ec043
Opcode Fuzzy Hash: dc230ebe102efb051326ae556abab537d7f128e004c28a2706078cc2e29e7cfa
Instruction Fuzzy Hash: 8801203541030D67CB14AF98E801A9977AC9A01350B408436FE19DBA91EB70D9748B94

Function 002C63F3 Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,002B91F7,00000000,?,002C5D79,00000001,00000364,00000000,00000006,000000FF,?,00000000,002BD244,002B89C3,002B91F7,00000000), ref: 002C6434

Memory Dump Source

Source File: 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000006.00000002.4496423630.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496522566.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496985101.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498257150.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498654718.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7d48cde3858231759f3451e53adca166c94f0dd86ebe2bc1df611292b6a37e4b
Instruction ID: 45814a5d8388ea79892f7fcb45facbcc1747f85c78d1e13181af6c607d2c6e40
Opcode Fuzzy Hash: 7d48cde3858231759f3451e53adca166c94f0dd86ebe2bc1df611292b6a37e4b
Instruction Fuzzy Hash: EDF0E93153512666DB396F629C0BF6B3B8C9F417B0F25832DEC04A6480CA70EC3046F1

Function 002C6E2D Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,002CD635,4D88C033,?,002CD635,00000220,?,002C57EF,4D88C033), ref: 002C6E60

Memory Dump Source

Source File: 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000006.00000002.4496423630.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496522566.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496985101.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498257150.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498654718.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 489302c3a4058ae832e7abd2116c50abdcdeeba224fd33f95b20fe7a6f23aa7d
Instruction ID: c7948cd59d642bf2cdfa5dad6e184d46fa525bfde2dd25c8f5d5b6481ccc49b0
Opcode Fuzzy Hash: 489302c3a4058ae832e7abd2116c50abdcdeeba224fd33f95b20fe7a6f23aa7d
Instruction Fuzzy Hash: 8CE0ED3913162A6ADA313AA5CD09FAB764C8B823B0F05072BEC04924D2DB60C83085A4

Function 0556005E Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4505941566.0000000005560000.00000040.00001000.00020000.00000000.sdmp, Offset: 05560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5560000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65e7d48ee1d7f4ed1acd2bcc25b497dd243e56c887095ff5f966f1eae516ff09
Instruction ID: 84d1f2dfedb8a6964b8dcb18b7e2ebedcb650104456141db9ba3ca5bd142a705
Opcode Fuzzy Hash: 65e7d48ee1d7f4ed1acd2bcc25b497dd243e56c887095ff5f966f1eae516ff09
Instruction Fuzzy Hash: A731D2EB28D2A47EB242D585BF1CDF76B6EF5C7730330886BF402C2592E2A50A4D9171

Function 055600F6 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4505941566.0000000005560000.00000040.00001000.00020000.00000000.sdmp, Offset: 05560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5560000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fedd2a8c20855aca1ed24b6fa3b92cb69e2a66fe90a103d56702991926638ba6
Instruction ID: b80db6da32fc368322d914b7c646bc8d59de2f8bcd0d31654b09b5b7cddd7ff2
Opcode Fuzzy Hash: fedd2a8c20855aca1ed24b6fa3b92cb69e2a66fe90a103d56702991926638ba6
Instruction Fuzzy Hash: 61219FEB28D1647DB142D1C67F28DF6AB2EE5C3B70330C83BF502C2542E2950A5E5171

Function 05560110 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4505941566.0000000005560000.00000040.00001000.00020000.00000000.sdmp, Offset: 05560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5560000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e95b15fccfffab75fd9d7e80f245130c9522633a2f764fb7cdb55b93ae42b30
Instruction ID: b5da5ac6b3ac9c67d2529c1185e3233fbb86b39f7609695757501aa7fbf84c15
Opcode Fuzzy Hash: 9e95b15fccfffab75fd9d7e80f245130c9522633a2f764fb7cdb55b93ae42b30
Instruction Fuzzy Hash: 622181EB28C1647DB142E5866F189F7A76EF5C3B70330883AF402C2552E2A54A9D6171

Function 05560134 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4505941566.0000000005560000.00000040.00001000.00020000.00000000.sdmp, Offset: 05560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5560000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60d13adca72e0ef1edfa154ce3c1a40d8306b9bed651da3ec8045a7dfa09a0fc
Instruction ID: f6b51d40150227109a93f50d930df24b0445531cea33ac017378f6078fddebee
Opcode Fuzzy Hash: 60d13adca72e0ef1edfa154ce3c1a40d8306b9bed651da3ec8045a7dfa09a0fc
Instruction Fuzzy Hash: 94113AEB2891647DB18291C66F18DF7AB2EF1C3B70330882AF502C2542E2A84E9D6171

Function 05560143 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4505941566.0000000005560000.00000040.00001000.00020000.00000000.sdmp, Offset: 05560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5560000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d80ba642898e264d4492f1f55f146ce73c1df765aeacf759226e74d1a4c40552
Instruction ID: 12e3c980a82562f72bfff8d2e4bf83bb6cd6421ba1f3868ea04ba22ac071d4cb
Opcode Fuzzy Hash: d80ba642898e264d4492f1f55f146ce73c1df765aeacf759226e74d1a4c40552
Instruction Fuzzy Hash: F611B1EB1891507CB152D1C66F189F6AB6EF5C3730330882BF042C2582E2940A5D5271

Function 05560171 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4505941566.0000000005560000.00000040.00001000.00020000.00000000.sdmp, Offset: 05560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5560000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5762b9d70d0cce97e0551b4799b8419446437a0f5a4dc60f2c157390963f9528
Instruction ID: 0493e5a2f04fd4eee72de30fd49b713a6a0961401232e6a5f7d150c76a9e5244
Opcode Fuzzy Hash: 5762b9d70d0cce97e0551b4799b8419446437a0f5a4dc60f2c157390963f9528
Instruction Fuzzy Hash: 09115EEB1892643DB14291C62F18EFBAB6EE5D3B71330883BF802C2482E2990E5D5171

Function 055601AB Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4505941566.0000000005560000.00000040.00001000.00020000.00000000.sdmp, Offset: 05560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5560000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5699f0fd8511305435a85388c2ffa6ba57736057ffd9d246bf5928251dd165e8
Instruction ID: 1cb2547efcc417f75a4df02794ff48374775c52804ebe83214a08aae5f1e3069
Opcode Fuzzy Hash: 5699f0fd8511305435a85388c2ffa6ba57736057ffd9d246bf5928251dd165e8
Instruction Fuzzy Hash: 14F0ECEB18D1507CB15291C62B18AF6AB6EF5D7771330892BF403C5942E2D90A5E6171

Non-executed Functions

Function 002B84A0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000006.00000002.4496423630.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496522566.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496985101.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498257150.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498654718.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction ID: bbe6706893308522768bf0182de4f41967739c2473e0555e83ee2cd9eb29734f
Opcode Fuzzy Hash: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction Fuzzy Hash: D1023C71E1121A9BDF14CFA9C8806EEFBB9FF48354F248269D519E7380DB31A951CB90

Function 0023F810 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0023F833
std::_Lockit::_Lockit.LIBCPMT ref: 0023F855
std::_Lockit::~_Lockit.LIBCPMT ref: 0023F875
std::_Lockit::~_Lockit.LIBCPMT ref: 0023F89F
std::_Lockit::_Lockit.LIBCPMT ref: 0023F90D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0023F959
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0023F973
std::_Lockit::~_Lockit.LIBCPMT ref: 0023FA08
std::_Facet_Register.LIBCPMT ref: 0023FA15

Strings

"/, xrefs: 0023F96B, 0023F972
bad locale name, xrefs: 0023FA2F

Memory Dump Source

Source File: 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000006.00000002.4496423630.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496522566.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496985101.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498257150.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498654718.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$"/
API String ID: 3375549084-1188037619
Opcode ID: 3a285ebabcfa9536c5826a11c3945500fc87f063c9472b171645b06cb9342405
Instruction ID: 1a52b5d5bccc1307b6ae5a42b191efb5dc6b5cc2003d162fc4a11836d4e7bd55
Opcode Fuzzy Hash: 3a285ebabcfa9536c5826a11c3945500fc87f063c9472b171645b06cb9342405
Instruction Fuzzy Hash: BA61CFB1D202099BEF10DFA4EA45BDEBBB4AF15310F144069E805AB381EB74E915CF91

Function 002B2E10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 002B2E47
___except_validate_context_record.LIBVCRUNTIME ref: 002B2E4F
_ValidateLocalCookies.LIBCMT ref: 002B2ED8
__IsNonwritableInCurrentImage.LIBCMT ref: 002B2F03
_ValidateLocalCookies.LIBCMT ref: 002B2F58

Strings

i0, xrefs: 002B2F78
csm, xrefs: 002B2EED

Memory Dump Source

Source File: 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000006.00000002.4496423630.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496522566.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496985101.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498257150.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498654718.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: i0$csm
API String ID: 1170836740-1866805317
Opcode ID: dbee62e5149e73ae7240dafcf94d0ef21dbe0738c8ed8b61c4f323501c396f79
Instruction ID: 32ac7f7cfeadbd2963840aa2b7b08df8b3fef845df534a84ea462bafd154c1fa
Opcode Fuzzy Hash: dbee62e5149e73ae7240dafcf94d0ef21dbe0738c8ed8b61c4f323501c396f79
Instruction Fuzzy Hash: CA41C430A20309DBCF10DF69C885AEEBBB5EF45394F148055E8149B792D771EE69CB90

Function 001D39F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 001D3A58
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 001D3AA4
__Getctype.LIBCPMT ref: 001D3ABA
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 001D3AE6
std::_Lockit::~_Lockit.LIBCPMT ref: 001D3B7B

Strings

bad locale name, xrefs: 001D3B96

Memory Dump Source

Source File: 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000006.00000002.4496423630.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496522566.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496985101.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498257150.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498654718.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: e336c04381489506ce98469e20e1aa0013bd86d0ae350632ed8ca0ff762a92d3
Instruction ID: 7eec70bbacd63bb50638145529670cbaa62c8c05c7e4b56e60d9b2299b9eeca0
Opcode Fuzzy Hash: e336c04381489506ce98469e20e1aa0013bd86d0ae350632ed8ca0ff762a92d3
Instruction Fuzzy Hash: B55144B1D102489FDF10DFA4D945BDDBBB8AF15310F14406AE819AB381EB75DA14CB52

Function 0023DE70 Relevance: 9.1, APIs: 6, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0023DE93
std::_Lockit::_Lockit.LIBCPMT ref: 0023DEB6
std::_Lockit::~_Lockit.LIBCPMT ref: 0023DED6
std::_Facet_Register.LIBCPMT ref: 0023DF4B
std::_Lockit::~_Lockit.LIBCPMT ref: 0023DF63
Concurrency::cancel_current_task.LIBCPMT ref: 0023DF7B

Memory Dump Source

Source File: 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000006.00000002.4496423630.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496522566.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496985101.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498257150.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498654718.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 3fcc8f2dd8ce59d5b053b5e8679bbf7d017a903f953f1645709824ea4ad6a51e
Instruction ID: c3f5f2e51c86c7bb40ed35f79696e9488f9dac318875ddca51c4b69ee872915a
Opcode Fuzzy Hash: 3fcc8f2dd8ce59d5b053b5e8679bbf7d017a903f953f1645709824ea4ad6a51e
Instruction Fuzzy Hash: D04123B5D202169FCB15DF54E881B6EBBB8FB11710F10426AE816AB752DB30AD21CBD1

Function 001D4C50 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 442COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 001D4F72
___std_exception_destroy.LIBVCRUNTIME ref: 001D4FFF
___std_exception_copy.LIBVCRUNTIME ref: 001D50C8

Strings

recursive_directory_iterator::operator++, xrefs: 001D504C

Memory Dump Source

Source File: 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000006.00000002.4496423630.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496522566.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496985101.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498257150.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498654718.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$___std_exception_copy
String ID: recursive_directory_iterator::operator++
API String ID: 1206660477-953255998
Opcode ID: ca26052e8f98b9b1c5fd7b2aee9a1f6a4e2ad062376d2f9617a647aa7de53046
Instruction ID: 977c9e67eec8c3d12b2928d7d57d3ff8a05cdf20fcdf868f4a016b3e73774ee2
Opcode Fuzzy Hash: ca26052e8f98b9b1c5fd7b2aee9a1f6a4e2ad062376d2f9617a647aa7de53046
Instruction Fuzzy Hash: FBE1E2B19106049FCB28DF68D895BAEF7F9FF44300F144A2EE45693781E774A914CBA1

Function 001D7820 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 001D799A
___std_exception_copy.LIBVCRUNTIME ref: 001D7B75

Strings

out_of_range, xrefs: 001D7A27
type_error, xrefs: 001D784A

Memory Dump Source

Source File: 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000006.00000002.4496423630.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496522566.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496985101.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498257150.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498654718.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: out_of_range$type_error
API String ID: 2659868963-3702451861
Opcode ID: 3b9fabe72a022adb020c0c12b9e90c2a241c656b08d31f4bc3cdd6034f6d1ebb
Instruction ID: b674fd593ab362357c3c0e7f3f47a3c52fb226ef3aaf768fe579279ba3ba9650
Opcode Fuzzy Hash: 3b9fabe72a022adb020c0c12b9e90c2a241c656b08d31f4bc3cdd6034f6d1ebb
Instruction Fuzzy Hash: CAC156B1D002088FDB08DFA8E9947ADFBF1AB49310F14866AE419EB791E7749984CB54

Function 001D2270 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 218COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 001D2275

Part of subcall function 002AD6E9: std::invalid_argument::invalid_argument.LIBCONCRT ref: 002AD6F5

Strings

string too long, xrefs: 001D2270
L0, xrefs: 001D2347
L0, xrefs: 001D2427

Memory Dump Source

Source File: 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000006.00000002.4496423630.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496522566.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496985101.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498257150.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498654718.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: string too long$L0$L0
API String ID: 1997705970-1638608421
Opcode ID: 8490484e3ed718928e4d1e8a565281a0dd77244087875b57fcc25a8bd79cf534
Instruction ID: de67a2654fe37548eab6af86c684d8b2c2d8ca9ac42ef4583abea7e05da30beb
Opcode Fuzzy Hash: 8490484e3ed718928e4d1e8a565281a0dd77244087875b57fcc25a8bd79cf534
Instruction Fuzzy Hash: 5A812475A042859FDB06CF68C4607EEBFB1FF6A300F18416BC9A4A7742C3798645CBA1

Function 001D73B0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 001D75BE
___std_exception_destroy.LIBVCRUNTIME ref: 001D75CD

Strings

at line , xrefs: 001D73F7
, column , xrefs: 001D7434, 001D744A

Memory Dump Source

Source File: 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000006.00000002.4496423630.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496522566.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496985101.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498257150.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498654718.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column
API String ID: 4194217158-191570568
Opcode ID: a779f5afa5746bba6e7bcc490a89991268e862839603d05a9dfb9a4c50c47bcc
Instruction ID: f8274f8b0619eec22966156a4b9cc3753fa667d835134da4d6afd29bb93263c5
Opcode Fuzzy Hash: a779f5afa5746bba6e7bcc490a89991268e862839603d05a9dfb9a4c50c47bcc
Instruction Fuzzy Hash: B4610571A042049FDB08DF68EC94BADBBB6FF45300F24462DE415A77C1E774AA54CB91

Function 001D3D10 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 001D3E7F

Strings

ios_base::eofbit set, xrefs: 001D3E41, 001D3E63
ios_base::badbit set, xrefs: 001D3E17
ios_base::failbit set, xrefs: 001D3D32

Memory Dump Source

Source File: 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000006.00000002.4496423630.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496522566.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496985101.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498257150.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498654718.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: 707a96433d09361d8b954ffb32816a226e6dcaa87bebb2d08964994ae3619097
Instruction ID: ec34735bd9e8b85d09d64430255fba95bba96aaf582367922541d2baf12672df
Opcode Fuzzy Hash: 707a96433d09361d8b954ffb32816a226e6dcaa87bebb2d08964994ae3619097
Instruction Fuzzy Hash: 5841C5B6900208AFCB04DF58C845BEEB7F9EB49310F14852BF925D7741E770AA108FA5

Function 001D3DE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 001D3E7F

Strings

ios_base::eofbit set, xrefs: 001D3E28, 001D3E41, 001D3E63
ios_base::badbit set, xrefs: 001D3E17
ios_base::failbit set, xrefs: 001D3D32, 001D3E1E

Memory Dump Source

Source File: 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000006.00000002.4496423630.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496522566.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496985101.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498257150.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498654718.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: 4c5ac9e67b2228a806689556943bbb9949273588420191857d46ac2ed5ff40eb
Instruction ID: 377aa51063d13f367f4840f4c5d71e4863d2eb10996cc4b1115d37f6eaa61e45
Opcode Fuzzy Hash: 4c5ac9e67b2228a806689556943bbb9949273588420191857d46ac2ed5ff40eb
Instruction Fuzzy Hash: 3D2108B2510305AFC714DF58D801B96F7D8AB04350F08883BFA6987781E770EA248B91

Function 001D6F40 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 349COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 001D7340

Strings

parse_error, xrefs: 001D6F8B
parse error, xrefs: 001D6FFF, 001D7018

Memory Dump Source

Source File: 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000006.00000002.4496423630.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496522566.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496985101.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498257150.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498654718.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: parse error$parse_error
API String ID: 2659868963-1820534363
Opcode ID: 73a6082c3ff85059db49390955e41f1bd66eacc0b976afd20812c25158f06e09
Instruction ID: eb281dc5de3bb0acc2be8a8c4f6e7498bb6ea29e511a4267ecd604c83117a59a
Opcode Fuzzy Hash: 73a6082c3ff85059db49390955e41f1bd66eacc0b976afd20812c25158f06e09
Instruction Fuzzy Hash: FBE18F70D042489FDB18CF68C8947ADBBB1FF49300F248269E419EB792E7749A85CF50

Function 001D6C60 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 001D6F11
___std_exception_destroy.LIBVCRUNTIME ref: 001D6F20

Strings

[json.exception., xrefs: 001D6CB8

Memory Dump Source

Source File: 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000006.00000002.4496423630.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496522566.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496985101.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498257150.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498654718.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.
API String ID: 4194217158-791563284
Opcode ID: 790557b696969aa77a97655168e22b0a79a0199f93f43922184a62aab90735dd
Instruction ID: ba68b37dc7840d83bdf5039b0c62cf856077ec49cbe9eea90d9e23d64c62cecb
Opcode Fuzzy Hash: 790557b696969aa77a97655168e22b0a79a0199f93f43922184a62aab90735dd
Instruction Fuzzy Hash: AA91E770A002049FDB18CF68D994BAEFBF6FF45300F20862DE415AB792D775A945CB90

Function 0024B450 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 190COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0024B612

Strings

Px$, xrefs: 0024B456, 0024B5BA, 0024B5F3, 0024B54A, 0024B4F1
invalid hash bucket count, xrefs: 0024B60D

Memory Dump Source

Source File: 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000006.00000002.4496423630.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496522566.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496985101.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498257150.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498654718.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_
String ID: Px$$invalid hash bucket count
API String ID: 909987262-1721581971
Opcode ID: df294b54a20dd5a98ea27c473de565f593aa9ed9f68095b67a8a92996a04e3e6
Instruction ID: fa0e18405247401935543f78bc820eb99f49c8f540618882be5deb9f32f00551
Opcode Fuzzy Hash: df294b54a20dd5a98ea27c473de565f593aa9ed9f68095b67a8a92996a04e3e6
Instruction Fuzzy Hash: 207124B4A10605DFCB19CF58C18086AFBF9FF88300764C5AAD8599B355D771EA62CF90

Function 0024E440 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0024E491

Strings

type must be string, but is , xrefs: 0024E4F8
type must be boolean, but is , xrefs: 0024E582

Memory Dump Source

Source File: 00000006.00000002.4496522566.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000006.00000002.4496423630.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496522566.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4496985101.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4497069031.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498257150.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4498654718.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: type must be boolean, but is $type must be string, but is
API String ID: 118556049-436076039
Opcode ID: d9e71b3e7803f4f63ff18a054844532d87a8d4852e94ac18ae2da5fb9f9817d1
Instruction ID: e82ddf4cbe23fb6ceade92774aaa7aa7429cd0174a1844fb0c2665c534010f04
Opcode Fuzzy Hash: d9e71b3e7803f4f63ff18a054844532d87a8d4852e94ac18ae2da5fb9f9817d1
Instruction Fuzzy Hash: 6F417CB1910248AFEF18EBA4D842BDEB7A8EB10310F144675F815D77C2EB35E920C791

Analysis Process: MPGPH131.exePID: 5012, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	3.1%
Dynamic/Decrypted Code Coverage:	3.1%
Signature Coverage:	0%
Total number of Nodes:	545
Total number of Limit Nodes:	68

Executed Functions

Function 00233A40 Relevance: 2.7, APIs: 2, Instructions: 157
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E9,?,00000001,00000000,?,?,?,?,?,?,?,?,00233DB6), ref: 00233B08
Sleep.KERNELBASE(00000001,?,00000001,00000000,?,?,?,?,?,?,?,?,00233DB6), ref: 00233BBA

Memory Dump Source

Source File: 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000007.00000002.4496427930.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496541525.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496992886.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498264487.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498681856.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 24de12ac09f3f57f502f9bf76acc82240d4407c0448c2b68dfb6d879352f2e33
Instruction ID: de360339753a3688c90de5653b3cb91dae84d5020feff21c708c09f340bd0124
Opcode Fuzzy Hash: 24de12ac09f3f57f502f9bf76acc82240d4407c0448c2b68dfb6d879352f2e33
Instruction Fuzzy Hash: 2051A775A1421A8FCB24CF58C8D0EAAF7B2EF45708F29859AD485AB351D731EF15CB80

Function 001EE0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 001EE0CB
socket.WS2_32(?,?,?), ref: 001EE17E
connect.WS2_32(00000000,?,?), ref: 001EE192
closesocket.WS2_32(00000000), ref: 001EE19E

Memory Dump Source

Source File: 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000007.00000002.4496427930.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496541525.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496992886.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498264487.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498681856.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: 3489dc81adaf24d9292dca29feae92c5b61d4a9a0dc585e20c034065082e13b6
Instruction ID: f291587fa8e318a6e5beebc1eee1f7e9be29a0e780e3334bc130a80039aac3df
Opcode Fuzzy Hash: 3489dc81adaf24d9292dca29feae92c5b61d4a9a0dc585e20c034065082e13b6
Instruction Fuzzy Hash: 7931B071605700ABD7219F698C85B2FB7E4EB85324F015F1DF9A8922E0D33198488B92

Function 002B4942 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

O+, xrefs: 002B4A93, 002B4A61, 002B4AAB, 002B4AC7

Memory Dump Source

Source File: 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000007.00000002.4496427930.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496541525.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496992886.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498264487.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498681856.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID: O+
API String ID: 0-697038414
Opcode ID: e021ecfa5ae017e001fb840f4414eb879ae0bf42ed5c1816f6b4ffe798e2c149
Instruction ID: 3d59fa5a25dffccc328096298d04b9be64e953d814d56c4d2afc959d9de2488e
Opcode Fuzzy Hash: e021ecfa5ae017e001fb840f4414eb879ae0bf42ed5c1816f6b4ffe798e2c149
Instruction Fuzzy Hash: F451E530A10108AFDB14EF58CCD5AEABBB5EF49394F248159F8499B253D371AE61CB90

Function 002C4623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000007.00000002.4496427930.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496541525.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496992886.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498264487.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498681856.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b8189d2cf87a96a617585a0c2314e7e12f4ff5f30a8954ba4bbbccc2227803a
Instruction ID: 2cf09bdf4e12e0af5edd5ee7b8f6752c61fc2aa8107ef0f91624d4c603c6cca8
Opcode Fuzzy Hash: 0b8189d2cf87a96a617585a0c2314e7e12f4ff5f30a8954ba4bbbccc2227803a
Instruction Fuzzy Hash: 60B1F170A20286AFDB11EFA8D861FAFBBB5AF45310F14435DE844A7286C7709D61CF60

Function 001DA210 Relevance: 1.7, APIs: 1, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 001DA343

Memory Dump Source

Source File: 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000007.00000002.4496427930.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496541525.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496992886.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498264487.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498681856.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 2016b29eb16f461fe01688964d1904b08abd69c9c24ee5b225ea84c2916cbab6
Instruction ID: eab2c6aa61fb6b8eee7820578754384f86a6f228e33011d8add4a83a30880969
Opcode Fuzzy Hash: 2016b29eb16f461fe01688964d1904b08abd69c9c24ee5b225ea84c2916cbab6
Instruction Fuzzy Hash: DA716871910204AFDB14DF68CC49BAEB7E9EF41340F54856EF8089B382D7B5DA41CB92

Function 002C549C Relevance: 1.7, APIs: 1, Instructions: 198
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000000,002B9087,?,00000000,00000000,00000000,?,00000000,?,001DA3EB,002B9087,00000000,001DA3EB,?,?), ref: 002C5621

Memory Dump Source

Source File: 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000007.00000002.4496427930.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496541525.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496992886.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498264487.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498681856.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 5c4956ce1ce70b95bf2fa14bc58b42b1a5b129fe24b3fa56f1241c556825091f
Instruction ID: feb93cc77dc3ebffd7f53603ceff20df8f1213fe97ad1627bdf65882ea4d6ffd
Opcode Fuzzy Hash: 5c4956ce1ce70b95bf2fa14bc58b42b1a5b129fe24b3fa56f1241c556825091f
Instruction Fuzzy Hash: F961C871D2052AAFDF15DFA8C844FEEBBB9AF05344F54024DE804A7215D371E9A1CBA0

Function 04D306A7 Relevance: 1.6, APIs: 1, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.4505380054.0000000004D30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d30000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: dffe6d529be76e33aa991987ac531bf397ffe6f32bb7245fba4311e6cdbc5302
Instruction ID: a68ff5c160c1a24ebae246f5b18276a3199dbe7d45fbd2270fd5128d7243010b
Opcode Fuzzy Hash: dffe6d529be76e33aa991987ac531bf397ffe6f32bb7245fba4311e6cdbc5302
Instruction Fuzzy Hash: 242136E730D214BEB103A1462B50AF7272DE6C2772730843AF4C7D1109F294EE4A7472

Function 00240560 Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 002406AE

Memory Dump Source

Source File: 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000007.00000002.4496427930.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496541525.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496992886.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498264487.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498681856.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction ID: a1c8e622623835b998cf8cc06c1d61e46e000331704331033eb58043c80a4e0b
Opcode Fuzzy Hash: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction Fuzzy Hash: FD41E372A101149BCB19EF68D9C06AE7BA9EF89350F550169FD05DB302DB70DDB08BE1

Function 04D306FD Relevance: 1.6, APIs: 1, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D30895

Memory Dump Source

Source File: 00000007.00000002.4505380054.0000000004D30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d30000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 539d4df8d0f13a4c70d1df591c0ef0ef5d6bd694fbcfa514fcc8dbd4de11b311
Instruction ID: 76cabbce488ea4d187baf6946024b82094c610c0f0af3cdfb5b3387ac1395e0b
Opcode Fuzzy Hash: 539d4df8d0f13a4c70d1df591c0ef0ef5d6bd694fbcfa514fcc8dbd4de11b311
Instruction Fuzzy Hash: 8D2127E630D214BDB24395562B54AFB6B2DEBC6772730843AF887C0109F294EE4D7471

Function 04D306E5 Relevance: 1.6, APIs: 1, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D30895

Memory Dump Source

Source File: 00000007.00000002.4505380054.0000000004D30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d30000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: c1677afbc1260da3c4cf1ec071d3aa66da41adef7170653e5c159c9aebba3dd1
Instruction ID: 7184d1f30aa1d81db2a7cff8f68f5bc6739be4e32385b728b49189a002b7ebb6
Opcode Fuzzy Hash: c1677afbc1260da3c4cf1ec071d3aa66da41adef7170653e5c159c9aebba3dd1
Instruction Fuzzy Hash: 152138EB30D214BDB243A1562B84AF7666EE7C2732730803AF487C110AF284EE4D7471

Function 04D306D6 Relevance: 1.6, APIs: 1, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D30895

Memory Dump Source

Source File: 00000007.00000002.4505380054.0000000004D30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d30000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 8226a770a8926a4a27a6eba13928b4ef319a8b78f47256114c5cc04fe10da447
Instruction ID: f27d25d106a7df48a581f0faea2367991d56fd7f4d8506c721381f6e2653fa95
Opcode Fuzzy Hash: 8226a770a8926a4a27a6eba13928b4ef319a8b78f47256114c5cc04fe10da447
Instruction Fuzzy Hash: EE21DFEB34D214BDB14391562B54AF62A2DE6C6772730803AF887C060AF2C4EE4D7472

Function 04D307A6 Relevance: 1.6, APIs: 1, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D30895

Memory Dump Source

Source File: 00000007.00000002.4505380054.0000000004D30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d30000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 03108e2c5e31d104d76932b711c90fcefbf28ed06e489a25328522c68a9d8508
Instruction ID: e94d974bedf2bf9164823a3ad1cc845cd9fa1700052f6455b03c01f1f6666bc1
Opcode Fuzzy Hash: 03108e2c5e31d104d76932b711c90fcefbf28ed06e489a25328522c68a9d8508
Instruction Fuzzy Hash: B02105E634D214BDB253A09A2B54BF76B2DDBC6732730843AF487D6546F2C49E4DA070

Function 04D3071B Relevance: 1.6, APIs: 1, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D30895

Memory Dump Source

Source File: 00000007.00000002.4505380054.0000000004D30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d30000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 261b5d6ac33fcff0d337c95e440ce9b96413899caec90fd04c8f0b3fc95f091d
Instruction ID: cd9785b405f54929b697a5469dbabc78a158e0d23bd27566e74ce929175e99a1
Opcode Fuzzy Hash: 261b5d6ac33fcff0d337c95e440ce9b96413899caec90fd04c8f0b3fc95f091d
Instruction Fuzzy Hash: E01136EB30D114FD725790862B54AF72A2DE6C6732730803AF48BD250AF2C4AE4D7470

Function 04D30723 Relevance: 1.6, APIs: 1, Instructions: 104
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D30895

Memory Dump Source

Source File: 00000007.00000002.4505380054.0000000004D30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d30000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 32afe21cb0683df192139624a0df7d04bd7d137918e1639fd544e30bbf635669
Instruction ID: 583cf18f840e59c276565302c5ad09793ec00c9a49092aa4a308b93fd618c464
Opcode Fuzzy Hash: 32afe21cb0683df192139624a0df7d04bd7d137918e1639fd544e30bbf635669
Instruction Fuzzy Hash: 2B1122EB30D228BCB153A5462B94AF7662DE6C6732730843AF487D210AF2C4AE4D7470

Function 04D3073B Relevance: 1.6, APIs: 1, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D30895

Memory Dump Source

Source File: 00000007.00000002.4505380054.0000000004D30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d30000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 4ad727158402ca0df5b3795052b4b578c6eac9c266f72c9741ecb0d82d3436df
Instruction ID: 99d372b74785ec92a5be2ddc26a70e14a63bffe83ab11663dd8b6b57593eb3d7
Opcode Fuzzy Hash: 4ad727158402ca0df5b3795052b4b578c6eac9c266f72c9741ecb0d82d3436df
Instruction Fuzzy Hash: 331123EB34D214BCB15391862B94AF7662EEBC6B32730803AF487C1506F2D4AE8D7071

Function 04D3074E Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D30895

Memory Dump Source

Source File: 00000007.00000002.4505380054.0000000004D30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d30000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 5a8a7a615571e67174c746ff3b47dda9d074db9d511391f8804e99b7a0a02a38
Instruction ID: 29d42b1090283c43c5ef767bd8f854d4078807b95c521e04bc87f64e03247cfd
Opcode Fuzzy Hash: 5a8a7a615571e67174c746ff3b47dda9d074db9d511391f8804e99b7a0a02a38
Instruction Fuzzy Hash: 7511C4EB34D218BD7253A0962B54AF76B2DD6C6732730843AF887D1146F2C49E4D6071

Function 04D308C1 Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D30895

Memory Dump Source

Source File: 00000007.00000002.4505380054.0000000004D30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d30000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 549a0e0996c920c184a64f8a2814f162684f8a5150ed124672fc8372e65c785e
Instruction ID: c2265639047d67ccaef2c22253a6a0085bf45b570ea7c9907873316c487f4e3d
Opcode Fuzzy Hash: 549a0e0996c920c184a64f8a2814f162684f8a5150ed124672fc8372e65c785e
Instruction Fuzzy Hash: EB1166EB30D1043DB213B4A52E50AFB6BAEEAC3631330C87AF882D610BD1949D4E5170

Function 04D30786 Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D30895

Memory Dump Source

Source File: 00000007.00000002.4505380054.0000000004D30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d30000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 515535cda74443c721071cd1317ebd19213c3594233c40057262ba9d0d50f443
Instruction ID: ac30b4035ffa53e24016c20a3a2b910ecc12ee4471f0ab2eb1c7c944f7f5753c
Opcode Fuzzy Hash: 515535cda74443c721071cd1317ebd19213c3594233c40057262ba9d0d50f443
Instruction Fuzzy Hash: 851182DB349214BCB25395862B44AF6666EE7C6632730443AF487D1646F2C49E4D6071

Function 04D307D4 Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D30895

Memory Dump Source

Source File: 00000007.00000002.4505380054.0000000004D30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d30000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: e545c2fe262e1275c5cb3f435a45412f711dbb51a3c908ffebacf7965e68f0d6
Instruction ID: 271cf6b7048f3907abc217225bc71812d7693352b6e48dfb2d5d1ce7841efa6f
Opcode Fuzzy Hash: e545c2fe262e1275c5cb3f435a45412f711dbb51a3c908ffebacf7965e68f0d6
Instruction Fuzzy Hash: CF01B5DB34D218BCB157A0822B44AF7666ED7C7732730843AB487D1146F2C49E4D7471

Function 04D307BF Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D30895

Memory Dump Source

Source File: 00000007.00000002.4505380054.0000000004D30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d30000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: eb0cd07791d7bdb2ed8f9880ab4bd36c8e30614d3d811890650044c59d06fd6e
Instruction ID: debd35610c1840fe111cd2b310606ef4ed1a52562f4c82d86996c33270b587eb
Opcode Fuzzy Hash: eb0cd07791d7bdb2ed8f9880ab4bd36c8e30614d3d811890650044c59d06fd6e
Instruction Fuzzy Hash: 7D0124EB34D218BCB113A0822B44AF7666EEBC6732B308436B443D1146F2C49E4D6071

Function 04D307E5 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D30895

Memory Dump Source

Source File: 00000007.00000002.4505380054.0000000004D30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d30000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 207d444f6d5cd62c4a943a94b6ae789a15e01ff714d408236f78c14a2b87057b
Instruction ID: bae17ccb3038cbedfb4bc38ac8f362f12fbeabff24dc9fe5ac426aa45a53be0c
Opcode Fuzzy Hash: 207d444f6d5cd62c4a943a94b6ae789a15e01ff714d408236f78c14a2b87057b
Instruction Fuzzy Hash: 3801A2EB34D1287C7157A0862B549F66A6EEAC3A72330847AB487C1246F2C89F4E6071

Function 04D30829 Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D30895

Memory Dump Source

Source File: 00000007.00000002.4505380054.0000000004D30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d30000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 3da1e6807a5b1820b20c00b68d3aac5a8e69b78df6b9b67bbff1aa126bf16724
Instruction ID: 91291aa09c775f6a5a304887b54a1cff73a19b82c5292fa2480cfbff953f454a
Opcode Fuzzy Hash: 3da1e6807a5b1820b20c00b68d3aac5a8e69b78df6b9b67bbff1aa126bf16724
Instruction Fuzzy Hash: 970128A770D128ADF217A1662A545F6276EDAC7672730887BF443C2606F2849A49A0B1

Function 002C4B12 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,002C49F9,00000000,CF830579,00301140,0000000C,002C4AB5,002B8BBD,?), ref: 002C4B68

Memory Dump Source

Source File: 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000007.00000002.4496427930.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496541525.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496992886.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498264487.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498681856.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: f43a7eeee8f43653bdd5a8d4eb1afaa72911779ad18724474540e12183408c56
Instruction ID: e711728bddd9996bc93b28213d70ec75e3025b8b5305f723adad60d644ba9bbd
Opcode Fuzzy Hash: f43a7eeee8f43653bdd5a8d4eb1afaa72911779ad18724474540e12183408c56
Instruction Fuzzy Hash: 5D118833E7011816DA247A356822F7F675E8B8277CF39030DFC089B0C2EE60EC614155

Function 002BE05C Relevance: 1.6, APIs: 1, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00300DF8,001DA3EB,00000002,001DA3EB,00000000,?,?,?,002BE166,00000000,?,001DA3EB,00000002,00300DF8), ref: 002BE098

Memory Dump Source

Source File: 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000007.00000002.4496427930.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496541525.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496992886.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498264487.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498681856.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 442d3ca08a5ca7506a37346be4de4209deef9d5154c002a306ee028f4c3a978c
Instruction ID: 5260c827199979693da52992514d8d6233ab4435a898cd1d764fbcc93b22ec9d
Opcode Fuzzy Hash: 442d3ca08a5ca7506a37346be4de4209deef9d5154c002a306ee028f4c3a978c
Instruction Fuzzy Hash: A9012632620119AFCF05AF19CC06CDE3B2ADB81364B250248FC50AB2D1E6B2FD619BD0

Function 002AF290 Relevance: 1.6, APIs: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 001D220E

Memory Dump Source

Source File: 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000007.00000002.4496427930.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496541525.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496992886.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498264487.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498681856.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: dc230ebe102efb051326ae556abab537d7f128e004c28a2706078cc2e29e7cfa
Instruction ID: f6c265f93404b6fbafc7c157f7a985d444585bc0bb31918bd4848bbf0e1ec043
Opcode Fuzzy Hash: dc230ebe102efb051326ae556abab537d7f128e004c28a2706078cc2e29e7cfa
Instruction Fuzzy Hash: 8801203541030D67CB14AF98E801A9977AC9A01350B408436FE19DBA91EB70D9748B94

Function 002C63F3 Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,002B91F7,00000000,?,002C5D79,00000001,00000364,00000000,00000006,000000FF,?,00000000,002BD244,002B89C3,002B91F7,00000000), ref: 002C6435

Memory Dump Source

Source File: 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000007.00000002.4496427930.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496541525.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496992886.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498264487.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498681856.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 3b471aceab78087a65b77303bee13917a0036079ef3f4cd03895c0ad672a09d9
Instruction ID: 201dede089a9a40ddc8f1dbccf20f3f8608f2a52c0d0333dba38f2da43870ca7
Opcode Fuzzy Hash: 3b471aceab78087a65b77303bee13917a0036079ef3f4cd03895c0ad672a09d9
Instruction Fuzzy Hash: EEF0E93153122666DB396F629C0AF6B3B4C9F417B0F15871DEC04A6480CB70E83046F1

Function 04D3084E Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04D30895

Memory Dump Source

Source File: 00000007.00000002.4505380054.0000000004D30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d30000_MPGPH131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: cb4bef39d99c4e6150ef92d8020b78de109b72371ab9c5555a78287e9d2df0bd
Instruction ID: a4d3bcf78c8f89f0474458d62529b54ea61c627320a34f66627ad07ea3dc9cb9
Opcode Fuzzy Hash: cb4bef39d99c4e6150ef92d8020b78de109b72371ab9c5555a78287e9d2df0bd
Instruction Fuzzy Hash: 2FE0228634E2503DF213A5662E109F76A1DCED3631334857AB8C6C2207E988AC1D51B1

Function 002C6E2D Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,002CD635,4D88C033,?,002CD635,00000220,?,002C57EF,4D88C033), ref: 002C6E5F

Memory Dump Source

Source File: 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000007.00000002.4496427930.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496541525.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496992886.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498264487.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498681856.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ebafbfaea1db20c30d47911c11b57269ba807adb1f3e43f9b8267260009a11e5
Instruction ID: 8f6c46e832be31053eb1f8ef47267bb5230e11632ac99052ecbacd655cdb9f76
Opcode Fuzzy Hash: ebafbfaea1db20c30d47911c11b57269ba807adb1f3e43f9b8267260009a11e5
Instruction Fuzzy Hash: D1E0E5391756165ADA313A65CC09F5B764C8B417B0F15072FEC00924D2CB50CC3085A4

Function 04D400DC Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

1, xrefs: 04D400F4

Memory Dump Source

Source File: 00000007.00000002.4505428808.0000000004D40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d40000_MPGPH131.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: 8553fbf817ab5f97fffae34bf0ec6ff255bd0e31713f058d05ea92ad996d9a7c
Instruction ID: 850b288377a6f556844fd65ac7e740a9f3bbce3b173d27ea238f13b3643364f0
Opcode Fuzzy Hash: 8553fbf817ab5f97fffae34bf0ec6ff255bd0e31713f058d05ea92ad996d9a7c
Instruction Fuzzy Hash: 2D113DFB24C210BEB14396926B14AFBABAEE5D2730730C42BF582C5506E2995B5E7131

Function 04D4009C Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4505428808.0000000004D40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d40000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14ff070b0185bd14b0e6e54b39d4cd3aeaddaf2716595181096dab1041fba690
Instruction ID: eada337e7544dba2a246f7301a95908d63645fb8044e5d8a6d4a44abd20f5322
Opcode Fuzzy Hash: 14ff070b0185bd14b0e6e54b39d4cd3aeaddaf2716595181096dab1041fba690
Instruction Fuzzy Hash: C6316DFB34C1217E704395856B15AFB5BAEE1D6B34330C42BF986D5502E2899B4E2131

Function 04D40112 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4505428808.0000000004D40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d40000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d321bc9b6e77f9a66fc9c6227af054830157c112b40a7de51b35ca8d8801855
Instruction ID: 4af99cd931c52e68bc3b2f38ea016a71f699a259a1898c9bb56992c84088feaa
Opcode Fuzzy Hash: 5d321bc9b6e77f9a66fc9c6227af054830157c112b40a7de51b35ca8d8801855
Instruction Fuzzy Hash: AE01E9FF24C1107E704295927B18EFB67AEE1D2730330C527F943D5502E2895B5E6171

Function 04D40153 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4505428808.0000000004D40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d40000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55d7a5043c413b4f4109bf25884b31abf34fb27b876f9c7772d02e6d04de7354
Instruction ID: bda204d518b6dece34a57cc9a68898d0b2056d79975db11da5812d23031d9aca
Opcode Fuzzy Hash: 55d7a5043c413b4f4109bf25884b31abf34fb27b876f9c7772d02e6d04de7354
Instruction Fuzzy Hash: 9A0128BA14C640BFA24386A56A089F6BB79F6D3630734446EF982D7043F2965219A231

Function 04D401C1 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4505428808.0000000004D40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d40000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe078d14a0619cf7ddb527f23d61491f1c5882dee738d07812e7ad1a5e00090b
Instruction ID: d7ba424051fc35da7343e73f4dfa545138fb40ded9f5a72502f5a3a5ec292877
Opcode Fuzzy Hash: fe078d14a0619cf7ddb527f23d61491f1c5882dee738d07812e7ad1a5e00090b
Instruction Fuzzy Hash: B0F090BF28D111BE614395A12708AF6AABDB5E36303744527F583D4902F285975E7270

Function 04D40000 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4505428808.0000000004D40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d40000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2b80680acc13ab334c0e7809eb1c4ca0d83f88ab8d16e7b967ab9691d83b0c9
Instruction ID: 958fc7d3ff140651eaf790b8edc4dc1d412ba9dc02d9e11474e0a4f4d1982c8b
Opcode Fuzzy Hash: d2b80680acc13ab334c0e7809eb1c4ca0d83f88ab8d16e7b967ab9691d83b0c9
Instruction Fuzzy Hash: E4F0EDFB34C165BE705390422E55DF71A2EE1D67783318426BA8BD6542F399AA4A3032

Non-executed Functions

Function 002B84A0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000007.00000002.4496427930.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496541525.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496992886.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498264487.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498681856.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction ID: bbe6706893308522768bf0182de4f41967739c2473e0555e83ee2cd9eb29734f
Opcode Fuzzy Hash: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction Fuzzy Hash: D1023C71E1121A9BDF14CFA9C8806EEFBB9FF48354F248269D519E7380DB31A951CB90

Function 04D40545 Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

E, xrefs: 04D404E9

Memory Dump Source

Source File: 00000007.00000002.4505428808.0000000004D40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d40000_MPGPH131.jbxd

Similarity

API ID:
String ID: E
API String ID: 0-972383279
Opcode ID: c109085f0313cc8cd1cdf65c0f67230347da5940e657dc05ed7ddca923c24c76
Instruction ID: 0b6713acf8c0eb1b6c5d7867e4230f038f55317b6e66503223308f5f435e2b9d
Opcode Fuzzy Hash: c109085f0313cc8cd1cdf65c0f67230347da5940e657dc05ed7ddca923c24c76
Instruction Fuzzy Hash: EA1171B710C5806FE7038524A918EFB7F28DBC7B34731805BE18687047F151950A9171

Function 04D40207 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4505428808.0000000004D40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d40000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f91f35f99c799fa9ce413baf5e63f7f6e92df4d7db45941e24878ba679a053f0
Instruction ID: 30e70b6d9287897d4fe4f1a66aabc9e29299bcac021d955673fbd6e4ad6a8a58
Opcode Fuzzy Hash: f91f35f99c799fa9ce413baf5e63f7f6e92df4d7db45941e24878ba679a053f0
Instruction Fuzzy Hash: 7EF0EC7730CA90BF6247456015C86BA7768EDC222133444FEEAC2CED83D165D45BE6B1

Function 0023F810 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0023F833
std::_Lockit::_Lockit.LIBCPMT ref: 0023F855
std::_Lockit::~_Lockit.LIBCPMT ref: 0023F875
std::_Lockit::~_Lockit.LIBCPMT ref: 0023F89F
std::_Lockit::_Lockit.LIBCPMT ref: 0023F90D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0023F959
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0023F973
std::_Lockit::~_Lockit.LIBCPMT ref: 0023FA08
std::_Facet_Register.LIBCPMT ref: 0023FA15

Strings

"/, xrefs: 0023F96B, 0023F972
bad locale name, xrefs: 0023FA2F

Memory Dump Source

Source File: 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000007.00000002.4496427930.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496541525.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496992886.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498264487.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498681856.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$"/
API String ID: 3375549084-1188037619
Opcode ID: 3a285ebabcfa9536c5826a11c3945500fc87f063c9472b171645b06cb9342405
Instruction ID: 1a52b5d5bccc1307b6ae5a42b191efb5dc6b5cc2003d162fc4a11836d4e7bd55
Opcode Fuzzy Hash: 3a285ebabcfa9536c5826a11c3945500fc87f063c9472b171645b06cb9342405
Instruction Fuzzy Hash: BA61CFB1D202099BEF10DFA4EA45BDEBBB4AF15310F144069E805AB381EB74E915CF91

Function 002B2E10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 002B2E47
___except_validate_context_record.LIBVCRUNTIME ref: 002B2E4F
_ValidateLocalCookies.LIBCMT ref: 002B2ED8
__IsNonwritableInCurrentImage.LIBCMT ref: 002B2F03
_ValidateLocalCookies.LIBCMT ref: 002B2F58

Strings

i0, xrefs: 002B2F78
csm, xrefs: 002B2EED

Memory Dump Source

Source File: 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000007.00000002.4496427930.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496541525.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496992886.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498264487.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498681856.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: i0$csm
API String ID: 1170836740-1866805317
Opcode ID: dbee62e5149e73ae7240dafcf94d0ef21dbe0738c8ed8b61c4f323501c396f79
Instruction ID: 32ac7f7cfeadbd2963840aa2b7b08df8b3fef845df534a84ea462bafd154c1fa
Opcode Fuzzy Hash: dbee62e5149e73ae7240dafcf94d0ef21dbe0738c8ed8b61c4f323501c396f79
Instruction Fuzzy Hash: CA41C430A20309DBCF10DF69C885AEEBBB5EF45394F148055E8149B792D771EE69CB90

Function 001D39F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 001D3A58
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 001D3AA4
__Getctype.LIBCPMT ref: 001D3ABA
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 001D3AE6
std::_Lockit::~_Lockit.LIBCPMT ref: 001D3B7B

Strings

bad locale name, xrefs: 001D3B96

Memory Dump Source

Source File: 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000007.00000002.4496427930.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496541525.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496992886.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498264487.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498681856.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: e336c04381489506ce98469e20e1aa0013bd86d0ae350632ed8ca0ff762a92d3
Instruction ID: 7eec70bbacd63bb50638145529670cbaa62c8c05c7e4b56e60d9b2299b9eeca0
Opcode Fuzzy Hash: e336c04381489506ce98469e20e1aa0013bd86d0ae350632ed8ca0ff762a92d3
Instruction Fuzzy Hash: B55144B1D102489FDF10DFA4D945BDDBBB8AF15310F14406AE819AB381EB75DA14CB52

Function 0023DE70 Relevance: 9.1, APIs: 6, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0023DE93
std::_Lockit::_Lockit.LIBCPMT ref: 0023DEB6
std::_Lockit::~_Lockit.LIBCPMT ref: 0023DED6
std::_Facet_Register.LIBCPMT ref: 0023DF4B
std::_Lockit::~_Lockit.LIBCPMT ref: 0023DF63
Concurrency::cancel_current_task.LIBCPMT ref: 0023DF7B

Memory Dump Source

Source File: 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000007.00000002.4496427930.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496541525.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496992886.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498264487.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498681856.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 3fcc8f2dd8ce59d5b053b5e8679bbf7d017a903f953f1645709824ea4ad6a51e
Instruction ID: c3f5f2e51c86c7bb40ed35f79696e9488f9dac318875ddca51c4b69ee872915a
Opcode Fuzzy Hash: 3fcc8f2dd8ce59d5b053b5e8679bbf7d017a903f953f1645709824ea4ad6a51e
Instruction Fuzzy Hash: D04123B5D202169FCB15DF54E881B6EBBB8FB11710F10426AE816AB752DB30AD21CBD1

Function 001D4C50 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 442COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 001D4F72
___std_exception_destroy.LIBVCRUNTIME ref: 001D4FFF
___std_exception_copy.LIBVCRUNTIME ref: 001D50C8

Strings

recursive_directory_iterator::operator++, xrefs: 001D504C

Memory Dump Source

Source File: 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000007.00000002.4496427930.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496541525.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496992886.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498264487.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498681856.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$___std_exception_copy
String ID: recursive_directory_iterator::operator++
API String ID: 1206660477-953255998
Opcode ID: ca26052e8f98b9b1c5fd7b2aee9a1f6a4e2ad062376d2f9617a647aa7de53046
Instruction ID: 977c9e67eec8c3d12b2928d7d57d3ff8a05cdf20fcdf868f4a016b3e73774ee2
Opcode Fuzzy Hash: ca26052e8f98b9b1c5fd7b2aee9a1f6a4e2ad062376d2f9617a647aa7de53046
Instruction Fuzzy Hash: FBE1E2B19106049FCB28DF68D895BAEF7F9FF44300F144A2EE45693781E774A914CBA1

Function 001D7820 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 001D799A
___std_exception_copy.LIBVCRUNTIME ref: 001D7B75

Strings

type_error, xrefs: 001D784A
out_of_range, xrefs: 001D7A27

Memory Dump Source

Source File: 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000007.00000002.4496427930.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496541525.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496992886.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498264487.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498681856.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: out_of_range$type_error
API String ID: 2659868963-3702451861
Opcode ID: 3b9fabe72a022adb020c0c12b9e90c2a241c656b08d31f4bc3cdd6034f6d1ebb
Instruction ID: b674fd593ab362357c3c0e7f3f47a3c52fb226ef3aaf768fe579279ba3ba9650
Opcode Fuzzy Hash: 3b9fabe72a022adb020c0c12b9e90c2a241c656b08d31f4bc3cdd6034f6d1ebb
Instruction Fuzzy Hash: CAC156B1D002088FDB08DFA8E9947ADFBF1AB49310F14866AE419EB791E7749984CB54

Function 001D2270 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 218COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 001D2275

Part of subcall function 002AD6E9: std::invalid_argument::invalid_argument.LIBCONCRT ref: 002AD6F5

Strings

L0, xrefs: 001D2347
L0, xrefs: 001D2427
string too long, xrefs: 001D2270

Memory Dump Source

Source File: 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000007.00000002.4496427930.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496541525.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496992886.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498264487.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498681856.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: string too long$L0$L0
API String ID: 1997705970-1638608421
Opcode ID: 8490484e3ed718928e4d1e8a565281a0dd77244087875b57fcc25a8bd79cf534
Instruction ID: de67a2654fe37548eab6af86c684d8b2c2d8ca9ac42ef4583abea7e05da30beb
Opcode Fuzzy Hash: 8490484e3ed718928e4d1e8a565281a0dd77244087875b57fcc25a8bd79cf534
Instruction Fuzzy Hash: 5A812475A042859FDB06CF68C4607EEBFB1FF6A300F18416BC9A4A7742C3798645CBA1

Function 001D73B0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 001D75BE
___std_exception_destroy.LIBVCRUNTIME ref: 001D75CD

Strings

, column , xrefs: 001D7434, 001D744A
at line , xrefs: 001D73F7

Memory Dump Source

Source File: 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000007.00000002.4496427930.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496541525.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496992886.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498264487.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498681856.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column
API String ID: 4194217158-191570568
Opcode ID: a779f5afa5746bba6e7bcc490a89991268e862839603d05a9dfb9a4c50c47bcc
Instruction ID: f8274f8b0619eec22966156a4b9cc3753fa667d835134da4d6afd29bb93263c5
Opcode Fuzzy Hash: a779f5afa5746bba6e7bcc490a89991268e862839603d05a9dfb9a4c50c47bcc
Instruction Fuzzy Hash: B4610571A042049FDB08DF68EC94BADBBB6FF45300F24462DE415A77C1E774AA54CB91

Function 001D3D10 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 001D3E7F

Strings

ios_base::eofbit set, xrefs: 001D3E41, 001D3E63
ios_base::badbit set, xrefs: 001D3E17
ios_base::failbit set, xrefs: 001D3D32

Memory Dump Source

Source File: 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000007.00000002.4496427930.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496541525.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496992886.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498264487.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498681856.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: 707a96433d09361d8b954ffb32816a226e6dcaa87bebb2d08964994ae3619097
Instruction ID: ec34735bd9e8b85d09d64430255fba95bba96aaf582367922541d2baf12672df
Opcode Fuzzy Hash: 707a96433d09361d8b954ffb32816a226e6dcaa87bebb2d08964994ae3619097
Instruction Fuzzy Hash: 5841C5B6900208AFCB04DF58C845BEEB7F9EB49310F14852BF925D7741E770AA108FA5

Function 001D3DE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 001D3E7F

Strings

ios_base::eofbit set, xrefs: 001D3E28, 001D3E41, 001D3E63
ios_base::badbit set, xrefs: 001D3E17
ios_base::failbit set, xrefs: 001D3D32, 001D3E1E

Memory Dump Source

Source File: 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000007.00000002.4496427930.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496541525.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496992886.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498264487.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498681856.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: 4c5ac9e67b2228a806689556943bbb9949273588420191857d46ac2ed5ff40eb
Instruction ID: 377aa51063d13f367f4840f4c5d71e4863d2eb10996cc4b1115d37f6eaa61e45
Opcode Fuzzy Hash: 4c5ac9e67b2228a806689556943bbb9949273588420191857d46ac2ed5ff40eb
Instruction Fuzzy Hash: 3D2108B2510305AFC714DF58D801B96F7D8AB04350F08883BFA6987781E770EA248B91

Function 001D6F40 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 349COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 001D7340

Strings

parse error, xrefs: 001D6FFF, 001D7018
parse_error, xrefs: 001D6F8B

Memory Dump Source

Source File: 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000007.00000002.4496427930.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496541525.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496992886.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498264487.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498681856.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: parse error$parse_error
API String ID: 2659868963-1820534363
Opcode ID: 73a6082c3ff85059db49390955e41f1bd66eacc0b976afd20812c25158f06e09
Instruction ID: eb281dc5de3bb0acc2be8a8c4f6e7498bb6ea29e511a4267ecd604c83117a59a
Opcode Fuzzy Hash: 73a6082c3ff85059db49390955e41f1bd66eacc0b976afd20812c25158f06e09
Instruction Fuzzy Hash: FBE18F70D042489FDB18CF68C8947ADBBB1FF49300F248269E419EB792E7749A85CF50

Function 001D6C60 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 001D6F11
___std_exception_destroy.LIBVCRUNTIME ref: 001D6F20

Strings

[json.exception., xrefs: 001D6CB8

Memory Dump Source

Source File: 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000007.00000002.4496427930.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496541525.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496992886.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498264487.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498681856.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.
API String ID: 4194217158-791563284
Opcode ID: 790557b696969aa77a97655168e22b0a79a0199f93f43922184a62aab90735dd
Instruction ID: ba68b37dc7840d83bdf5039b0c62cf856077ec49cbe9eea90d9e23d64c62cecb
Opcode Fuzzy Hash: 790557b696969aa77a97655168e22b0a79a0199f93f43922184a62aab90735dd
Instruction Fuzzy Hash: AA91E770A002049FDB18CF68D994BAEFBF6FF45300F20862DE415AB792D775A945CB90

Function 0024B450 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 190COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0024B612

Strings

invalid hash bucket count, xrefs: 0024B60D
Px$, xrefs: 0024B456, 0024B5BA, 0024B5F3, 0024B54A, 0024B4F1

Memory Dump Source

Source File: 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000007.00000002.4496427930.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496541525.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496992886.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498264487.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498681856.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_
String ID: Px$$invalid hash bucket count
API String ID: 909987262-1721581971
Opcode ID: df294b54a20dd5a98ea27c473de565f593aa9ed9f68095b67a8a92996a04e3e6
Instruction ID: fa0e18405247401935543f78bc820eb99f49c8f540618882be5deb9f32f00551
Opcode Fuzzy Hash: df294b54a20dd5a98ea27c473de565f593aa9ed9f68095b67a8a92996a04e3e6
Instruction Fuzzy Hash: 207124B4A10605DFCB19CF58C18086AFBF9FF88300764C5AAD8599B355D771EA62CF90

Function 0024E440 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0024E491

Strings

type must be boolean, but is , xrefs: 0024E582
type must be string, but is , xrefs: 0024E4F8

Memory Dump Source

Source File: 00000007.00000002.4496541525.00000000001D1000.00000040.00000001.01000000.00000005.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000007.00000002.4496427930.00000000001D0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496541525.0000000000303000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4496992886.0000000000308000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000030C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000049C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.000000000057F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4497101175.00000000005CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498264487.00000000005D0000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4498681856.0000000000779000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1d0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: type must be boolean, but is $type must be string, but is
API String ID: 118556049-436076039
Opcode ID: d9e71b3e7803f4f63ff18a054844532d87a8d4852e94ac18ae2da5fb9f9817d1
Instruction ID: e82ddf4cbe23fb6ceade92774aaa7aa7429cd0174a1844fb0c2665c534010f04
Opcode Fuzzy Hash: d9e71b3e7803f4f63ff18a054844532d87a8d4852e94ac18ae2da5fb9f9817d1
Instruction Fuzzy Hash: 6F417CB1910248AFEF18EBA4D842BDEB7A8EB10310F144675F815D77C2EB35E920C791

Analysis Process: RageMP131.exePID: 7252, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	2.1%
Signature Coverage:	0%
Total number of Nodes:	389
Total number of Limit Nodes:	62

Executed Functions

Function 00193A40 Relevance: 2.7, APIs: 2, Instructions: 157
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E9,?,00000001,00000000,?,?,?,?,?,?,?,?,00193DB6), ref: 00193B08
Sleep.KERNELBASE(00000001,?,00000001,00000000,?,?,?,?,?,?,?,?,00193DB6), ref: 00193BBA

Memory Dump Source

Source File: 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 00000008.00000002.4496437825.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496594215.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496988803.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498123126.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498472050.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 1dcbf5d2800823ad194629fb9a24eb22f16e685f2c51b7365056544888e8d80e
Instruction ID: 4c76ca5a7f84ae4f4d7845147b736a909d04ed86c72d2ec15f430ca1bafd9f90
Opcode Fuzzy Hash: 1dcbf5d2800823ad194629fb9a24eb22f16e685f2c51b7365056544888e8d80e
Instruction Fuzzy Hash: 08519935A042199FCF28CF58C8D0EAAB7B1EF45704F29859AD866AB351D731EE05CB90

Function 0014E0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 0014E0CB
socket.WS2_32(?,?,?), ref: 0014E17E
connect.WS2_32(00000000,?,?), ref: 0014E193
closesocket.WS2_32(00000000), ref: 0014E19E

Memory Dump Source

Source File: 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 00000008.00000002.4496437825.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496594215.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496988803.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498123126.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498472050.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: 5f35a3adedce056c4ff9249d22e6f492589afc8ec05e70ece650ca2507e477e9
Instruction ID: adeeff08c63fbbb417fdb2fa28a702cfa3f19f447e4ec7487c7217e1cb2c1825
Opcode Fuzzy Hash: 5f35a3adedce056c4ff9249d22e6f492589afc8ec05e70ece650ca2507e477e9
Instruction Fuzzy Hash: 5231B0716443006FDB209F25DC89B2BB7E4FB85728F015F1DF9A8932E0D33198188B92

Function 00214942 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

O!, xrefs: 00214A93, 00214A61, 00214AAB, 00214AC7

Memory Dump Source

Source File: 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 00000008.00000002.4496437825.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496594215.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496988803.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498123126.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498472050.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID: O!
API String ID: 0-3378388816
Opcode ID: 83cc3ab2b5d6dca641c8de62f5bd5ee9cf248633cb9d31bc2f04a505a21f77d4
Instruction ID: bc8382ed1db60b344367f1a6723a808a4882fe06e0946efc245a4d48ecb159e7
Opcode Fuzzy Hash: 83cc3ab2b5d6dca641c8de62f5bd5ee9cf248633cb9d31bc2f04a505a21f77d4
Instruction Fuzzy Hash: 80510670A10108AFCF10EF58CC95AEABBF1EF59324F258159F84D9B252D3719EA1CB90

Function 00224623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 00000008.00000002.4496437825.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496594215.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496988803.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498123126.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498472050.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 048c09f7c77a036c8da469c426eccb95cea16dad930afcf5e3d7f7ca7f44f970
Instruction ID: dffcde181e33e76295df6f4ed6b8a738818961be263c64e2424f9f8aae5e213d
Opcode Fuzzy Hash: 048c09f7c77a036c8da469c426eccb95cea16dad930afcf5e3d7f7ca7f44f970
Instruction Fuzzy Hash: 62B12770A24266BFDB11EFE8F840BAEBBF1AF55304F144159E5509B282C7B09DA1CF51

Function 04C80931 Relevance: 1.8, APIs: 1, Instructions: 287
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C80AA6

Memory Dump Source

Source File: 00000008.00000002.4505605801.0000000004C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4c80000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: a7cc6e5d47c065c053357e565b4cb1415583c8db09447f230937b5cfcddcc126
Instruction ID: 494c0f48ec73d393f35a5d011d817af6658909a4d49cfac44e3e6f8bbb507f5e
Opcode Fuzzy Hash: a7cc6e5d47c065c053357e565b4cb1415583c8db09447f230937b5cfcddcc126
Instruction Fuzzy Hash: 4C51A4BB34D150BDB102A6836B10AFB67BFE6D2738B36847EF403D6106E6941E4D6131

Function 04C80911 Relevance: 1.8, APIs: 1, Instructions: 286
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C80AA6

Memory Dump Source

Source File: 00000008.00000002.4505605801.0000000004C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4c80000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 653e7c8d7ca781e5fc07986af7ae203e0714088d5628791b53caebf5addd8c47
Instruction ID: 5e19eeda46cbff0c967c2a20e7371c3100bf9475896bc0978942ea529126e984
Opcode Fuzzy Hash: 653e7c8d7ca781e5fc07986af7ae203e0714088d5628791b53caebf5addd8c47
Instruction Fuzzy Hash: 88517EEB34D111BDB112A5832B20AFB56AFE6D2778F36847AF407D2502F7942A8D7131

Function 04C808BD Relevance: 1.8, APIs: 1, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C80AA6

Memory Dump Source

Source File: 00000008.00000002.4505605801.0000000004C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4c80000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: df054ec7d84b480286c57bcf8005c470e1e79e14f20a4ddcd32955d488504a61
Instruction ID: b039f6bab2b9d5383fe85842537d0b92d5581b1dca35e8dc00b6ae170ad6add3
Opcode Fuzzy Hash: df054ec7d84b480286c57bcf8005c470e1e79e14f20a4ddcd32955d488504a61
Instruction Fuzzy Hash: B2517FEB34D111BDB102A5832B20AFA57AFD6D2778B36847EF403D6102F6942A4D7131

Function 04C8091F Relevance: 1.8, APIs: 1, Instructions: 278
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C80AA6

Memory Dump Source

Source File: 00000008.00000002.4505605801.0000000004C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4c80000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 3da7560770d1b02cff79ab5639cef24e19be002fa5439c891bae710abe54a1db
Instruction ID: c4d0996b8c94837e26b81467ca4bb34ac2829e827c8adfb87b5417e25fd13ccd
Opcode Fuzzy Hash: 3da7560770d1b02cff79ab5639cef24e19be002fa5439c891bae710abe54a1db
Instruction Fuzzy Hash: B0517EEB34D121BDB102A5832B20AFB56AFE6D2778B36847EF403D1506F6942E4D7131

Function 04C808EF Relevance: 1.8, APIs: 1, Instructions: 269
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C80AA6

Memory Dump Source

Source File: 00000008.00000002.4505605801.0000000004C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4c80000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: d59da38796be4b5d302419c63994bcd42a3a62119151d8a7ae92629261498dcc
Instruction ID: 423a34e118bf8843744baa63330ca62e5bbd9fbe3b81238391f2d51cd564dce1
Opcode Fuzzy Hash: d59da38796be4b5d302419c63994bcd42a3a62119151d8a7ae92629261498dcc
Instruction Fuzzy Hash: 1851C5AB34D211BDF212A5932B10AFA67AFD6D2738F3A847EF403D5102F6941E4D6131

Function 04C809BF Relevance: 1.8, APIs: 1, Instructions: 253
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C80AA6

Memory Dump Source

Source File: 00000008.00000002.4505605801.0000000004C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4c80000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 7e68010b0cf8b8ea517296a744241a003c767b0a69cd69ed666a3f89e614114f
Instruction ID: d13243a81576fabb19a2c4c7082dacb140f0e93909847d819f849176755f9e56
Opcode Fuzzy Hash: 7e68010b0cf8b8ea517296a744241a003c767b0a69cd69ed666a3f89e614114f
Instruction Fuzzy Hash: 2D51C4BB30D225BDB102A5836B10AFA57AFE6D2778F36847EF403D6102F6946E4D6131

Function 04C8098E Relevance: 1.7, APIs: 1, Instructions: 242
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C80AA6

Memory Dump Source

Source File: 00000008.00000002.4505605801.0000000004C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4c80000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 1bff30909e58d0a893997982517dceea9f869a8d00636355ba7c4aa5ae6f980c
Instruction ID: 24f2c4f143bf7992a3cf42617b7be777ef729c3c388cd06813b281ec5bf043ca
Opcode Fuzzy Hash: 1bff30909e58d0a893997982517dceea9f869a8d00636355ba7c4aa5ae6f980c
Instruction Fuzzy Hash: A441A0EB34D115BDB112A5832B20AFA56AFD6D6778F36847AF403D2102F6D41E8D7131

Function 04C809A1 Relevance: 1.7, APIs: 1, Instructions: 239
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C80AA6

Memory Dump Source

Source File: 00000008.00000002.4505605801.0000000004C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4c80000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 363410116ae3ad85bfb3f50c9a3993a4e6e6492dd6221b89ac53115fc66d7c60
Instruction ID: 0dd8e2381007e855ab2e2d1897ec09a5c3c847e3a0332d2ae72bfc71c1d6cfd4
Opcode Fuzzy Hash: 363410116ae3ad85bfb3f50c9a3993a4e6e6492dd6221b89ac53115fc66d7c60
Instruction Fuzzy Hash: F941A0BB34D225BDB112A5832B20AFA56AFD6D6778F36847AF403D2102F6D41E4D7131

Function 04C809AD Relevance: 1.7, APIs: 1, Instructions: 234
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C80AA6

Memory Dump Source

Source File: 00000008.00000002.4505605801.0000000004C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4c80000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: f59c53122800ee80912fd647bd94bdc0e8c29a378f4abbdeae0a45b4cacc40b7
Instruction ID: 6340578a35770ce09e060d1c9e379ea2a25659172186cff5bdb35038d5ead9b7
Opcode Fuzzy Hash: f59c53122800ee80912fd647bd94bdc0e8c29a378f4abbdeae0a45b4cacc40b7
Instruction Fuzzy Hash: 17419FEB34D215BDB112A5832B10AFA66AFE6D6778F36847AF403D2102F6D41E4D7131

Function 0013A210 Relevance: 1.7, APIs: 1, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 0013A343

Memory Dump Source

Source File: 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 00000008.00000002.4496437825.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496594215.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496988803.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498123126.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498472050.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 092a03b920dedef74d3f1ecb313006ddb561323ab2b11039c37ab5c73cde540d
Instruction ID: 9768a6f726e0a21228e59e669dd0cbca655b2040ac02597b5d6dad6402b4f5b6
Opcode Fuzzy Hash: 092a03b920dedef74d3f1ecb313006ddb561323ab2b11039c37ab5c73cde540d
Instruction Fuzzy Hash: 6E715A71900204AFDB14DF68CC49BAFB7E8EF41300F60456DF8499B682D7B5DA81CB91

Function 04C809E7 Relevance: 1.7, APIs: 1, Instructions: 221
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C80AA6

Memory Dump Source

Source File: 00000008.00000002.4505605801.0000000004C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4c80000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 6f2db42ddb975eae74388bc1a2279a6ca9fe1a689a48752cc00f33ac60107bb4
Instruction ID: caab940e3300a433050ec09e976150fd440ab1437acf357fe2a55e16080c9a7b
Opcode Fuzzy Hash: 6f2db42ddb975eae74388bc1a2279a6ca9fe1a689a48752cc00f33ac60107bb4
Instruction Fuzzy Hash: 9441A0EB34D224BDB112A5832B10AF666AFE6D2778B36847AF403D6502F6D41E4D7131

Function 04C809FD Relevance: 1.7, APIs: 1, Instructions: 221COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C80AA6

Memory Dump Source

Source File: 00000008.00000002.4505605801.0000000004C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4c80000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 2eedf0ddd88d71b1d0fde34200310fb7a04a1b2004fe2c9afa24b47a186e88be
Instruction ID: 96946b15e2b6a143cb401b760966fd84c59780a9c5ec3c4148071678dfc39c8e
Opcode Fuzzy Hash: 2eedf0ddd88d71b1d0fde34200310fb7a04a1b2004fe2c9afa24b47a186e88be
Instruction Fuzzy Hash: 8341B1FB34C215BDB112A5832B10AF666AFE6D2678B36847EF403D2102F6D45E4D6131

Function 04C80A34 Relevance: 1.7, APIs: 1, Instructions: 217COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C80AA6

Memory Dump Source

Source File: 00000008.00000002.4505605801.0000000004C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4c80000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: e6ecd4e54a04ad1112b650e7498756bbc7319946bcfdf3a0a390c8c43192b385
Instruction ID: c445054d8e0bd40815eb1fd6e2b78a1530050fef685c0630dc36c58badeb843f
Opcode Fuzzy Hash: e6ecd4e54a04ad1112b650e7498756bbc7319946bcfdf3a0a390c8c43192b385
Instruction Fuzzy Hash: 3E4192EB34D214BDB112A5832B20AFB56AFE6D6778B36847EF403D2102F6D41E4D6132

Function 04C80A25 Relevance: 1.7, APIs: 1, Instructions: 210COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C80AA6

Memory Dump Source

Source File: 00000008.00000002.4505605801.0000000004C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4c80000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: c0e00de71c027d6e0ffda6f9f03ada3761001c63bc6a1d0ee37834c705f8a301
Instruction ID: 5753b99072838ab1a73b11f8df2714705823d2c11b5369c313236e4dff1ab72d
Opcode Fuzzy Hash: c0e00de71c027d6e0ffda6f9f03ada3761001c63bc6a1d0ee37834c705f8a301
Instruction Fuzzy Hash: 214191EB34D214BDB112A5832B20AF756AFE6D6778B36847AF403D2502F6D41E4D7132

Function 04C80AC8 Relevance: 1.7, APIs: 1, Instructions: 203COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C80AA6

Memory Dump Source

Source File: 00000008.00000002.4505605801.0000000004C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4c80000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 35ca1a510ce9d4e7a289df373f640b1750ce93d9f7247f6c6a828ae6e146430a
Instruction ID: a53acbfcd2cfbfe0b3bbd5807afa7198336923731ec7b8a19d28f962695aa485
Opcode Fuzzy Hash: 35ca1a510ce9d4e7a289df373f640b1750ce93d9f7247f6c6a828ae6e146430a
Instruction Fuzzy Hash: 5141D4EB34D214BDB112A5832B20AF757AFD6D6778B36847AF803D6102F6C45E4D6132

Function 0022549C Relevance: 1.7, APIs: 1, Instructions: 198fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000000,00219087,?,00000000,00000000,00000000,?,00000000,?,0013A3EB,00219087,00000000,0013A3EB,?,?), ref: 00225621

Memory Dump Source

Source File: 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 00000008.00000002.4496437825.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496594215.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496988803.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498123126.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498472050.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: e586226c977434460eceb83fdf1c17f3ad53128d8fbb749f073634473127e9a4
Instruction ID: d030150fa8878a1c992140c8ae8fdd7131c3c373811f8d1dfb2eb0138d7b40e9
Opcode Fuzzy Hash: e586226c977434460eceb83fdf1c17f3ad53128d8fbb749f073634473127e9a4
Instruction Fuzzy Hash: 4E619E7192053ABFDF119FE8E884AFEBBBAAF09304F548145E804A7215D375D961CBA0

Function 04C80A6A Relevance: 1.7, APIs: 1, Instructions: 195COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C80AA6

Memory Dump Source

Source File: 00000008.00000002.4505605801.0000000004C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4c80000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 7b963bf3e8a210d71cd8d9dd3e9d61f3f99f304a0a1f7754ed9aeae9778bc81f
Instruction ID: 466024557445fb8f9b10705c32bc93dcbc8b51e8a9e01fa5fc7e1c4fbefc1f42
Opcode Fuzzy Hash: 7b963bf3e8a210d71cd8d9dd3e9d61f3f99f304a0a1f7754ed9aeae9778bc81f
Instruction Fuzzy Hash: F731A2FB34D214BDB112A5832B20AFB56AED6D6778B36847AF803D6102F6C51E4D6032

Function 04C80A82 Relevance: 1.7, APIs: 1, Instructions: 192COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C80AA6

Memory Dump Source

Source File: 00000008.00000002.4505605801.0000000004C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4c80000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: d92ef6da152c721decd819d0c10f6c0e45eddc8fd6a3676038815bcf35345d9e
Instruction ID: f2cb4d72eb5072b1fc8ab946c5305b44e8fa951a7fb34293d1c3d48b103a48c0
Opcode Fuzzy Hash: d92ef6da152c721decd819d0c10f6c0e45eddc8fd6a3676038815bcf35345d9e
Instruction Fuzzy Hash: 4B31B1FB349210BDB112A5832B10EFB67AEE6D2738B36847AF803D1102F7D41A4D6032

Function 04C80AA0 Relevance: 1.7, APIs: 1, Instructions: 180COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 04C80AA6

Memory Dump Source

Source File: 00000008.00000002.4505605801.0000000004C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4c80000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 85c7472d6651f00c2432a9d20aa876b190d5c9a92c0768f1f39b4af42dc1c28b
Instruction ID: 064b508bb90bc95b306579c52198d27f0afbe287f76161d624440fba3cf8f09e
Opcode Fuzzy Hash: 85c7472d6651f00c2432a9d20aa876b190d5c9a92c0768f1f39b4af42dc1c28b
Instruction Fuzzy Hash: FD318FFB30D115BDB111A5832B20AFB53AED6D6778B36846AF803C1102E7C45A4D6132

Function 001A0560 Relevance: 1.6, APIs: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 001A06AE

Memory Dump Source

Source File: 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 00000008.00000002.4496437825.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496594215.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496988803.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498123126.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498472050.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction ID: 20c88e65975a37eeb0c4c1df0e4a1fee91b35dcac9ad282aa7b3478fbba802d0
Opcode Fuzzy Hash: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction Fuzzy Hash: F141D476A001149FCB16EF68DD805AE7BE5AF8A350F150169FC09DB342D730DE618BE1

Function 00224B12 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,002249F9,00000000,CF830579,00261140,0000000C,00224AB5,00218BBD,?), ref: 00224B68

Memory Dump Source

Source File: 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 00000008.00000002.4496437825.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496594215.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496988803.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498123126.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498472050.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 4abc29a2526f635204b834adaea4fdbe63365086a98b3edbb8069f7bad29cf44
Instruction ID: 329ca5d849f215c7ac4f1408e92a291664dac5c458c77b590d3332545488cb9f
Opcode Fuzzy Hash: 4abc29a2526f635204b834adaea4fdbe63365086a98b3edbb8069f7bad29cf44
Instruction Fuzzy Hash: C1114833E7413477DA247AF57805B7E67898B8277CF29028AF8188B0C2EFA0DC614995

Function 0021E05C Relevance: 1.6, APIs: 1, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00260DF8,0013A3EB,00000002,0013A3EB,00000000,?,?,?,0021E166,00000000,?,0013A3EB,00000002,00260DF8), ref: 0021E098

Memory Dump Source

Source File: 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 00000008.00000002.4496437825.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496594215.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496988803.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498123126.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498472050.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: ccc41eae3fc23aaaa5e6beacec14c0bbb4a49b32530cd061a184890022412181
Instruction ID: 30e2848e8090a8a4f5277f2abf273663a095f0c2eafe3b1d29f99fe9d5ec9b6a
Opcode Fuzzy Hash: ccc41eae3fc23aaaa5e6beacec14c0bbb4a49b32530cd061a184890022412181
Instruction Fuzzy Hash: 74012B32620515AFCF159F55CC05DDE3B69DB95324F250248FC50A7191EAB2EDA18BD0

Function 0020F290 Relevance: 1.6, APIs: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0013220E

Memory Dump Source

Source File: 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 00000008.00000002.4496437825.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496594215.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496988803.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498123126.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498472050.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 0647994880ecef6210d877e75e65b0a585e2c277952343184b95ebfeb14f2cce
Instruction ID: c6e3883adea6c022a6bf92facde348416d3fdcb6b4dc74f47bc47e5833cc709b
Opcode Fuzzy Hash: 0647994880ecef6210d877e75e65b0a585e2c277952343184b95ebfeb14f2cce
Instruction Fuzzy Hash: FD012B7541430DABCB24AFA8E80299977ECDE00350F444435FE18DB991EB70E9B08B90

Function 002263F3 Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,002191F7,00000000,?,00225D79,00000001,00000364,00000000,00000006,000000FF,?,00000000,0021D244,002189C3,002191F7,00000000), ref: 00226435

Memory Dump Source

Source File: 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 00000008.00000002.4496437825.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496594215.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496988803.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498123126.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498472050.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2513f8af59330f029d094f8e28391110bd1c1c834acfcb37ddfd242724e4bafe
Instruction ID: 3b365ced88c0823027b8e8210ddf851a2f31dffa08907f1f78a4aad009e11927
Opcode Fuzzy Hash: 2513f8af59330f029d094f8e28391110bd1c1c834acfcb37ddfd242724e4bafe
Instruction Fuzzy Hash: 32F05433535135B69B317FE2BD0AB5B7B499B81764B158061EC84A6580CB70E831C6F1

Function 00226E2D Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0022D635,4D88C033,?,0022D635,00000220,?,002257EF,4D88C033), ref: 00226E5F

Memory Dump Source

Source File: 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 00000008.00000002.4496437825.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496594215.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496988803.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498123126.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498472050.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7d0b49c685767e6bacb3b0b687675bd4f68284e86307abb4a5bc35eb4a92fce1
Instruction ID: d76b6d418d057d1d8407c2058c898887e50c111e198e108b481187da03de78b9
Opcode Fuzzy Hash: 7d0b49c685767e6bacb3b0b687675bd4f68284e86307abb4a5bc35eb4a92fce1
Instruction Fuzzy Hash: 6BE0E53B171532B6DA312AE5FD09F5B76888B917A0F270120FC50924D1CB60CC3045A4

Function 04C9018D Relevance: 1.4, Strings: 1, Instructions: 174COMMON

Download Yara Rule

Strings

@lFs, xrefs: 04C90192

Memory Dump Source

Source File: 00000008.00000002.4505685874.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4c90000_RageMP131.jbxd

Similarity

API ID:
String ID: @lFs
API String ID: 0-2494725472
Opcode ID: 530bb552cf4fdb0069f74a8d04bd3c63fffcf4eee88e3b5103c21398d947fd22
Instruction ID: 46ea3ffe845c724023717eca9281c4abf9d7f06315abe99e4f4a039864402b4c
Opcode Fuzzy Hash: 530bb552cf4fdb0069f74a8d04bd3c63fffcf4eee88e3b5103c21398d947fd22
Instruction Fuzzy Hash: CB3196FB24C1557D755295932B18DF76BAEE6C2B30334C42BF803D5542E2995E4E3131

Function 04C901B0 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4505685874.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4c90000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 421fad94f924f8737e472eff1731a25a12ff0ba4e7d220e2b88bfb71bf0f2571
Instruction ID: a4d1d4989789934a14f586364c6964a800716d98f7f6b020af580e0481466374
Opcode Fuzzy Hash: 421fad94f924f8737e472eff1731a25a12ff0ba4e7d220e2b88bfb71bf0f2571
Instruction Fuzzy Hash: 173130EB64C1657DB54295832B28EFB6BAEE6C2B70334C42BF803D1542E2981E5D3132

Function 04C901E1 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4505685874.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4c90000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cf5fb9c83489af29df8c0829a10323c18756920f4d2d670cbc362f6b7f7f291
Instruction ID: cdbf8ad0859d763c27eca6cfaf8e0574f4465576f66d0947270003dd5df6bd63
Opcode Fuzzy Hash: 9cf5fb9c83489af29df8c0829a10323c18756920f4d2d670cbc362f6b7f7f291
Instruction Fuzzy Hash: 0E2180EB64C165BDB94195532B2CAFB6BAEE7C2730338842BF803C1542E2985E4D3132

Function 04C901FF Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4505685874.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4c90000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95d456848390d09c6988ee2f1643d7f7551cc43c7bdb367aca1d0d0628c1be66
Instruction ID: 0a5010903e2ab6ca6f3c4c2db5d902298a9c0ed535333d0543907d4d97ee26b5
Opcode Fuzzy Hash: 95d456848390d09c6988ee2f1643d7f7551cc43c7bdb367aca1d0d0628c1be66
Instruction Fuzzy Hash: 912150EB64C5657DB54191833F28AFB6BAEE6C2B30334C42BF843C1542E2995E4D3131

Function 04C9020C Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4505685874.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4c90000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a12fdae72f5a455646b225cdc58958d41ad89e4ea13becb840e5d558c9f155dc
Instruction ID: 223c08a6b62c9323217505033de9893a2bf64ccd3d41d1925e6be4e4bd3d3e60
Opcode Fuzzy Hash: a12fdae72f5a455646b225cdc58958d41ad89e4ea13becb840e5d558c9f155dc
Instruction Fuzzy Hash: 782180EB60C1657DB94695436B28AFBABAEE6D2B30338C42BF443C1502E2995E4D3131

Function 04C90225 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4505685874.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4c90000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cac5a25f465a75153dba91856481fd1534cdb010eb6774f4b57a2376ce8223c
Instruction ID: 9605d8149f217c8a78d0cefc16abe832f773667b0ca0275d79305e783153fc91
Opcode Fuzzy Hash: 0cac5a25f465a75153dba91856481fd1534cdb010eb6774f4b57a2376ce8223c
Instruction Fuzzy Hash: 30111CEB20C1217DB54290837F28AFB6BAEE6D2B30335C427F847C5502E2985E4D3172

Function 04C902B4 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4505685874.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4c90000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6601f2b13d24a0aea03d3491e6a21001fe637d349ba50308226f08f1351c328b
Instruction ID: 73e3fa23a6ec3ef9b8d6dcbee0e1d7d0bd5740a5c04c2570067a2f0afbb14dbd
Opcode Fuzzy Hash: 6601f2b13d24a0aea03d3491e6a21001fe637d349ba50308226f08f1351c328b
Instruction Fuzzy Hash: CB112BEB24C5517DBA4195837F28EFB67AEE6D6B30335C42BF802C5406E2981E4E2031

Function 04C9023F Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4505685874.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4c90000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ef432ba63d72c970f9c89ba6765e245cd82036b203b6d6c5a2079e45461e2a6
Instruction ID: 1578fa6cfb8deb1a2414242cbb34e1a6f2f8bfb028ef988433711680cdb74acd
Opcode Fuzzy Hash: 6ef432ba63d72c970f9c89ba6765e245cd82036b203b6d6c5a2079e45461e2a6
Instruction Fuzzy Hash: 22113AFB24C1257DB54191833F28AFAA7AEE6D2B30335C42BF803C5402E2981E4D3171

Function 04C9024F Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4505685874.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4c90000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b066dc2e74441ddce6b947c394f82e09be04b61a7f0f2adf8d98896f44905b63
Instruction ID: 0368ccf402a82f4b28388fcc1dc10aa02ff1a11b9265fbe558d2e1978418834b
Opcode Fuzzy Hash: b066dc2e74441ddce6b947c394f82e09be04b61a7f0f2adf8d98896f44905b63
Instruction Fuzzy Hash: 45110AEB24C1657DB54295833F28DFB67BEE6D2B30335C82BF802C5402E2981E4E2171

Function 04C90265 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4505685874.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4c90000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1741056122df57eabd6be4323cf546c5a29bc8ef8ecf06049a97b4ae0adbc398
Instruction ID: 29ca9442817280eee434352a4ba96f5f9fb5261b6dd4cdec403e41f70034fd42
Opcode Fuzzy Hash: 1741056122df57eabd6be4323cf546c5a29bc8ef8ecf06049a97b4ae0adbc398
Instruction Fuzzy Hash: 24110CEB24C1517DB54291433F28DFA57AEE6D2B30335C86BF843C5406E2995E4E3131

Function 04C9029E Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4505685874.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4c90000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2afc77a754f5ca5ea6203e593737f9309f3c36b3df2c0dadad245b79a4b072df
Instruction ID: 5ff285b6e7bc9a78c856492ead288d043c28d0799ac7b914ab3315e0e8d5c38c
Opcode Fuzzy Hash: 2afc77a754f5ca5ea6203e593737f9309f3c36b3df2c0dadad245b79a4b072df
Instruction Fuzzy Hash: 54F062EB64C1117EA54190932B2CAFA5BBEF6D2B30379C86BF443C5001F2885E4E3171

Non-executed Functions

Function 002184A0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 00000008.00000002.4496437825.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496594215.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496988803.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498123126.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498472050.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction ID: bde0113280cfbda9c95275b2583dce71ed5cd7b5b2f1ff4133e380229173fa05
Opcode Fuzzy Hash: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction Fuzzy Hash: 4D025B71E1121A9BDF14CFA8C8C06EEFBF5FF58314F258269D919A7380DB31A9518B90

Function 0019F810 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0019F833
std::_Lockit::_Lockit.LIBCPMT ref: 0019F855
std::_Lockit::~_Lockit.LIBCPMT ref: 0019F875
std::_Lockit::~_Lockit.LIBCPMT ref: 0019F89F
std::_Lockit::_Lockit.LIBCPMT ref: 0019F90D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0019F959
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0019F973
std::_Lockit::~_Lockit.LIBCPMT ref: 0019FA08
std::_Facet_Register.LIBCPMT ref: 0019FA15

Strings

bad locale name, xrefs: 0019FA2F
"%, xrefs: 0019F96B, 0019F972

Memory Dump Source

Source File: 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 00000008.00000002.4496437825.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496594215.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496988803.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498123126.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498472050.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$"%
API String ID: 3375549084-2785405677
Opcode ID: 4a54bf5f6e3152a018bb00732e1ad6b7508442f0a4e6be0fa36ab11bad9f5f2d
Instruction ID: ee9b7f4059d942a84a4923003dc0c330985f7655f3f5f0108cb6b216cd744a21
Opcode Fuzzy Hash: 4a54bf5f6e3152a018bb00732e1ad6b7508442f0a4e6be0fa36ab11bad9f5f2d
Instruction Fuzzy Hash: 0F617CB1D10208EBEF10DFA4D849B9EBBF4AF14714F184468E805E7381E775AD56CB91

Function 00212E10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00212E47
___except_validate_context_record.LIBVCRUNTIME ref: 00212E4F
_ValidateLocalCookies.LIBCMT ref: 00212ED8
__IsNonwritableInCurrentImage.LIBCMT ref: 00212F03
_ValidateLocalCookies.LIBCMT ref: 00212F58

Strings

csm, xrefs: 00212EED
i&, xrefs: 00212F78

Memory Dump Source

Source File: 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 00000008.00000002.4496437825.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496594215.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496988803.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498123126.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498472050.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: i&$csm
API String ID: 1170836740-3583052009
Opcode ID: 502c7fd2cc1b6305c62e736f76ed96174aa6e38b662974a43a9185f2d4dd9457
Instruction ID: 7f0d160eddc657807d555fb2c4130da08c0cff65e6a9c9554e2eb7bae3c02c9b
Opcode Fuzzy Hash: 502c7fd2cc1b6305c62e736f76ed96174aa6e38b662974a43a9185f2d4dd9457
Instruction Fuzzy Hash: B3419230A20209DBCF10DF68D885ADEBBF5EF55324F148055F9149B292D732EAB9CB91

Function 001339F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00133A58
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00133AA4
__Getctype.LIBCPMT ref: 00133ABA
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00133AE6
std::_Lockit::~_Lockit.LIBCPMT ref: 00133B7B

Strings

bad locale name, xrefs: 00133B96

Memory Dump Source

Source File: 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 00000008.00000002.4496437825.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496594215.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496988803.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498123126.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498472050.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: 39bd3b24db54c8945a5bd8bbaffa1dc1c88ce69294c0efdb10762d82777e3811
Instruction ID: 60b0b95d657660890123011f12d31e36870daadeb48752eb23c3c8ce6cd24115
Opcode Fuzzy Hash: 39bd3b24db54c8945a5bd8bbaffa1dc1c88ce69294c0efdb10762d82777e3811
Instruction Fuzzy Hash: F3513CB1D00348DBEF10DFA4D845B9EFBB8AF14310F144069E809AB382E775DA58CBA5

Function 0019DE70 Relevance: 9.1, APIs: 6, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0019DE93
std::_Lockit::_Lockit.LIBCPMT ref: 0019DEB6
std::_Lockit::~_Lockit.LIBCPMT ref: 0019DED6
std::_Facet_Register.LIBCPMT ref: 0019DF4B
std::_Lockit::~_Lockit.LIBCPMT ref: 0019DF63
Concurrency::cancel_current_task.LIBCPMT ref: 0019DF7B

Memory Dump Source

Source File: 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 00000008.00000002.4496437825.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496594215.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496988803.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498123126.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498472050.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: db6ba1707d3abd9644993d4242b9ed1c54b2dd77ded878fd3753c344aa5ea57b
Instruction ID: 5bbc7e19c18dc5cbb7f804ee8bc3cc3c85cc3a2ec7f3de1f221a2ef33f8ba2f8
Opcode Fuzzy Hash: db6ba1707d3abd9644993d4242b9ed1c54b2dd77ded878fd3753c344aa5ea57b
Instruction Fuzzy Hash: C4412672910219DFCF14DF94E986A6EBBB4FB10720F148268E8156B392D770AD11CBD1

Function 00134C50 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 442COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00134F72
___std_exception_destroy.LIBVCRUNTIME ref: 00134FFF
___std_exception_copy.LIBVCRUNTIME ref: 001350C8

Strings

recursive_directory_iterator::operator++, xrefs: 0013504C

Memory Dump Source

Source File: 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 00000008.00000002.4496437825.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496594215.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496988803.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498123126.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498472050.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$___std_exception_copy
String ID: recursive_directory_iterator::operator++
API String ID: 1206660477-953255998
Opcode ID: aa329517829dd043ed5df8be018229e123097f1a4f8f567f8a8a5bda6c51010f
Instruction ID: 253f524e4b1548819be38e26e859700b79edce99598856a978eeba78fb40dec4
Opcode Fuzzy Hash: aa329517829dd043ed5df8be018229e123097f1a4f8f567f8a8a5bda6c51010f
Instruction Fuzzy Hash: 4AE1E2B19106049FCB28DF68D845BAEBBF9FF44300F148A2DE45693B81E774B954CBA1

Function 00137820 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0013799A
___std_exception_copy.LIBVCRUNTIME ref: 00137B75

Strings

out_of_range, xrefs: 00137A27
type_error, xrefs: 0013784A

Memory Dump Source

Source File: 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 00000008.00000002.4496437825.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496594215.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496988803.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498123126.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498472050.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: out_of_range$type_error
API String ID: 2659868963-3702451861
Opcode ID: 540c24e0f071101a32b1eca3f3cc57115b9605288b9a43b435352324834673d2
Instruction ID: 0873fba22ab0ce2be53dfb639add407632513e482b25baa43b04831e90967bc9
Opcode Fuzzy Hash: 540c24e0f071101a32b1eca3f3cc57115b9605288b9a43b435352324834673d2
Instruction Fuzzy Hash: C7C157B19002089FDB18CFA8D984B9DFBF5FF49310F14866AE419EB781E774A984CB54

Function 00132270 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 218COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00132275

Part of subcall function 0020D6E9: std::invalid_argument::invalid_argument.LIBCONCRT ref: 0020D6F5

Strings

string too long, xrefs: 00132270
L&, xrefs: 00132347
L&, xrefs: 00132427

Memory Dump Source

Source File: 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 00000008.00000002.4496437825.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496594215.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496988803.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498123126.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498472050.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: string too long$L&$L&
API String ID: 1997705970-2440114816
Opcode ID: caede21bbe6da2d8325baf246a4404f57dd146b58e2bb040046a6ae201ebde9e
Instruction ID: 5b3de2f90b9657f3117d96fcc1dd6357183e1885e244b762af2c0565347044f0
Opcode Fuzzy Hash: caede21bbe6da2d8325baf246a4404f57dd146b58e2bb040046a6ae201ebde9e
Instruction Fuzzy Hash: 9A811275A042899FDB06DF68C460BEEBFF1FF6A300F18416AC894A7782C3758545CBA1

Function 001373B0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 001375BE
___std_exception_destroy.LIBVCRUNTIME ref: 001375CD

Strings

, column , xrefs: 00137434, 0013744A
at line , xrefs: 001373F7

Memory Dump Source

Source File: 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 00000008.00000002.4496437825.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496594215.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496988803.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498123126.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498472050.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column
API String ID: 4194217158-191570568
Opcode ID: 95248feb7ad489353458c012df0ff6237a5906c97576e95e4986a57363183d99
Instruction ID: e713cffd93a8342dc265857860f14b9b779d03d1872c0bdf27575f4e9eea48ee
Opcode Fuzzy Hash: 95248feb7ad489353458c012df0ff6237a5906c97576e95e4986a57363183d99
Instruction Fuzzy Hash: 2061E1B0A002049FDB1CDF68DC94BADBBB6FF45300F244628E415A7BC2D774AA948B91

Function 00133D10 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00133E7F

Strings

ios_base::badbit set, xrefs: 00133E17
ios_base::eofbit set, xrefs: 00133E41, 00133E63
ios_base::failbit set, xrefs: 00133D32

Memory Dump Source

Source File: 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 00000008.00000002.4496437825.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496594215.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496988803.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498123126.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498472050.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: 64febd75ea1defa470ad7b3011e45b44c48d1f549c5fe142f83530c4ebef8e78
Instruction ID: 2d5e31264e3a3d13f64ec59032cca74881ff3375f8c859c39f11909fe2193e10
Opcode Fuzzy Hash: 64febd75ea1defa470ad7b3011e45b44c48d1f549c5fe142f83530c4ebef8e78
Instruction Fuzzy Hash: 4841E5B2900208AFCB04DF58D845BEEB7F8EF49310F14852AF929D7741E770AA518BA4

Function 00133DE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00133E7F

Strings

ios_base::badbit set, xrefs: 00133E17
ios_base::eofbit set, xrefs: 00133E28, 00133E41, 00133E63
ios_base::failbit set, xrefs: 00133D32, 00133E1E

Memory Dump Source

Source File: 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 00000008.00000002.4496437825.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496594215.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496988803.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498123126.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498472050.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: 2a08587c746d88124f316b24918324e75a92d8b8ac6f7c870d5a50c47ae9d4a3
Instruction ID: cc3c1446fa671a292058142bfe81be661c9c41c6035c3aacaf34c4e00ddd5208
Opcode Fuzzy Hash: 2a08587c746d88124f316b24918324e75a92d8b8ac6f7c870d5a50c47ae9d4a3
Instruction Fuzzy Hash: 0B212BB2910304AFC714DF58D805B96B7DCAB15310F08883AFE78C7641E770EA64CB94

Function 00136F40 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 349COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00137340

Strings

parse_error, xrefs: 00136F8B
parse error, xrefs: 00136FFF, 00137018

Memory Dump Source

Source File: 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 00000008.00000002.4496437825.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496594215.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496988803.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498123126.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498472050.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: parse error$parse_error
API String ID: 2659868963-1820534363
Opcode ID: c8476df3bccb410aaeb4ff1cc796e1777eb874f8314be004736b49cc16b15b32
Instruction ID: ef308799dead33717b3887087c51cdcc24be091f2186bd8655a685de9c041b42
Opcode Fuzzy Hash: c8476df3bccb410aaeb4ff1cc796e1777eb874f8314be004736b49cc16b15b32
Instruction Fuzzy Hash: 2CE16EB19042488FDB18CF68C994BADBBF1FF49300F248269E418EB792D7749A85CF51

Function 00136C60 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00136F11
___std_exception_destroy.LIBVCRUNTIME ref: 00136F20

Strings

[json.exception., xrefs: 00136CB8

Memory Dump Source

Source File: 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 00000008.00000002.4496437825.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496594215.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496988803.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498123126.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498472050.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.
API String ID: 4194217158-791563284
Opcode ID: d17a50bc521287bf69b06eb3116490c74b242475790006aead737d8738004055
Instruction ID: 39e1b33da134756bc4e5c3fb801c1326f2bee5662c519cc35e6b94a182fde5f8
Opcode Fuzzy Hash: d17a50bc521287bf69b06eb3116490c74b242475790006aead737d8738004055
Instruction Fuzzy Hash: 4391D470A002049FDB18CF68D994BAEBBF6FF45300F20866CE459AB792D775A985CB50

Function 001AE440 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 001AE491

Strings

type must be string, but is , xrefs: 001AE4F8
type must be boolean, but is , xrefs: 001AE582

Memory Dump Source

Source File: 00000008.00000002.4496594215.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 00000008.00000002.4496437825.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496594215.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4496988803.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4497056945.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498123126.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.4498472050.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: type must be boolean, but is $type must be string, but is
API String ID: 118556049-436076039
Opcode ID: ada7ecae50ea3af7e7b299258ca7013531d35b153ffce0ec69130373915f08c8
Instruction ID: 50c3bfae8fa7e8564c86067a1522744ef176f232a6406315d3c94f091652707f
Opcode Fuzzy Hash: ada7ecae50ea3af7e7b299258ca7013531d35b153ffce0ec69130373915f08c8
Instruction Fuzzy Hash: 5F419CB9904248AFDB14EBA4D802BAEB7ECDB15300F144574F805D7682EB35EA54C791

Analysis Process: RageMP131.exePID: 7568, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	4.8%
Signature Coverage:	0%
Total number of Nodes:	756
Total number of Limit Nodes:	79

Executed Functions

Function 00193A40 Relevance: 2.7, APIs: 2, Instructions: 157
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E9,?,00000001,00000000,?,?,?,?,?,?,?,?,00193DB6), ref: 00193B08
Sleep.KERNELBASE(00000001,?,00000001,00000000,?,?,?,?,?,?,?,?,00193DB6), ref: 00193BBA

Memory Dump Source

Source File: 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000A.00000002.4496465970.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496595662.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496987481.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498121363.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498469107.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 1ee8e0f17a8c5cac38af342f6c1e6a78066e47474a1114e984294fe282be5cba
Instruction ID: ee48a5b8860cb459710b52d3722918763617b59e759811ef2877f0737835d176
Opcode Fuzzy Hash: 1ee8e0f17a8c5cac38af342f6c1e6a78066e47474a1114e984294fe282be5cba
Instruction Fuzzy Hash: D651A935A042199FCF28CF58C8D0EAAB3B1EF45704F29859AD466AB351D731EE05CB90

Function 0014E0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 0014E0CA
socket.WS2_32(?,?,?), ref: 0014E17F
connect.WS2_32(00000000,?,?), ref: 0014E193
closesocket.WS2_32(00000000), ref: 0014E19E

Memory Dump Source

Source File: 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000A.00000002.4496465970.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496595662.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496987481.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498121363.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498469107.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: 536c6b0c956c741ac8e5c90f1a490874564bbb68eada41272a3967eaaa146fba
Instruction ID: 415859c9fd368dd0af9f4c58c1aac9bbddc2d8311d927ca6d4f57a47f22a1090
Opcode Fuzzy Hash: 536c6b0c956c741ac8e5c90f1a490874564bbb68eada41272a3967eaaa146fba
Instruction Fuzzy Hash: A13190726443016FDB209F259C49B2BB7E4FB85728F115F1DF9A8962E0D37198188B92

Function 00214942 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

O!, xrefs: 00214A93, 00214A61, 00214AAB, 00214AC7

Memory Dump Source

Source File: 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000A.00000002.4496465970.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496595662.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496987481.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498121363.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498469107.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID: O!
API String ID: 0-3378388816
Opcode ID: 83cc3ab2b5d6dca641c8de62f5bd5ee9cf248633cb9d31bc2f04a505a21f77d4
Instruction ID: bc8382ed1db60b344367f1a6723a808a4882fe06e0946efc245a4d48ecb159e7
Opcode Fuzzy Hash: 83cc3ab2b5d6dca641c8de62f5bd5ee9cf248633cb9d31bc2f04a505a21f77d4
Instruction Fuzzy Hash: 80510670A10108AFCF10EF58CC95AEABBF1EF59324F258159F84D9B252D3719EA1CB90

Function 00224623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000A.00000002.4496465970.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496595662.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496987481.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498121363.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498469107.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bfdb33ce1bf3132f9d6a6fc73ba6ff0501edcbddeb889383ddb5320d4cbe2be
Instruction ID: edb1a1e6e52d049215569228c87aa79f081ea1df820ed988da733170ec3c4268
Opcode Fuzzy Hash: 1bfdb33ce1bf3132f9d6a6fc73ba6ff0501edcbddeb889383ddb5320d4cbe2be
Instruction Fuzzy Hash: 78B13770A20266BFDB11EFE8F844BAEBBF5AF55300F144159E550AB282C7B09DA1CF51

Function 05080845 Relevance: 1.8, APIs: 1, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.4505200126.0000000005080000.00000040.00001000.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5080000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d40cf87f9ab816976b9e818032394d687942c93078d44cc591480b60922ea19
Instruction ID: 5c10e4dd4d42fd6f48079ba853486af344372a943ba0d0b7382d8e21a3734bd4
Opcode Fuzzy Hash: 8d40cf87f9ab816976b9e818032394d687942c93078d44cc591480b60922ea19
Instruction Fuzzy Hash: 8E5168EB24D125BCB202E6817B3CEFE6B6FE6D27307318466F887D6502E6940E8D5131

Function 05080855 Relevance: 1.8, APIs: 1, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.4505200126.0000000005080000.00000040.00001000.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5080000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c2d3cee89d29cbbf180ba19c8ca2af5eda65d4d7f8eac28a54670591b5ee67c
Instruction ID: a3784ee3e594f5620582c70bef6bd136c6f5fa48e89ccbf74239477340971b3b
Opcode Fuzzy Hash: 1c2d3cee89d29cbbf180ba19c8ca2af5eda65d4d7f8eac28a54670591b5ee67c
Instruction Fuzzy Hash: 135168EB24D125BCB202E6817B3CEFE6B6FE6D27307318466F887D6502E6940E8D5131

Function 05080862 Relevance: 1.8, APIs: 1, Instructions: 323
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(00000081), ref: 05080A86

Memory Dump Source

Source File: 0000000A.00000002.4505200126.0000000005080000.00000040.00001000.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5080000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: a055664c17c9d8777e60dea44ed4cd98df4357fb83a54191160028d61badb5c7
Instruction ID: 50c51698abe2ed7f91c4b17baac47cb852a2f99198184576918d7cf94962cac4
Opcode Fuzzy Hash: a055664c17c9d8777e60dea44ed4cd98df4357fb83a54191160028d61badb5c7
Instruction Fuzzy Hash: AB5149EB24D125BCB102E6817B38EFE676FE2D27307318466F887D5502E7944E8D5131

Function 05080880 Relevance: 1.8, APIs: 1, Instructions: 308
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(00000081), ref: 05080A86

Memory Dump Source

Source File: 0000000A.00000002.4505200126.0000000005080000.00000040.00001000.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5080000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 9a3aec71a2a728a6c072a72b273e4b8d201aa85ed183931da427d5740cd9d193
Instruction ID: 7d6127a6ba1601b9582ae3373546154997e25526b12c2ce046cf02407bfe1a72
Opcode Fuzzy Hash: 9a3aec71a2a728a6c072a72b273e4b8d201aa85ed183931da427d5740cd9d193
Instruction Fuzzy Hash: AF5157FB24D125BCB201E6817B78EFE676FE6D2730731846AF887D2502E7944A8E5131

Function 05080897 Relevance: 1.8, APIs: 1, Instructions: 307
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(00000081), ref: 05080A86

Memory Dump Source

Source File: 0000000A.00000002.4505200126.0000000005080000.00000040.00001000.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5080000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 7bb9ddbfffa4720bd48760a5e3ea961df87f6f45c9af746bfaad3feb6afb8479
Instruction ID: b363ef2bd87eabd85fe60571bc0602041b9f8b7b3db4a48efccf9f5510c7fcd4
Opcode Fuzzy Hash: 7bb9ddbfffa4720bd48760a5e3ea961df87f6f45c9af746bfaad3feb6afb8479
Instruction Fuzzy Hash: A7516AFB24D125BDB201E6817B38EFE6B6FE6D67307318466F887D6502E2940E8D5131

Function 050808B4 Relevance: 1.8, APIs: 1, Instructions: 302
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(00000081), ref: 05080A86

Memory Dump Source

Source File: 0000000A.00000002.4505200126.0000000005080000.00000040.00001000.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5080000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 1767b62319410129ad6e42b6e187f76a12c37e5e5246b8ba543ea4b80d2d1c63
Instruction ID: 22998253cca68d92cdb0f6acc6e7075954401e44bfb9344b80f3fbbd74df956c
Opcode Fuzzy Hash: 1767b62319410129ad6e42b6e187f76a12c37e5e5246b8ba543ea4b80d2d1c63
Instruction Fuzzy Hash: 74518DFB24D115BDB202E6817B38EFE6B6FE2D2730731846AF887D5502E3940A8D5131

Function 05080925 Relevance: 1.8, APIs: 1, Instructions: 300
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.4505200126.0000000005080000.00000040.00001000.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5080000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f4c6ad9070cb59c94093faa448dd34442478fc92e826eb22985ae2120776631
Instruction ID: 2aa720f947e94a8ae13acc87dd213137950e4a4438c5a6167ea0702d8cb7ef55
Opcode Fuzzy Hash: 3f4c6ad9070cb59c94093faa448dd34442478fc92e826eb22985ae2120776631
Instruction Fuzzy Hash: 27517BFB24D125BCB202E6817B38EFE6B6FE2D27307318466F887D5502E2840E8E5131

Function 050808ED Relevance: 1.8, APIs: 1, Instructions: 292
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(00000081), ref: 05080A86

Memory Dump Source

Source File: 0000000A.00000002.4505200126.0000000005080000.00000040.00001000.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5080000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 3b96d6efb0e0e256c6a096a61240bd90a5f9ac19036235cf34ca7c0a863208b1
Instruction ID: 7846f2a6da2fc17bdc3a1ef387e97a2a4fc713938069bc0286cb9f970d152a7f
Opcode Fuzzy Hash: 3b96d6efb0e0e256c6a096a61240bd90a5f9ac19036235cf34ca7c0a863208b1
Instruction Fuzzy Hash: BE514BFB24D125BCB102E6827B78EFE5A6FE2D27307318466F887D5502E7944E8E1531

Function 05080906 Relevance: 1.8, APIs: 1, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(00000081), ref: 05080A86

Memory Dump Source

Source File: 0000000A.00000002.4505200126.0000000005080000.00000040.00001000.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5080000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 26d7a97092920e4ead48b521b640b62f9d0592d4e37f5e8c7bd520316d73cf7c
Instruction ID: c771b3876e6c01e56c353654c234e3fc22dc1976ffc449d8a6acba8da7aa9e7b
Opcode Fuzzy Hash: 26d7a97092920e4ead48b521b640b62f9d0592d4e37f5e8c7bd520316d73cf7c
Instruction Fuzzy Hash: AF514AFB24D125BCB252E6817B38EFE6B6FE2D27307318466F887D1502E6944E8E5131

Function 05080913 Relevance: 1.8, APIs: 1, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(00000081), ref: 05080A86

Memory Dump Source

Source File: 0000000A.00000002.4505200126.0000000005080000.00000040.00001000.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5080000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 073ea9dd7e07b54f92e3486144c7f6229c54fe4396603b79495bb2e9a7d80389
Instruction ID: ab768a14b17b85e809cba5b41b638107198b8d38041cfa27bb795dcfd172beea
Opcode Fuzzy Hash: 073ea9dd7e07b54f92e3486144c7f6229c54fe4396603b79495bb2e9a7d80389
Instruction Fuzzy Hash: 145137FB24D125BCB152E6823B38EFF6A6FE2D27307318466F887D1502E6944E8E5131

Function 0508094A Relevance: 1.8, APIs: 1, Instructions: 277
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileW.ADVAPI32(00000081), ref: 05080A86

Memory Dump Source

Source File: 0000000A.00000002.4505200126.0000000005080000.00000040.00001000.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5080000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: f0fa27e08ec0fcf045bc226a56c671cff8975408d6eef026b476c99c8b94c344
Instruction ID: efecdea8840befdad4076bd14abc92a1f336a6428a4ef17ba499e77bbc99a9d2
Opcode Fuzzy Hash: f0fa27e08ec0fcf045bc226a56c671cff8975408d6eef026b476c99c8b94c344
Instruction Fuzzy Hash: 4F5138FB24D125BCB151E6823B38EFF676EE2D2730731846AF887D1502E6944E8E6131

Function 05080961 Relevance: 1.8, APIs: 1, Instructions: 273COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(00000081), ref: 05080A86

Memory Dump Source

Source File: 0000000A.00000002.4505200126.0000000005080000.00000040.00001000.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5080000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 6cc6519f748e8eb366a5a9fbc950bfb99731b294bcfef0fb8c6c91e5099575d4
Instruction ID: 6885365aa0efb641624c54d534dc25943a6bf256a3244300ff7edd619c5006e7
Opcode Fuzzy Hash: 6cc6519f748e8eb366a5a9fbc950bfb99731b294bcfef0fb8c6c91e5099575d4
Instruction Fuzzy Hash: 1F5146FB24D125BCB251E6823B78EFF676FE2D2730731846AF887D1506E6844A8E5031

Function 05080986 Relevance: 1.8, APIs: 1, Instructions: 266COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(00000081), ref: 05080A86

Memory Dump Source

Source File: 0000000A.00000002.4505200126.0000000005080000.00000040.00001000.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5080000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: e73a94005448a8801b5960f62665b5135fb4f0df531ec8301a1858c7b2067007
Instruction ID: 057c29871984c5511314360ea546a93e2c0ffc14e50282ba8be3cf44489a0bed
Opcode Fuzzy Hash: e73a94005448a8801b5960f62665b5135fb4f0df531ec8301a1858c7b2067007
Instruction Fuzzy Hash: 405117FB24D125BCB211E6823F38EFF6A6EE2D2730731846AF887D1506E6844E8D5531

Function 0508098F Relevance: 1.8, APIs: 1, Instructions: 261COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(00000081), ref: 05080A86

Memory Dump Source

Source File: 0000000A.00000002.4505200126.0000000005080000.00000040.00001000.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5080000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: adafcf8e967dbe7f2f60f6785255570cfa558e647f59dc613a1be64a592fef67
Instruction ID: aeaac1d84820bb7495efedbae4b2f405a32ea713996d44d00825fdbb76dda84a
Opcode Fuzzy Hash: adafcf8e967dbe7f2f60f6785255570cfa558e647f59dc613a1be64a592fef67
Instruction Fuzzy Hash: AF5118EB24D125BCB112E6823F38EFF5B6EE2D27307318866F887D1506E6844E8D5131

Function 050809AF Relevance: 1.8, APIs: 1, Instructions: 258COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(00000081), ref: 05080A86

Memory Dump Source

Source File: 0000000A.00000002.4505200126.0000000005080000.00000040.00001000.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5080000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: a90d3c6835e596616e44cda608b90052ba47cbddabcd03a7ef93a3a553639318
Instruction ID: 6317c887222e30e54b1bee1e7eefa93c20d97fac2190d5f76270c9b9da80e03d
Opcode Fuzzy Hash: a90d3c6835e596616e44cda608b90052ba47cbddabcd03a7ef93a3a553639318
Instruction Fuzzy Hash: 24514AFB24D125BCB141E6913F38EFE6B6EE6D67307318866F887D2402E6840E8E5431

Function 050809FB Relevance: 1.7, APIs: 1, Instructions: 238COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(00000081), ref: 05080A86

Memory Dump Source

Source File: 0000000A.00000002.4505200126.0000000005080000.00000040.00001000.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5080000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: db8e075dd730293a61a7e565b108c61bd85deefde8cc29f78f194078aac28784
Instruction ID: 5edb246bf42741aa31212c002981057c0f24fe355a28f2662ef5f12d421d80db
Opcode Fuzzy Hash: db8e075dd730293a61a7e565b108c61bd85deefde8cc29f78f194078aac28784
Instruction Fuzzy Hash: 2A416EFB24D125BCB242E6813F38EFE6B6EE6D273073184A6F887D5502E6854E8D5131

Function 05080A48 Relevance: 1.7, APIs: 1, Instructions: 235COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(00000081), ref: 05080A86

Memory Dump Source

Source File: 0000000A.00000002.4505200126.0000000005080000.00000040.00001000.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5080000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 536baf778ee5b4591884045791fbdb7efc39aff60ee339cec5a5cb4fe7d05223
Instruction ID: fe7f7611ba1f72783765757143c5e55aab77164b9356979909312a6a4024b93a
Opcode Fuzzy Hash: 536baf778ee5b4591884045791fbdb7efc39aff60ee339cec5a5cb4fe7d05223
Instruction Fuzzy Hash: 3F416AFB24D125BCB241E6913B38EFF6B6EE2D27307318466F887D2406E6944E8E5431

Function 0013A210 Relevance: 1.7, APIs: 1, Instructions: 231COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 0013A343

Memory Dump Source

Source File: 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000A.00000002.4496465970.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496595662.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496987481.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498121363.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498469107.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 35d97661874be07c20d17ed04aaf1f5d2a34f1e3c8c6387e9b3f4a54131d9d47
Instruction ID: 885c3cc732375e752f200c1a6cb33d04e96cf05efb6d6a01533a9bcc953a7add
Opcode Fuzzy Hash: 35d97661874be07c20d17ed04aaf1f5d2a34f1e3c8c6387e9b3f4a54131d9d47
Instruction Fuzzy Hash: 55714971900204AFDB14DF68CC49BAFBBE8EF41700F60456DF8499B682D7B5DA81CB92

Function 05080A1E Relevance: 1.7, APIs: 1, Instructions: 213COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(00000081), ref: 05080A86

Memory Dump Source

Source File: 0000000A.00000002.4505200126.0000000005080000.00000040.00001000.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5080000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 4e69df2fefdd20f983021b5455a1b3231776f0f4d732b684aebdc9d3f152cda0
Instruction ID: 3d827e5b4331103d06b9528b92f16f19ca6611134a54cb2699489e104cfa4e4b
Opcode Fuzzy Hash: 4e69df2fefdd20f983021b5455a1b3231776f0f4d732b684aebdc9d3f152cda0
Instruction Fuzzy Hash: B24106FB24D125BCB151E6823B38EFE6A6EE2D27307318866F887D1506E7944E8E5431

Function 05080A2B Relevance: 1.7, APIs: 1, Instructions: 211COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(00000081), ref: 05080A86

Memory Dump Source

Source File: 0000000A.00000002.4505200126.0000000005080000.00000040.00001000.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5080000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 2151f679e29c73bce6ef11b758726f90396e9951bf70ecffc40562272a407a5e
Instruction ID: e3096c79df81266ff4297861fbd5691a2c98f0fd92598cbfe0da7128561f2b31
Opcode Fuzzy Hash: 2151f679e29c73bce6ef11b758726f90396e9951bf70ecffc40562272a407a5e
Instruction Fuzzy Hash: F24118FB24D125BCB151E6823B38EFE6A6EE2D2B30731C466F887D1502E7944E8E5431

Function 0022549C Relevance: 1.7, APIs: 1, Instructions: 198fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000000,00219087,?,00000000,00000000,00000000,?,00000000,?,0013A3EB,00219087,00000000,0013A3EB,?,?), ref: 00225621

Memory Dump Source

Source File: 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000A.00000002.4496465970.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496595662.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496987481.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498121363.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498469107.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 10c26e02cb8c9765ddbd9b1f326dd2b1d0ee5b9f954f0aa7c23b7b1ec966dfb4
Instruction ID: 3a355c0a43ae557ca1b21e5c05b76fb27b4c6347bfaaa7ab22396a029d6a84cd
Opcode Fuzzy Hash: 10c26e02cb8c9765ddbd9b1f326dd2b1d0ee5b9f954f0aa7c23b7b1ec966dfb4
Instruction Fuzzy Hash: C761AE7192053ABFDF119FE8E884AFEBBBAAF09304F548145E804A7205D375D9618BA0

Function 05080A7D Relevance: 1.7, APIs: 1, Instructions: 190COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(00000081), ref: 05080A86

Memory Dump Source

Source File: 0000000A.00000002.4505200126.0000000005080000.00000040.00001000.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5080000_RageMP131.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 3ef8e789e0d5dae6491cdfce8cfb11f3bd678c72b3d9631c0a36804bacb3ea6d
Instruction ID: f67accc7eb6d93ef1d826b4ed3fec5be4bf798f2608b73b338d35207cc76ff1f
Opcode Fuzzy Hash: 3ef8e789e0d5dae6491cdfce8cfb11f3bd678c72b3d9631c0a36804bacb3ea6d
Instruction Fuzzy Hash: 293148FB24D125BCB151E6813B38EFE6B6EE2D2B307318466F887D1502E7844E8E5031

Function 001A06C0 Relevance: 1.7, APIs: 1, Instructions: 156COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 001A0807

Memory Dump Source

Source File: 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000A.00000002.4496465970.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496595662.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496987481.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498121363.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498469107.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 72ae2a14724d4e83691c0531f3cf1eefdbecef984361d26ffcaed67d00a3d962
Instruction ID: c42d24567654f0d1385fe62ccfec02b01bb567509ddebee1d6e552dc58ba92c5
Opcode Fuzzy Hash: 72ae2a14724d4e83691c0531f3cf1eefdbecef984361d26ffcaed67d00a3d962
Instruction Fuzzy Hash: 3741567A9001149BCB16EF68DD815AEBBA5EF4A350F1002A9FC45D7342DB70AE618BE1

Function 001A0560 Relevance: 1.6, APIs: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 001A06AE

Memory Dump Source

Source File: 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000A.00000002.4496465970.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496595662.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496987481.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498121363.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498469107.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction ID: 20c88e65975a37eeb0c4c1df0e4a1fee91b35dcac9ad282aa7b3478fbba802d0
Opcode Fuzzy Hash: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
Instruction Fuzzy Hash: F141D476A001149FCB16EF68DD805AE7BE5AF8A350F150169FC09DB342D730DE618BE1

Function 00224B12 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,002249F9,00000000,CF830579,00261140,0000000C,00224AB5,00218BBD,?), ref: 00224B68

Memory Dump Source

Source File: 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000A.00000002.4496465970.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496595662.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496987481.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498121363.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498469107.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: ca1af8afb9f479e971f3e4c1596a3aaa6035b290c135bbdf7a8ef185abdac113
Instruction ID: 521c9aa1984fc27cb4a8cd1f98c570a9f388312a70d27670815eba211bda2467
Opcode Fuzzy Hash: ca1af8afb9f479e971f3e4c1596a3aaa6035b290c135bbdf7a8ef185abdac113
Instruction Fuzzy Hash: 7B114833E741347BDA247AF5B805B7E678D8B82778F290249F8149B4C2EFA0D8624596

Function 0021E05C Relevance: 1.6, APIs: 1, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00260DF8,0013A3EB,00000002,0013A3EB,00000000,?,?,?,0021E166,00000000,?,0013A3EB,00000002,00260DF8), ref: 0021E098

Memory Dump Source

Source File: 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000A.00000002.4496465970.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496595662.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496987481.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498121363.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498469107.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: be05b63e29a8d01928c54a4e5e42a7ea787db12c96a648dc269af2e4382c2c6a
Instruction ID: 9c1f8a6ae344f23f7dc56b368b2c7eb253505d94e88e0f6a41af6923220ba7fa
Opcode Fuzzy Hash: be05b63e29a8d01928c54a4e5e42a7ea787db12c96a648dc269af2e4382c2c6a
Instruction Fuzzy Hash: A4014932620515AFCF159F59DC05CDE3BA9DB95330F250258FC50AB2D1EAB2EDA18BD0

Function 0020F290 Relevance: 1.6, APIs: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0013220E

Memory Dump Source

Source File: 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000A.00000002.4496465970.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496595662.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496987481.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498121363.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498469107.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 0647994880ecef6210d877e75e65b0a585e2c277952343184b95ebfeb14f2cce
Instruction ID: c6e3883adea6c022a6bf92facde348416d3fdcb6b4dc74f47bc47e5833cc709b
Opcode Fuzzy Hash: 0647994880ecef6210d877e75e65b0a585e2c277952343184b95ebfeb14f2cce
Instruction Fuzzy Hash: FD012B7541430DABCB24AFA8E80299977ECDE00350F444435FE18DB991EB70E9B08B90

Function 002263F3 Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,002191F7,00000000,?,00225D79,00000001,00000364,00000000,00000006,000000FF,?,00000000,0021D244,002189C3,002191F7,00000000), ref: 00226434

Memory Dump Source

Source File: 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000A.00000002.4496465970.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496595662.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496987481.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498121363.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498469107.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8ce0a76dafce71c88eaa9f2b83f9f34fd7c06ce9a47bdaaa168864d6c89e4289
Instruction ID: 3303a7fe81f8e1335776e589ae81169d1bc26a9fcdc5f5e85026cd03071e73cc
Opcode Fuzzy Hash: 8ce0a76dafce71c88eaa9f2b83f9f34fd7c06ce9a47bdaaa168864d6c89e4289
Instruction Fuzzy Hash: FBF05433565135B69B317FE2BC0AB5B7B899B81B64B258061E884A6590CA70EC31C6F1

Function 00226E2D Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0022D635,4D88C033,?,0022D635,00000220,?,002257EF,4D88C033), ref: 00226E60

Memory Dump Source

Source File: 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000A.00000002.4496465970.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496595662.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496987481.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498121363.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498469107.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d29274f376375a2a7be2adaf77ddeb815745d13ee91522c528cea3d02b66fcc5
Instruction ID: 480cdf98c244bf818f7a5cfecc5cce5046569820bae2573d6e5a9c09f8b54486
Opcode Fuzzy Hash: d29274f376375a2a7be2adaf77ddeb815745d13ee91522c528cea3d02b66fcc5
Instruction Fuzzy Hash: 6EE0ED3B130632BADA312AE5FD08FAB76888B927A0F170120FC14924D2CB60C83085A4

Function 050901BA Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4505277155.0000000005090000.00000040.00001000.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5090000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b9afb4d4b39188a0f20031ef0568bfb4920345c24dfc7b384112a4cd0a22b50
Instruction ID: 0a8c38a067547a331136391d4d2a679034acb992293eae15733d6c7dc3cc440c
Opcode Fuzzy Hash: 9b9afb4d4b39188a0f20031ef0568bfb4920345c24dfc7b384112a4cd0a22b50
Instruction Fuzzy Hash: C62162EB24C1507DB546C5867F28EFEAB6EE5D7B30331843BF442C5146E2864A4E6171

Function 0509023E Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4505277155.0000000005090000.00000040.00001000.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5090000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3ea46bc3c618e9fd1d4256371126f4a1b15e3e38b27fc2485b25a2378bad3ce
Instruction ID: 27ec40f9933753843a1586f3dd663b122c3cbe594660ad4996aaf5296b8b9474
Opcode Fuzzy Hash: b3ea46bc3c618e9fd1d4256371126f4a1b15e3e38b27fc2485b25a2378bad3ce
Instruction Fuzzy Hash: 76215EEB2881107E7542C5867F28EFFAB6EE5D7B70331C43BF902C6506E2954A4E6171

Function 05090237 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4505277155.0000000005090000.00000040.00001000.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5090000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d76900492852f16365f70fb44fde9c1efccc13420c8e216dabf9552625e0ef38
Instruction ID: acfe74b925f78f19894e1c8398ff9da54d9b2e078c8b254204e60dd8d96870c9
Opcode Fuzzy Hash: d76900492852f16365f70fb44fde9c1efccc13420c8e216dabf9552625e0ef38
Instruction Fuzzy Hash: 93113AEB288110BE7542C1867F28EFFAB6EE5D6B70331C43BF802C2506E2D54A4E6131

Function 05090291 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4505277155.0000000005090000.00000040.00001000.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5090000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de1b34815465c396f000e70b720b1aa8839f5c1f99d073548b5e4eb059224810
Instruction ID: be98d22b5aa1c2c8a6994d427e04a97678369247d3d4c99a7c174ce1f45a32ef
Opcode Fuzzy Hash: de1b34815465c396f000e70b720b1aa8839f5c1f99d073548b5e4eb059224810
Instruction Fuzzy Hash: 5C015EEF188010BE7542C1867B28AFEAB6FE5C7B30371C427F842C1506E2D54A4D6131

Function 0509029D Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4505277155.0000000005090000.00000040.00001000.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5090000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 942ad7058cc9ffe01416412679ba928cf7d57bcced4f1ebe1c72600bdd5b8ec6
Instruction ID: 4c76524984c0477bbc0344da58aa944543e6ba2c2222ca7cf1def15cc31c39c8
Opcode Fuzzy Hash: 942ad7058cc9ffe01416412679ba928cf7d57bcced4f1ebe1c72600bdd5b8ec6
Instruction Fuzzy Hash: 72015EAF188010BEB956C6867B28AFEA77EE5D7B30371C437F842C1416E3954A4DA231

Function 05090332 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4505277155.0000000005090000.00000040.00001000.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5090000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b08476470e74e9441c49cf9cb8ea9421768f6d6ea3eb7fc28b7aec00e234c2a6
Instruction ID: c8c02cf94d8c58471321d245b36245b83688055627a499ff1579800efd3129af
Opcode Fuzzy Hash: b08476470e74e9441c49cf9cb8ea9421768f6d6ea3eb7fc28b7aec00e234c2a6
Instruction Fuzzy Hash: 5801D8BB148114BE6652D1853B29BFEBB6FEAC6B30371C42BF802C5415D2954A49A131

Function 050902CF Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4505277155.0000000005090000.00000040.00001000.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5090000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fba4a2f424770dea158e84b9ab80bd643f33423e42adf61849450744da981de
Instruction ID: f1409bb23e14e2800e6e2fc2ea808c700c6c47f627e45ff2a3e7591e9cd82275
Opcode Fuzzy Hash: 1fba4a2f424770dea158e84b9ab80bd643f33423e42adf61849450744da981de
Instruction Fuzzy Hash: 7F01A2FB148114BF6652D1957B29AFEBB6FE6C6B30331C42BF842C6016D2964A49A131

Non-executed Functions

Function 002184A0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000A.00000002.4496465970.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496595662.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496987481.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498121363.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498469107.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction ID: bde0113280cfbda9c95275b2583dce71ed5cd7b5b2f1ff4133e380229173fa05
Opcode Fuzzy Hash: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
Instruction Fuzzy Hash: 4D025B71E1121A9BDF14CFA8C8C06EEFBF5FF58314F258269D919A7380DB31A9518B90

Function 0019F810 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0019F833
std::_Lockit::_Lockit.LIBCPMT ref: 0019F855
std::_Lockit::~_Lockit.LIBCPMT ref: 0019F875
std::_Lockit::~_Lockit.LIBCPMT ref: 0019F89F
std::_Lockit::_Lockit.LIBCPMT ref: 0019F90D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0019F959
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0019F973
std::_Lockit::~_Lockit.LIBCPMT ref: 0019FA08
std::_Facet_Register.LIBCPMT ref: 0019FA15

Strings

bad locale name, xrefs: 0019FA2F
"%, xrefs: 0019F96B, 0019F972

Memory Dump Source

Source File: 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000A.00000002.4496465970.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496595662.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496987481.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498121363.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498469107.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$"%
API String ID: 3375549084-2785405677
Opcode ID: 4a54bf5f6e3152a018bb00732e1ad6b7508442f0a4e6be0fa36ab11bad9f5f2d
Instruction ID: ee9b7f4059d942a84a4923003dc0c330985f7655f3f5f0108cb6b216cd744a21
Opcode Fuzzy Hash: 4a54bf5f6e3152a018bb00732e1ad6b7508442f0a4e6be0fa36ab11bad9f5f2d
Instruction Fuzzy Hash: 0F617CB1D10208EBEF10DFA4D849B9EBBF4AF14714F184468E805E7381E775AD56CB91

Function 00212E10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00212E47
___except_validate_context_record.LIBVCRUNTIME ref: 00212E4F
_ValidateLocalCookies.LIBCMT ref: 00212ED8
__IsNonwritableInCurrentImage.LIBCMT ref: 00212F03
_ValidateLocalCookies.LIBCMT ref: 00212F58

Strings

csm, xrefs: 00212EED
i&, xrefs: 00212F78

Memory Dump Source

Source File: 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000A.00000002.4496465970.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496595662.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496987481.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498121363.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498469107.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: i&$csm
API String ID: 1170836740-3583052009
Opcode ID: 502c7fd2cc1b6305c62e736f76ed96174aa6e38b662974a43a9185f2d4dd9457
Instruction ID: 7f0d160eddc657807d555fb2c4130da08c0cff65e6a9c9554e2eb7bae3c02c9b
Opcode Fuzzy Hash: 502c7fd2cc1b6305c62e736f76ed96174aa6e38b662974a43a9185f2d4dd9457
Instruction Fuzzy Hash: B3419230A20209DBCF10DF68D885ADEBBF5EF55324F148055F9149B292D732EAB9CB91

Function 001339F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00133A58
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00133AA4
__Getctype.LIBCPMT ref: 00133ABA
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00133AE6
std::_Lockit::~_Lockit.LIBCPMT ref: 00133B7B

Strings

bad locale name, xrefs: 00133B96

Memory Dump Source

Source File: 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000A.00000002.4496465970.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496595662.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496987481.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498121363.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498469107.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: 39bd3b24db54c8945a5bd8bbaffa1dc1c88ce69294c0efdb10762d82777e3811
Instruction ID: 60b0b95d657660890123011f12d31e36870daadeb48752eb23c3c8ce6cd24115
Opcode Fuzzy Hash: 39bd3b24db54c8945a5bd8bbaffa1dc1c88ce69294c0efdb10762d82777e3811
Instruction Fuzzy Hash: F3513CB1D00348DBEF10DFA4D845B9EFBB8AF14310F144069E809AB382E775DA58CBA5

Function 0019DE70 Relevance: 9.1, APIs: 6, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0019DE93
std::_Lockit::_Lockit.LIBCPMT ref: 0019DEB6
std::_Lockit::~_Lockit.LIBCPMT ref: 0019DED6
std::_Facet_Register.LIBCPMT ref: 0019DF4B
std::_Lockit::~_Lockit.LIBCPMT ref: 0019DF63
Concurrency::cancel_current_task.LIBCPMT ref: 0019DF7B

Memory Dump Source

Source File: 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000A.00000002.4496465970.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496595662.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496987481.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498121363.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498469107.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: db6ba1707d3abd9644993d4242b9ed1c54b2dd77ded878fd3753c344aa5ea57b
Instruction ID: 5bbc7e19c18dc5cbb7f804ee8bc3cc3c85cc3a2ec7f3de1f221a2ef33f8ba2f8
Opcode Fuzzy Hash: db6ba1707d3abd9644993d4242b9ed1c54b2dd77ded878fd3753c344aa5ea57b
Instruction Fuzzy Hash: C4412672910219DFCF14DF94E986A6EBBB4FB10720F148268E8156B392D770AD11CBD1

Function 00134C50 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 442COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00134F72
___std_exception_destroy.LIBVCRUNTIME ref: 00134FFF
___std_exception_copy.LIBVCRUNTIME ref: 001350C8

Strings

recursive_directory_iterator::operator++, xrefs: 0013504C

Memory Dump Source

Source File: 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000A.00000002.4496465970.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496595662.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496987481.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498121363.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498469107.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$___std_exception_copy
String ID: recursive_directory_iterator::operator++
API String ID: 1206660477-953255998
Opcode ID: 0a0d4c7e6a91c7fd64ca2dbfd56b5b28e2ee5424e2a6f1f2aa536e4814f4f92b
Instruction ID: 253f524e4b1548819be38e26e859700b79edce99598856a978eeba78fb40dec4
Opcode Fuzzy Hash: 0a0d4c7e6a91c7fd64ca2dbfd56b5b28e2ee5424e2a6f1f2aa536e4814f4f92b
Instruction Fuzzy Hash: 4AE1E2B19106049FCB28DF68D845BAEBBF9FF44300F148A2DE45693B81E774B954CBA1

Function 00137820 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0013799A
___std_exception_copy.LIBVCRUNTIME ref: 00137B75

Strings

out_of_range, xrefs: 00137A27
type_error, xrefs: 0013784A

Memory Dump Source

Source File: 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000A.00000002.4496465970.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496595662.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496987481.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498121363.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498469107.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: out_of_range$type_error
API String ID: 2659868963-3702451861
Opcode ID: 540c24e0f071101a32b1eca3f3cc57115b9605288b9a43b435352324834673d2
Instruction ID: 0873fba22ab0ce2be53dfb639add407632513e482b25baa43b04831e90967bc9
Opcode Fuzzy Hash: 540c24e0f071101a32b1eca3f3cc57115b9605288b9a43b435352324834673d2
Instruction Fuzzy Hash: C7C157B19002089FDB18CFA8D984B9DFBF5FF49310F14866AE419EB781E774A984CB54

Function 00132270 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 218COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00132275

Part of subcall function 0020D6E9: std::invalid_argument::invalid_argument.LIBCONCRT ref: 0020D6F5

Strings

L&, xrefs: 00132347
string too long, xrefs: 00132270
L&, xrefs: 00132427

Memory Dump Source

Source File: 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000A.00000002.4496465970.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496595662.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496987481.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498121363.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498469107.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: string too long$L&$L&
API String ID: 1997705970-2440114816
Opcode ID: caede21bbe6da2d8325baf246a4404f57dd146b58e2bb040046a6ae201ebde9e
Instruction ID: 5b3de2f90b9657f3117d96fcc1dd6357183e1885e244b762af2c0565347044f0
Opcode Fuzzy Hash: caede21bbe6da2d8325baf246a4404f57dd146b58e2bb040046a6ae201ebde9e
Instruction Fuzzy Hash: 9A811275A042899FDB06DF68C460BEEBFF1FF6A300F18416AC894A7782C3758545CBA1

Function 001373B0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 001375BE
___std_exception_destroy.LIBVCRUNTIME ref: 001375CD

Strings

at line , xrefs: 001373F7
, column , xrefs: 00137434, 0013744A

Memory Dump Source

Source File: 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000A.00000002.4496465970.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496595662.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496987481.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498121363.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498469107.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column
API String ID: 4194217158-191570568
Opcode ID: 4180e295cf1a2fe8dd93279fc840884f7f2da454b04d9ef6da9f47839da57658
Instruction ID: e713cffd93a8342dc265857860f14b9b779d03d1872c0bdf27575f4e9eea48ee
Opcode Fuzzy Hash: 4180e295cf1a2fe8dd93279fc840884f7f2da454b04d9ef6da9f47839da57658
Instruction Fuzzy Hash: 2061E1B0A002049FDB1CDF68DC94BADBBB6FF45300F244628E415A7BC2D774AA948B91

Function 00133D10 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00133E7F

Strings

ios_base::badbit set, xrefs: 00133E17
ios_base::eofbit set, xrefs: 00133E41, 00133E63
ios_base::failbit set, xrefs: 00133D32

Memory Dump Source

Source File: 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000A.00000002.4496465970.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496595662.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496987481.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498121363.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498469107.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: 64febd75ea1defa470ad7b3011e45b44c48d1f549c5fe142f83530c4ebef8e78
Instruction ID: 2d5e31264e3a3d13f64ec59032cca74881ff3375f8c859c39f11909fe2193e10
Opcode Fuzzy Hash: 64febd75ea1defa470ad7b3011e45b44c48d1f549c5fe142f83530c4ebef8e78
Instruction Fuzzy Hash: 4841E5B2900208AFCB04DF58D845BEEB7F8EF49310F14852AF929D7741E770AA518BA4

Function 00133DE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00133E7F

Strings

ios_base::badbit set, xrefs: 00133E17
ios_base::eofbit set, xrefs: 00133E28, 00133E41, 00133E63
ios_base::failbit set, xrefs: 00133D32, 00133E1E

Memory Dump Source

Source File: 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000A.00000002.4496465970.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496595662.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496987481.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498121363.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498469107.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: 2a08587c746d88124f316b24918324e75a92d8b8ac6f7c870d5a50c47ae9d4a3
Instruction ID: cc3c1446fa671a292058142bfe81be661c9c41c6035c3aacaf34c4e00ddd5208
Opcode Fuzzy Hash: 2a08587c746d88124f316b24918324e75a92d8b8ac6f7c870d5a50c47ae9d4a3
Instruction Fuzzy Hash: 0B212BB2910304AFC714DF58D805B96B7DCAB15310F08883AFE78C7641E770EA64CB94

Function 00136F40 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 349COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00137340

Strings

parse_error, xrefs: 00136F8B
parse error, xrefs: 00136FFF, 00137018

Memory Dump Source

Source File: 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000A.00000002.4496465970.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496595662.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496987481.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498121363.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498469107.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: parse error$parse_error
API String ID: 2659868963-1820534363
Opcode ID: 4783d47757e759f9e3b0418e43315489b6121af0f7b18089215b1e1010609783
Instruction ID: ef308799dead33717b3887087c51cdcc24be091f2186bd8655a685de9c041b42
Opcode Fuzzy Hash: 4783d47757e759f9e3b0418e43315489b6121af0f7b18089215b1e1010609783
Instruction Fuzzy Hash: 2CE16EB19042488FDB18CF68C994BADBBF1FF49300F248269E418EB792D7749A85CF51

Function 00136C60 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00136F11
___std_exception_destroy.LIBVCRUNTIME ref: 00136F20

Strings

[json.exception., xrefs: 00136CB8

Memory Dump Source

Source File: 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000A.00000002.4496465970.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496595662.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496987481.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498121363.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498469107.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.
API String ID: 4194217158-791563284
Opcode ID: 04a5be585f3883f481887d485d151d6fb3d9bc38d423d5a7fe33530e531bd164
Instruction ID: 39e1b33da134756bc4e5c3fb801c1326f2bee5662c519cc35e6b94a182fde5f8
Opcode Fuzzy Hash: 04a5be585f3883f481887d485d151d6fb3d9bc38d423d5a7fe33530e531bd164
Instruction Fuzzy Hash: 4391D470A002049FDB18CF68D994BAEBBF6FF45300F20866CE459AB792D775A985CB50

Function 001AE440 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 001AE491

Strings

type must be boolean, but is , xrefs: 001AE582
type must be string, but is , xrefs: 001AE4F8

Memory Dump Source

Source File: 0000000A.00000002.4496595662.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000A.00000002.4496465970.0000000000130000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496595662.0000000000263000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4496987481.0000000000268000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000026C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000003FC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.00000000004DF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000518000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.0000000000521000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4497054948.000000000052F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498121363.0000000000530000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.4498469107.00000000006D9000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_130000_RageMP131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: type must be boolean, but is $type must be string, but is
API String ID: 118556049-436076039
Opcode ID: ada7ecae50ea3af7e7b299258ca7013531d35b153ffce0ec69130373915f08c8
Instruction ID: 50c3bfae8fa7e8564c86067a1522744ef176f232a6406315d3c94f091652707f
Opcode Fuzzy Hash: ada7ecae50ea3af7e7b299258ca7013531d35b153ffce0ec69130373915f08c8
Instruction Fuzzy Hash: 5F419CB9904248AFDB14EBA4D802BAEB7ECDB15300F144574F805D7682EB35EA54C791

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LisectAVT_2403002A_163.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\MPGPH131\MPGPH131.exe

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
LisectAVT_2403002A_163.exe

Function 0003E0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Function 00083A40 Relevance: 2.7, APIs: 2, Instructions: 157
sleepCOMMON

Function 04C506E0 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 334
COMMON

Function 04C506C8 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 329
COMMON

Function 04C506D5 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 328
COMMON

Function 04C506F8 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 320
COMMON

Function 04C50745 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 302
COMMON

Function 04C50729 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 299
COMMON

Function 04C50760 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 285
COMMON

Function 04C50769 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 281
COMMON

Function 04C507A5 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 268
COMMON

Function 04C507C3 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 247
COMMON

Function 04C507B1 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 246
COMMON

Function 00114623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE