Edit tour

Windows Analysis Report
LisectAVT_2403002A_151.exe

Overview

General Information

Sample name:	LisectAVT_2403002A_151.exe
Analysis ID:	1482488
MD5:	a528d71182717541346487642bb54dd2
SHA1:	7c9b47714dfce098237d5df9381fcbe1d856f41d
SHA256:	f4880369ec64ebb35bbf6231f9275d82a878e6c3cdfb75468ea1d529b895892d
Tags:	exeRiseProStealer
Infos:

Detection

RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Yara detected RisePro Stealer

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Uses schtasks.exe or at.exe to add and modify task schedules

Abnormal high CPU Usage

Contains capabilities to detect virtual machines

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Classification

Process Tree

System is w10x64

LisectAVT_2403002A_151.exe (PID: 6456 cmdline: "C:\Users\user\Desktop\LisectAVT_2403002A_151.exe" MD5: A528D71182717541346487642BB54DD2)

schtasks.exe (PID: 6952 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7052 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MPGPH131.exe (PID: 5804 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: A528D71182717541346487642BB54DD2)

MPGPH131.exe (PID: 2932 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: A528D71182717541346487642BB54DD2)

RageMP131.exe (PID: 7196 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: A528D71182717541346487642BB54DD2)

RageMP131.exe (PID: 7456 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: A528D71182717541346487642BB54DD2)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000003.1655205420.0000000004DC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000009.00000003.1894436988.00000000049C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000005.00000003.1713791639.0000000004B60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000006.00000003.1715659153.0000000004320000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000009.00000002.2908237269.0000000000E91000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000007.00000003.1808878932.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: LisectAVT_2403002A_151.exe PID: 6456	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 5804	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 2932	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 7196	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 7456	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe, ProcessId: 6456, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET MALWARE RisePro TCP Heartbeat Packet - Source IP: 192.168.2.4 - Destination IP: 193.233.132.62

Timestamp:	2024-07-25T23:42:32.818118+0200
SID:	2049060
Source Port:	49731
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.68.123.157 - Destination IP: 192.168.2.4

Timestamp:	2024-07-25T23:42:46.250615+0200
SID:	2022930
Source Port:	443
Destination Port:	49734
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE RisePro TCP Heartbeat Packet - Source IP: 192.168.2.4 - Destination IP: 193.233.132.62

Timestamp:	2024-07-25T23:42:27.536551+0200
SID:	2049060
Source Port:	49730
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 193.233.132.62

Timestamp:	2024-07-25T23:42:35.811823+0200
SID:	2046269
Source Port:	49731
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 193.233.132.62

Timestamp:	2024-07-25T23:42:35.811723+0200
SID:	2046269
Source Port:	49732
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 193.233.132.62

Timestamp:	2024-07-25T23:42:30.525266+0200
SID:	2046269
Source Port:	49730
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 193.233.132.62

Timestamp:	2024-07-25T23:42:53.202466+0200
SID:	2046269
Source Port:	49740
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 193.233.132.62

Timestamp:	2024-07-25T23:42:45.437263+0200
SID:	2046269
Source Port:	49733
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.68.123.157 - Destination IP: 192.168.2.4

Timestamp:	2024-07-25T23:43:26.815937+0200
SID:	2022930
Source Port:	443
Destination Port:	49741
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: LisectAVT_2403002A_151.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: LisectAVT_2403002A_151.exe

Joe Sandbox ML: detected

Source: LisectAVT_2403002A_151.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 193.233.132.62 ports 0,5,7,8,58709,9

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 193.233.132.62:58709

Source: Joe Sandbox View	IP Address: 193.233.132.62 193.233.132.62
Source: Joe Sandbox View	IP Address: 193.233.132.62 193.233.132.62

Source: Joe Sandbox View

ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU

Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.62

Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe

Code function: 0_2_009DE0A0 recv,setsockopt,WSAStartup,closesocket,socket,connect,closesocket,

0_2_009DE0A0

Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000003.1715659153.0000000004320000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000003.1808878932.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000003.1894436988.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000002.2908237269.0000000000E91000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: MPGPH131.exe, RageMP131.exe	String found in binary or memory: https://ipinfo.io/
Source: LisectAVT_2403002A_151.exe, 00000000.00000003.1655205420.0000000004DC0000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002A_151.exe, 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000005.00000003.1713791639.0000000004B60000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1715659153.0000000004320000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000003.1808878932.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000003.1894436988.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000002.2908237269.0000000000E91000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: RageMP131.exe, 00000009.00000002.2907853014.0000000000D98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: MPGPH131.exe, 00000006.00000002.2909798840.0000000000B18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT2
Source: MPGPH131.exe, RageMP131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

System Summary

PE file contains section with special chars

Source: LisectAVT_2403002A_151.exe	Static PE information: section name:
Source: LisectAVT_2403002A_151.exe	Static PE information: section name: .idata
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name: .idata
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_009CB6A0	0_2_009CB6A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_009D5B90	0_2_009D5B90
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_009D7DC0	0_2_009D7DC0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_009C91A0	0_2_009C91A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_00A4E140	0_2_00A4E140
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_009D9259	0_2_009D9259
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_00A563D0	0_2_00A563D0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_00A4F360	0_2_00A4F360
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_00AA84A0	0_2_00AA84A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_00A4E490	0_2_00A4E490
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_009C24F0	0_2_009C24F0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_00AA646A	0_2_00AA646A
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_00A46550	0_2_00A46550
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_009D6689	0_2_009D6689
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_00A4F600	0_2_00A4F600
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_00A49880	0_2_00A49880
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_00A568C0	0_2_00A568C0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_009D48E0	0_2_009D48E0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_00AB9824	0_2_00AB9824
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_00A4F810	0_2_00A4F810
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_00A4E910	0_2_00A4E910
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_00A45B20	0_2_00A45B20
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_00AABB6D	0_2_00AABB6D
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_00AA2CE0	0_2_00AA2CE0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_00A46C00	0_2_00A46C00
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_009D8C58	0_2_009D8C58
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_00A4BD50	0_2_00A4BD50
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_00AABEAF	0_2_00AABEAF
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_00A43F80	0_2_00A43F80
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_009D9F50	0_2_009D9F50
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005F7E3E	5_2_005F7E3E
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005EB6A0	5_2_005EB6A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_006D9824	5_2_006D9824
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0066F810	5_2_0066F810
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005F48E0	5_2_005F48E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00669880	5_2_00669880
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0066E140	5_2_0066E140
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0066E910	5_2_0066E910
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005E91A0	5_2_005E91A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005F9259	5_2_005F9259
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_006CBB6D	5_2_006CBB6D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0066F360	5_2_0066F360
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00665B20	5_2_00665B20
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005F5B90	5_2_005F5B90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_006C646A	5_2_006C646A
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005F8C58	5_2_005F8C58
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00666C00	5_2_00666C00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_006C2CE0	5_2_006C2CE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005E24F0	5_2_005E24F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_006C84A0	5_2_006C84A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0066E490	5_2_0066E490
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00666550	5_2_00666550
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0066BD50	5_2_0066BD50
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0066F600	5_2_0066F600
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_006CBEAF	5_2_006CBEAF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005F9F50	5_2_005F9F50
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00663F80	5_2_00663F80
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005EB6A0	6_2_005EB6A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005F5B90	6_2_005F5B90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005F7DC0	6_2_005F7DC0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0066E140	6_2_0066E140
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005E91A0	6_2_005E91A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005F9259	6_2_005F9259
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0066F360	6_2_0066F360
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_006763D0	6_2_006763D0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_006C646A	6_2_006C646A
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005E24F0	6_2_005E24F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_006C84A0	6_2_006C84A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0066E490	6_2_0066E490
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00666550	6_2_00666550
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0066F600	6_2_0066F600
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005F6689	6_2_005F6689
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_006D9824	6_2_006D9824
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0066F810	6_2_0066F810
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_006768C0	6_2_006768C0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005F48E0	6_2_005F48E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00669880	6_2_00669880
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0066E910	6_2_0066E910
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_006CBB6D	6_2_006CBB6D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00665B20	6_2_00665B20
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005F8C58	6_2_005F8C58
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00666C00	6_2_00666C00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_006C2CE0	6_2_006C2CE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0066BD50	6_2_0066BD50
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_006CBEAF	6_2_006CBEAF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005F9F50	6_2_005F9F50
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00663F80	6_2_00663F80
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00E9B6A0	7_2_00E9B6A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00EA7E3E	7_2_00EA7E3E
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00EA48E0	7_2_00EA48E0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00F19880	7_2_00F19880
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00F89824	7_2_00F89824
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00F1F810	7_2_00F1F810
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00E991A0	7_2_00E991A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00F1E140	7_2_00F1E140
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00F1E910	7_2_00F1E910
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00EA9259	7_2_00EA9259
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00EA5B90	7_2_00EA5B90
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00F1F360	7_2_00F1F360
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00F7BB6D	7_2_00F7BB6D
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00F15B20	7_2_00F15B20
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00F72CE0	7_2_00F72CE0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00E924F0	7_2_00E924F0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00F784A0	7_2_00F784A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00F1E490	7_2_00F1E490
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00F7646A	7_2_00F7646A
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00EA8C58	7_2_00EA8C58
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00F16C00	7_2_00F16C00
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00F16550	7_2_00F16550
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00F1BD50	7_2_00F1BD50
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00F7BEAF	7_2_00F7BEAF
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00F1F600	7_2_00F1F600
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00F13F80	7_2_00F13F80
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00EA9F50	7_2_00EA9F50

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: String function: 00F6FED0 appears 31 times
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: String function: 00A9FED0 appears 31 times
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 006BFED0 appears 62 times
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 006BF4FC appears 46 times
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 006CFD51 appears 34 times

Source: LisectAVT_2403002A_151.exe, 00000000.00000002.2913002181.0000000004DCF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefilezilla.exe4 vs LisectAVT_2403002A_151.exe
Source: LisectAVT_2403002A_151.exe, 00000000.00000000.1649743770.0000000000AF8000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamefilezilla.exe4 vs LisectAVT_2403002A_151.exe
Source: LisectAVT_2403002A_151.exe, 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamefilezilla.exe4 vs LisectAVT_2403002A_151.exe
Source: LisectAVT_2403002A_151.exe	Binary or memory string: OriginalFilenamefilezilla.exe4 vs LisectAVT_2403002A_151.exe

Source: LisectAVT_2403002A_151.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: LisectAVT_2403002A_151.exe	Static PE information: Section: ZLIB complexity 0.9991561823593074
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9991561823593074
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9991561823593074

Source: classification engine

Classification label: mal100.troj.evad.winEXE@11/5@0/1

Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe

File created: C:\Users\user\AppData\Local\RageMP131

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6964:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7064:120:WilError_03

Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe

File created: C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Jump to behavior

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Command line argument: nIn		5_2_006E48C0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Command line argument: nIn		6_2_006E48C0

Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000003.1715659153.0000000004320000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000003.1808878932.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000003.1894436988.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000002.2908237269.0000000000E91000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: LisectAVT_2403002A_151.exe, 00000000.00000003.1655205420.0000000004DC0000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002A_151.exe, 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000005.00000003.1713791639.0000000004B60000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1715659153.0000000004320000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000003.1808878932.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000003.1894436988.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000002.2908237269.0000000000E91000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

Source: LisectAVT_2403002A_151.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: LisectAVT_2403002A_151.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: MPGPH131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: MPGPH131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: RageMP131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: RageMP131.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe

File read: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe "C:\Users\user\Desktop\LisectAVT_2403002A_151.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll	Jump to behavior

Source: LisectAVT_2403002A_151.exe

Static file information: File size 3193864 > 1048576

Source: LisectAVT_2403002A_151.exe

Static PE information: Raw size of qzmhftlj is bigger than: 0x100000 < 0x275400

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Unpacked PE file: 0.2.LisectAVT_2403002A_151.exe.9c0000.0.unpack :EW;.rsrc:W;.idata :W;qzmhftlj:EW;bkynihaq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;qzmhftlj:EW;bkynihaq:EW;.taggant:EW;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 5.2.MPGPH131.exe.5e0000.0.unpack :EW;.rsrc:W;.idata :W;qzmhftlj:EW;bkynihaq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;qzmhftlj:EW;bkynihaq:EW;.taggant:EW;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 6.2.MPGPH131.exe.5e0000.0.unpack :EW;.rsrc:W;.idata :W;qzmhftlj:EW;bkynihaq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;qzmhftlj:EW;bkynihaq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 7.2.RageMP131.exe.e90000.0.unpack :EW;.rsrc:W;.idata :W;qzmhftlj:EW;bkynihaq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;qzmhftlj:EW;bkynihaq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 9.2.RageMP131.exe.e90000.0.unpack :EW;.rsrc:W;.idata :W;qzmhftlj:EW;bkynihaq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;qzmhftlj:EW;bkynihaq:EW;.taggant:EW;

Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe

Code function: 0_2_009D9F50 LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,

0_2_009D9F50

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: RageMP131.exe.0.dr	Static PE information: real checksum: 0x315411 should be: 0x30f84d
Source: MPGPH131.exe.0.dr	Static PE information: real checksum: 0x315411 should be: 0x30f84d
Source: LisectAVT_2403002A_151.exe	Static PE information: real checksum: 0x315411 should be: 0x30f84d

Source: LisectAVT_2403002A_151.exe	Static PE information: section name:
Source: LisectAVT_2403002A_151.exe	Static PE information: section name: .idata
Source: LisectAVT_2403002A_151.exe	Static PE information: section name: qzmhftlj
Source: LisectAVT_2403002A_151.exe	Static PE information: section name: bkynihaq
Source: LisectAVT_2403002A_151.exe	Static PE information: section name: .taggant
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name: .idata
Source: RageMP131.exe.0.dr	Static PE information: section name: qzmhftlj
Source: RageMP131.exe.0.dr	Static PE information: section name: bkynihaq
Source: RageMP131.exe.0.dr	Static PE information: section name: .taggant
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name: .idata
Source: MPGPH131.exe.0.dr	Static PE information: section name: qzmhftlj
Source: MPGPH131.exe.0.dr	Static PE information: section name: bkynihaq
Source: MPGPH131.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_00A9FA97 push ecx; ret	0_2_00A9FAAA
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_009E1B20 push esi; ret	0_2_009E1B22
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_006BFA97 push ecx; ret	5_2_006BFAAA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005F7D53 push edi; retf 000Ch	5_2_005F7D56
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_006BFA97 push ecx; ret	6_2_006BFAAA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00601B20 push esi; ret	6_2_00601B22
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00F6FA97 push ecx; ret	7_2_00F6FAAA
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00EA7D53 push edi; retf 000Ch	7_2_00EA7D56

Source: LisectAVT_2403002A_151.exe	Static PE information: section name: entropy: 7.983746449936841
Source: RageMP131.exe.0.dr	Static PE information: section name: entropy: 7.983746449936841
Source: MPGPH131.exe.0.dr	Static PE information: section name: entropy: 7.983746449936841

Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe			Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe			Jump to dropped file

Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe

File created: C:\ProgramData\MPGPH131\MPGPH131.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe

Code function: 0_2_00A43F80 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00A43F80

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: B00270 second address: AFFBA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DEC96Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c jmp 00007F4860DEC972h 0x00000011 push dword ptr [ebp+122D0F11h] 0x00000017 cld 0x00000018 call dword ptr [ebp+122D1CB6h] 0x0000001e pushad 0x0000001f xor dword ptr [ebp+122D2535h], ebx 0x00000025 xor eax, eax 0x00000027 xor dword ptr [ebp+122D2535h], edx 0x0000002d mov edx, dword ptr [esp+28h] 0x00000031 jmp 00007F4860DEC96Ah 0x00000036 mov dword ptr [ebp+122D38ACh], eax 0x0000003c cmc 0x0000003d mov esi, 0000003Ch 0x00000042 pushad 0x00000043 mov ebx, dword ptr [ebp+122D37ECh] 0x00000049 mov ch, dh 0x0000004b popad 0x0000004c add esi, dword ptr [esp+24h] 0x00000050 sub dword ptr [ebp+122D2535h], edi 0x00000056 lodsw 0x00000058 jmp 00007F4860DEC977h 0x0000005d add eax, dword ptr [esp+24h] 0x00000061 jmp 00007F4860DEC974h 0x00000066 mov ebx, dword ptr [esp+24h] 0x0000006a mov dword ptr [ebp+122D299Dh], ecx 0x00000070 push eax 0x00000071 push edx 0x00000072 pushad 0x00000073 jmp 00007F4860DEC96Dh 0x00000078 push eax 0x00000079 push edx 0x0000007a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: C85142 second address: C85151 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F4860DF3FC6h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: C85151 second address: C85157 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: C85157 second address: C85175 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4860DF3FD2h 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007F4860DF3FC6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: C85175 second address: C85179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: C85179 second address: C8517D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: C7809D second address: C780BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F4860DEC978h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: C780BF second address: C780DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4860DF3FD7h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: C780DB second address: C780EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DEC96Bh 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: C84737 second address: C8476D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnc 00007F4860DF3FC6h 0x0000000d ja 00007F4860DF3FC6h 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F4860DF3FD7h 0x0000001c ja 00007F4860DF3FCCh 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: C8476D second address: C84771 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: C84771 second address: C84785 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4860DF3FCEh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: C84785 second address: C84789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: C84A07 second address: C84A0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: C84A0B second address: C84A1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jbe 00007F4860DEC966h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: C84A1C second address: C84A24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: C84A24 second address: C84A46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c jmp 00007F4860DEC976h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: C84A46 second address: C84A4E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: C84A4E second address: C84A54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: C84A54 second address: C84A58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CA763B second address: CA7661 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F4860DEC972h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b ja 00007F4860DEC96Eh 0x00000011 js 00007F4860DEC966h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CA7661 second address: CA767E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4860DF3FD9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CA7838 second address: CA783E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CA783E second address: CA7863 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DF3FD0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F4860DF3FD1h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CA7863 second address: CA7869 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CA7869 second address: CA7873 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F4860DF3FC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CA7873 second address: CA7877 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CA7877 second address: CA788F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F4860DF3FCEh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CA7CD8 second address: CA7CF4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F4860DEC966h 0x00000009 jne 00007F4860DEC966h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jnc 00007F4860DEC966h 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CA8162 second address: CA8166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CA82DB second address: CA82FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pushad 0x00000007 push edx 0x00000008 jmp 00007F4860DEC96Dh 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jno 00007F4860DEC966h 0x00000016 push esi 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CA82FB second address: CA8301 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CA846E second address: CA8473 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CA8EE1 second address: CA8EEB instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4860DF3FC6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CAE767 second address: CAE774 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F4860DEC966h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CB0BF2 second address: CB0BF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CB0BF6 second address: CB0BFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CB0BFC second address: CB0C25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F4860DF3FCCh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F4860DF3FCEh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CB4D25 second address: CB4D2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CB4D2B second address: CB4D37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F4860DF3FD2h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CB4D37 second address: CB4D3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CB4D3D second address: CB4D45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CB4D45 second address: CB4D5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4860DEC971h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CB4D5A second address: CB4D7B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DF3FD4h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CB4D7B second address: CB4DB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edx 0x00000008 jp 00007F4860DEC966h 0x0000000e jmp 00007F4860DEC96Bh 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F4860DEC979h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: C7B670 second address: C7B676 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: C7B676 second address: C7B6BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DEC971h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007F4860DEC96Eh 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007F4860DEC977h 0x0000001b push edx 0x0000001c pop edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: C7B6BB second address: C7B6C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CB7167 second address: CB7171 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F4860DEC966h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CB7171 second address: CB7183 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F4860DF3FC6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CB7183 second address: CB71A1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4860DEC976h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CB73CE second address: CB73D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CB73D5 second address: CB73E3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CB73E3 second address: CB73E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CB73E8 second address: CB73F2 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4860DEC96Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CB78B9 second address: CB78C3 instructions: 0x00000000 rdtsc 0x00000002 je 00007F4860DF3FC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CB7947 second address: CB7958 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CB7958 second address: CB795C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CB7E1A second address: CB7E29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F4860DEC966h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CB8383 second address: CB8389 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CB8BE8 second address: CB8BF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CB8A6D second address: CB8A78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CB951E second address: CB9532 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DEC970h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CB8A78 second address: CB8A7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CB976A second address: CB976F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CB9532 second address: CB9538 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CBADA7 second address: CBADC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DEC96Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push ecx 0x0000000c jnc 00007F4860DEC966h 0x00000012 pop ecx 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CBDA86 second address: CBDA8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CC0A9B second address: CC0B32 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DEC970h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov edi, 325ACBEAh 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F4860DEC968h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 0000001Ah 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d call 00007F4860DEC975h 0x00000032 push eax 0x00000033 mov dword ptr [ebp+122D2A49h], eax 0x00000039 pop edi 0x0000003a pop edi 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push ecx 0x00000040 call 00007F4860DEC968h 0x00000045 pop ecx 0x00000046 mov dword ptr [esp+04h], ecx 0x0000004a add dword ptr [esp+04h], 0000001Ch 0x00000052 inc ecx 0x00000053 push ecx 0x00000054 ret 0x00000055 pop ecx 0x00000056 ret 0x00000057 jnl 00007F4860DEC96Ch 0x0000005d push eax 0x0000005e push eax 0x0000005f push edx 0x00000060 push eax 0x00000061 push edx 0x00000062 pushad 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CC0B32 second address: CC0B38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CC1AE1 second address: CC1AE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CC1AE7 second address: CC1B6F instructions: 0x00000000 rdtsc 0x00000002 je 00007F4860DF3FC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F4860DF3FD7h 0x00000012 nop 0x00000013 or dword ptr [ebp+1248708Eh], ebx 0x00000019 mov di, 32B0h 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push ecx 0x00000022 call 00007F4860DF3FC8h 0x00000027 pop ecx 0x00000028 mov dword ptr [esp+04h], ecx 0x0000002c add dword ptr [esp+04h], 00000018h 0x00000034 inc ecx 0x00000035 push ecx 0x00000036 ret 0x00000037 pop ecx 0x00000038 ret 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push ebx 0x0000003e call 00007F4860DF3FC8h 0x00000043 pop ebx 0x00000044 mov dword ptr [esp+04h], ebx 0x00000048 add dword ptr [esp+04h], 00000018h 0x00000050 inc ebx 0x00000051 push ebx 0x00000052 ret 0x00000053 pop ebx 0x00000054 ret 0x00000055 movzx ebx, si 0x00000058 push eax 0x00000059 pushad 0x0000005a push eax 0x0000005b push edx 0x0000005c jmp 00007F4860DF3FCEh 0x00000061 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CC0C94 second address: CC0C9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CC2ACE second address: CC2AD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CC1D2D second address: CC1D3F instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4860DEC966h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007F4860DEC96Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CC1D3F second address: CC1DB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 add bx, B8FAh 0x0000000d push dword ptr fs:[00000000h] 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007F4860DF3FC8h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 0000001Ah 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e mov dword ptr fs:[00000000h], esp 0x00000035 push 00000000h 0x00000037 push edx 0x00000038 call 00007F4860DF3FC8h 0x0000003d pop edx 0x0000003e mov dword ptr [esp+04h], edx 0x00000042 add dword ptr [esp+04h], 00000016h 0x0000004a inc edx 0x0000004b push edx 0x0000004c ret 0x0000004d pop edx 0x0000004e ret 0x0000004f mov eax, dword ptr [ebp+122D173Dh] 0x00000055 mov dword ptr [ebp+122D2A2Eh], ebx 0x0000005b push FFFFFFFFh 0x0000005d mov ebx, dword ptr [ebp+122D2A66h] 0x00000063 push eax 0x00000064 push eax 0x00000065 push edx 0x00000066 push eax 0x00000067 push edx 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CC1DB5 second address: CC1DB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CC1DB9 second address: CC1DBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CC1DBD second address: CC1DC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CC5A29 second address: CC5A2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CC6B15 second address: CC6B19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CC9376 second address: CC937C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CC937C second address: CC9383 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CCB171 second address: CCB18E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DF3FD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CCB18E second address: CCB198 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4860DEC96Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CCB198 second address: CCB1E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 clc 0x0000000a push 00000000h 0x0000000c sub dword ptr [ebp+122D2BB7h], esi 0x00000012 mov edi, dword ptr [ebp+122D3A94h] 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007F4860DF3FC8h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 0000001Bh 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 mov ebx, dword ptr [ebp+122D37C8h] 0x0000003a xchg eax, esi 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f jne 00007F4860DF3FC6h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CC9427 second address: CC942B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CCB1E6 second address: CCB1EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CC942B second address: CC943F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DEC970h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CCB1EC second address: CCB1F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CCC182 second address: CCC187 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CCC187 second address: CCC18D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CCB418 second address: CCB422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CCD254 second address: CCD2D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push esi 0x0000000b call 00007F4860DF3FCEh 0x00000010 mov edi, dword ptr [ebp+122D1CE9h] 0x00000016 pop ebx 0x00000017 pop edi 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push eax 0x0000001d call 00007F4860DF3FC8h 0x00000022 pop eax 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 add dword ptr [esp+04h], 0000001Dh 0x0000002f inc eax 0x00000030 push eax 0x00000031 ret 0x00000032 pop eax 0x00000033 ret 0x00000034 cld 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push edx 0x0000003a call 00007F4860DF3FC8h 0x0000003f pop edx 0x00000040 mov dword ptr [esp+04h], edx 0x00000044 add dword ptr [esp+04h], 0000001Dh 0x0000004c inc edx 0x0000004d push edx 0x0000004e ret 0x0000004f pop edx 0x00000050 ret 0x00000051 jmp 00007F4860DF3FCEh 0x00000056 push eax 0x00000057 pushad 0x00000058 pushad 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CCD42D second address: CCD433 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CCD433 second address: CCD4B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push ecx 0x00000008 jmp 00007F4860DF3FD5h 0x0000000d pop ecx 0x0000000e nop 0x0000000f and ebx, dword ptr [ebp+122D2A0Bh] 0x00000015 add di, F602h 0x0000001a push dword ptr fs:[00000000h] 0x00000021 mov dword ptr fs:[00000000h], esp 0x00000028 sub dword ptr [ebp+122D316Ch], ecx 0x0000002e mov eax, dword ptr [ebp+122D1255h] 0x00000034 push 00000000h 0x00000036 push ebp 0x00000037 call 00007F4860DF3FC8h 0x0000003c pop ebp 0x0000003d mov dword ptr [esp+04h], ebp 0x00000041 add dword ptr [esp+04h], 00000015h 0x00000049 inc ebp 0x0000004a push ebp 0x0000004b ret 0x0000004c pop ebp 0x0000004d ret 0x0000004e movsx ebx, di 0x00000051 mov dword ptr [ebp+122D2BBEh], ecx 0x00000057 push FFFFFFFFh 0x00000059 mov ebx, dword ptr [ebp+122D2C1Bh] 0x0000005f nop 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 jmp 00007F4860DF3FCCh 0x00000069 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CCE4B3 second address: CCE4B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CCD4B6 second address: CCD4CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DF3FD3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CCD4CD second address: CCD4E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jnl 00007F4860DEC966h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CCD4E0 second address: CCD4E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CD04FD second address: CD0522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4860DEC978h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CD0522 second address: CD0528 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CD0528 second address: CD052E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CD13EF second address: CD13F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CD13F5 second address: CD13F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CD06D0 second address: CD06EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F4860DF3FC6h 0x0000000a popad 0x0000000b pop edx 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F4860DF3FCCh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CDC144 second address: CDC154 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F4860DEC96Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CDC154 second address: CDC163 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4860DF3FC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CDC163 second address: CDC16E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: C72D59 second address: C72D7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DF3FD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007F4860DF3FCCh 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: C72D7D second address: C72DB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F4860DEC979h 0x00000010 jmp 00007F4860DEC96Fh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CE234B second address: CE2351 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CE2351 second address: CE2357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CE2357 second address: CE235D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CEEB05 second address: CEEB2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 jmp 00007F4860DEC96Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4860DEC96Fh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CEEB2B second address: CEEB2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CECB85 second address: CECB89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CECB89 second address: CECB93 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CECB93 second address: CECB97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CECCC4 second address: CECCE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F4860DF3FD7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CECCE1 second address: CECCFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4860DEC978h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CECCFD second address: CECD01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CED2DD second address: CED2E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CED2E3 second address: CED2E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CED2E7 second address: CED2F1 instructions: 0x00000000 rdtsc 0x00000002 js 00007F4860DEC96Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CED716 second address: CED720 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4860DF3FD2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CED720 second address: CED726 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CED868 second address: CED86C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CED86C second address: CED870 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CED870 second address: CED87C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CED87C second address: CED880 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CED880 second address: CED884 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CEDB79 second address: CEDB7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CEDB7D second address: CEDB8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DF3FCAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CEDB8B second address: CEDBC4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DEC973h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jmp 00007F4860DEC979h 0x0000000f push eax 0x00000010 push edx 0x00000011 jg 00007F4860DEC966h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CEDBC4 second address: CEDBC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CEE953 second address: CEE968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4860DEC96Eh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CEE968 second address: CEE973 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F4860DF3FC6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CEE973 second address: CEE981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CEE981 second address: CEE993 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007F4860DF3FC6h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CEE993 second address: CEE9B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DEC972h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007F4860DEC966h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CF6557 second address: CF656F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4860DF3FCAh 0x00000009 je 00007F4860DF3FDFh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CF5F78 second address: CF5F7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CF60BD second address: CF60CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F4860DF3FC6h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CF60CC second address: CF60D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CF60D2 second address: CF60DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F4860DF3FC6h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CF60DF second address: CF60EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F4860DEC966h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CF60EE second address: CF60F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CF6299 second address: CF629D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CF629D second address: CF62AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F4860DF3FC6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CF62AB second address: CF62B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CF62B7 second address: CF62BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: C748DF second address: C7490C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jp 00007F4860DEC966h 0x0000000c jne 00007F4860DEC966h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jg 00007F4860DEC966h 0x0000001b jmp 00007F4860DEC972h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: C7490C second address: C74912 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D115AC second address: D115CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F4860DEC966h 0x0000000a jo 00007F4860DEC966h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jbe 00007F4860DEC966h 0x00000019 jns 00007F4860DEC966h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D115CB second address: D115CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D115CF second address: D115E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F4860DEC966h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d jl 00007F4860DEC96Eh 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D13700 second address: D13721 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DF3FCFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007F4860DF3FD2h 0x0000000f jnc 00007F4860DF3FC6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D13721 second address: D13735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 jmp 00007F4860DEC96Dh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D13735 second address: D1374C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 pushad 0x00000007 jmp 00007F4860DF3FCBh 0x0000000c push ecx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D1D22E second address: D1D234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D1D234 second address: D1D238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D1D238 second address: D1D23C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D1D23C second address: D1D246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D1D246 second address: D1D24A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D1CDB8 second address: D1CDC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F4860DF3FC6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D1CDC9 second address: D1CDCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D1CDCD second address: D1CDD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D1CF24 second address: D1CF28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D1CF28 second address: D1CF2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D1CF2E second address: D1CF34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D1CF34 second address: D1CF40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F4860DF3FC6h 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D1CF40 second address: D1CF46 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D1CF46 second address: D1CF54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F4860DF3FCEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D1F7A4 second address: D1F7CD instructions: 0x00000000 rdtsc 0x00000002 jns 00007F4860DEC971h 0x00000008 jmp 00007F4860DEC96Bh 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F4860DEC974h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D1F7CD second address: D1F7D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: C6DBB2 second address: C6DBB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: C6DBB6 second address: C6DC0A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnp 00007F4860DF3FC6h 0x0000000f jmp 00007F4860DF3FD6h 0x00000014 popad 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 jc 00007F4860DF3FC6h 0x0000001e jmp 00007F4860DF3FCAh 0x00000023 popad 0x00000024 popad 0x00000025 push edi 0x00000026 pushad 0x00000027 pushad 0x00000028 popad 0x00000029 push ecx 0x0000002a pop ecx 0x0000002b popad 0x0000002c pushad 0x0000002d jmp 00007F4860DF3FCDh 0x00000032 pushad 0x00000033 popad 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D21076 second address: D2108A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4860DEC96Eh 0x00000008 jnp 00007F4860DEC966h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D2108A second address: D21090 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D37862 second address: D37882 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F4860DEC970h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F4860DEC966h 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D37882 second address: D3788E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4860DF3FC6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D3770A second address: D3770E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D39028 second address: D3902E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D3BC03 second address: D3BC11 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4860DEC968h 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D3BC11 second address: D3BC15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D5F24A second address: D5F24E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D5F24E second address: D5F298 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F4860DF3FD3h 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F4860DF3FD5h 0x00000018 jmp 00007F4860DF3FD4h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D5F298 second address: D5F2A4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jno 00007F4860DEC966h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D5FB07 second address: D5FB0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D5FB0D second address: D5FB11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D5FB11 second address: D5FB28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DF3FD3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D5FF70 second address: D5FF7E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F4860DEC972h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D5FF7E second address: D5FF84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D5FF84 second address: D5FF88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D5FF88 second address: D5FF8D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D60121 second address: D60168 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jmp 00007F4860DEC96Ch 0x0000000c popad 0x0000000d pushad 0x0000000e push ecx 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F4860DEC96Eh 0x00000016 pop ecx 0x00000017 pushad 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a jnp 00007F4860DEC966h 0x00000020 pushad 0x00000021 popad 0x00000022 jmp 00007F4860DEC96Ah 0x00000027 popad 0x00000028 push eax 0x00000029 push edx 0x0000002a jp 00007F4860DEC966h 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D60168 second address: D6016C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D632FA second address: D632FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D632FE second address: D63366 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a sbb dh, FFFFFFB1h 0x0000000d push dword ptr [ebp+122D3209h] 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F4860DF3FC8h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 0000001Dh 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d add dword ptr [ebp+122D2A16h], eax 0x00000033 push edx 0x00000034 pushad 0x00000035 cld 0x00000036 mov esi, dword ptr [ebp+122D1F80h] 0x0000003c popad 0x0000003d pop edx 0x0000003e jo 00007F4860DF3FC9h 0x00000044 mov dx, di 0x00000047 push 0B868C74h 0x0000004c pushad 0x0000004d jno 00007F4860DF3FCCh 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D63366 second address: D6336A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D66516 second address: D66535 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop eax 0x00000007 jp 00007F4860DF3FD2h 0x0000000d popad 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D66535 second address: D66539 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D660F6 second address: D66130 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DF3FCAh 0x00000007 jmp 00007F4860DF3FD3h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jng 00007F4860DF3FE3h 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 jmp 00007F4860DF3FCFh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D68166 second address: D6817F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnl 00007F4860DEC966h 0x00000009 jc 00007F4860DEC966h 0x0000000f pop edi 0x00000010 pushad 0x00000011 jp 00007F4860DEC966h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: D6817F second address: D68185 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	RDTSC instruction interceptor: First address: CBEDE6 second address: CBEDEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 720270 second address: 71FBA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DF3FCDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c jmp 00007F4860DF3FD2h 0x00000011 push dword ptr [ebp+122D0F11h] 0x00000017 cld 0x00000018 call dword ptr [ebp+122D1CB6h] 0x0000001e pushad 0x0000001f xor dword ptr [ebp+122D2535h], ebx 0x00000025 xor eax, eax 0x00000027 xor dword ptr [ebp+122D2535h], edx 0x0000002d mov edx, dword ptr [esp+28h] 0x00000031 jmp 00007F4860DF3FCAh 0x00000036 mov dword ptr [ebp+122D38ACh], eax 0x0000003c cmc 0x0000003d mov esi, 0000003Ch 0x00000042 pushad 0x00000043 mov ebx, dword ptr [ebp+122D37ECh] 0x00000049 mov ch, dh 0x0000004b popad 0x0000004c add esi, dword ptr [esp+24h] 0x00000050 sub dword ptr [ebp+122D2535h], edi 0x00000056 lodsw 0x00000058 jmp 00007F4860DF3FD7h 0x0000005d add eax, dword ptr [esp+24h] 0x00000061 jmp 00007F4860DF3FD4h 0x00000066 mov ebx, dword ptr [esp+24h] 0x0000006a mov dword ptr [ebp+122D299Dh], ecx 0x00000070 push eax 0x00000071 push edx 0x00000072 pushad 0x00000073 jmp 00007F4860DF3FCDh 0x00000078 push eax 0x00000079 push edx 0x0000007a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8A5142 second address: 8A5151 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F4860DEC966h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8A5151 second address: 8A5157 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8A5157 second address: 8A5175 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4860DEC972h 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007F4860DEC966h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8A5175 second address: 8A5179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8A5179 second address: 8A517D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 89809D second address: 8980BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F4860DF3FD8h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8980BF second address: 8980DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4860DEC977h 0x00000009 popad 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8980DB second address: 8980EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DF3FCBh 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8A4737 second address: 8A476D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnc 00007F4860DEC966h 0x0000000d ja 00007F4860DEC966h 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F4860DEC977h 0x0000001c ja 00007F4860DEC96Ch 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8A476D second address: 8A4771 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8A4771 second address: 8A4785 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4860DEC96Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8A4785 second address: 8A4789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8A4A07 second address: 8A4A0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8A4A0B second address: 8A4A1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jbe 00007F4860DF3FC6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8A4A1C second address: 8A4A24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8A4A24 second address: 8A4A46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c jmp 00007F4860DF3FD6h 0x00000011 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8A4A46 second address: 8A4A4E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8A4A4E second address: 8A4A54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8A4A54 second address: 8A4A58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8C763B second address: 8C7661 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F4860DF3FD2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b ja 00007F4860DF3FCEh 0x00000011 js 00007F4860DF3FC6h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8C7661 second address: 8C767E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4860DEC979h 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8C7838 second address: 8C783E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8C783E second address: 8C7863 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DEC970h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F4860DEC971h 0x0000000e rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8C7863 second address: 8C7869 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8C7869 second address: 8C7873 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F4860DEC966h 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8C7873 second address: 8C7877 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8C7877 second address: 8C788F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F4860DEC96Eh 0x0000000f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8C7CD8 second address: 8C7CF4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F4860DF3FC6h 0x00000009 jne 00007F4860DF3FC6h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jnc 00007F4860DF3FC6h 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8C8162 second address: 8C8166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8C82DB second address: 8C82FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pushad 0x00000007 push edx 0x00000008 jmp 00007F4860DF3FCDh 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jno 00007F4860DF3FC6h 0x00000016 push esi 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8C82FB second address: 8C8301 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8C846E second address: 8C8473 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8C8EE1 second address: 8C8EEB instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4860DEC966h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8CE767 second address: 8CE774 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F4860DF3FC6h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D0BF2 second address: 8D0BF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D0BF6 second address: 8D0BFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D0BFC second address: 8D0C25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F4860DEC96Ch 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F4860DEC96Eh 0x00000019 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D4D25 second address: 8D4D2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D4D2B second address: 8D4D37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F4860DEC972h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D4D37 second address: 8D4D3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D4D3D second address: 8D4D45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D4D45 second address: 8D4D5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4860DF3FD1h 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D4D5A second address: 8D4D7B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DEC974h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D4D7B second address: 8D4DB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edx 0x00000008 jp 00007F4860DF3FC6h 0x0000000e jmp 00007F4860DF3FCBh 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F4860DF3FD9h 0x0000001b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 89B670 second address: 89B676 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 89B676 second address: 89B6BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DF3FD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007F4860DF3FCEh 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007F4860DF3FD7h 0x0000001b push edx 0x0000001c pop edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 89B6BB second address: 89B6C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D7167 second address: 8D7171 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F4860DF3FC6h 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D7171 second address: 8D7183 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F4860DEC966h 0x00000012 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D7183 second address: 8D71A1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4860DF3FD6h 0x0000000d rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D73CE second address: 8D73D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D73D5 second address: 8D73E3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D73E3 second address: 8D73E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D73E8 second address: 8D73F2 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4860DF3FCCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D78B9 second address: 8D78C3 instructions: 0x00000000 rdtsc 0x00000002 je 00007F4860DEC966h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D7947 second address: 8D7958 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8C7CD8 second address: 8C7CF4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F4860DEC966h 0x00000009 jne 00007F4860DEC966h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jnc 00007F4860DEC966h 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8C82DB second address: 8C82FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pushad 0x00000007 push edx 0x00000008 jmp 00007F4860DEC96Dh 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jno 00007F4860DEC966h 0x00000016 push esi 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8C8EE1 second address: 8C8EEB instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4860DF3FC6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8CE767 second address: 8CE774 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F4860DEC966h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D0BFC second address: 8D0C25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F4860DF3FCCh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F4860DF3FCEh 0x00000019 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D4D2B second address: 8D4D37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F4860DF3FD2h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D4D45 second address: 8D4D5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4860DEC971h 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D4D5A second address: 8D4D7B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DF3FD4h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D4D7B second address: 8D4DB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edx 0x00000008 jp 00007F4860DEC966h 0x0000000e jmp 00007F4860DEC96Bh 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F4860DEC979h 0x0000001b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 89B676 second address: 89B6BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DEC971h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007F4860DEC96Eh 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007F4860DEC977h 0x0000001b push edx 0x0000001c pop edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D7167 second address: 8D7171 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F4860DEC966h 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D7171 second address: 8D7183 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F4860DF3FC6h 0x00000012 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D7183 second address: 8D71A1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4860DEC976h 0x0000000d rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D73E8 second address: 8D73F2 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4860DEC96Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D78B9 second address: 8D78C3 instructions: 0x00000000 rdtsc 0x00000002 je 00007F4860DF3FC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D7958 second address: 8D795C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D7E1A second address: 8D7E29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F4860DEC966h 0x0000000f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D8383 second address: 8D8389 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D8BE8 second address: 8D8BF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D8A6D second address: 8D8A78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D8A78 second address: 8D8A7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D976A second address: 8D976F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D951E second address: 8D9532 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DF3FD0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8D9532 second address: 8D9538 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8DADA7 second address: 8DADC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DEC96Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push ecx 0x0000000c jnc 00007F4860DEC966h 0x00000012 pop ecx 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8DDA86 second address: 8DDA8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8E0A9B second address: 8E0B32 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DF3FD0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov edi, 325ACBEAh 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F4860DF3FC8h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 0000001Ah 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d call 00007F4860DF3FD5h 0x00000032 push eax 0x00000033 mov dword ptr [ebp+122D2A49h], eax 0x00000039 pop edi 0x0000003a pop edi 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push ecx 0x00000040 call 00007F4860DF3FC8h 0x00000045 pop ecx 0x00000046 mov dword ptr [esp+04h], ecx 0x0000004a add dword ptr [esp+04h], 0000001Ch 0x00000052 inc ecx 0x00000053 push ecx 0x00000054 ret 0x00000055 pop ecx 0x00000056 ret 0x00000057 jnl 00007F4860DF3FCCh 0x0000005d push eax 0x0000005e push eax 0x0000005f push edx 0x00000060 push eax 0x00000061 push edx 0x00000062 pushad 0x00000063 popad 0x00000064 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8E0B32 second address: 8E0B38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8E1AE1 second address: 8E1AE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8E1AE7 second address: 8E1B6F instructions: 0x00000000 rdtsc 0x00000002 je 00007F4860DEC966h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F4860DEC977h 0x00000012 nop 0x00000013 or dword ptr [ebp+1248708Eh], ebx 0x00000019 mov di, 32B0h 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push ecx 0x00000022 call 00007F4860DEC968h 0x00000027 pop ecx 0x00000028 mov dword ptr [esp+04h], ecx 0x0000002c add dword ptr [esp+04h], 00000018h 0x00000034 inc ecx 0x00000035 push ecx 0x00000036 ret 0x00000037 pop ecx 0x00000038 ret 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push ebx 0x0000003e call 00007F4860DEC968h 0x00000043 pop ebx 0x00000044 mov dword ptr [esp+04h], ebx 0x00000048 add dword ptr [esp+04h], 00000018h 0x00000050 inc ebx 0x00000051 push ebx 0x00000052 ret 0x00000053 pop ebx 0x00000054 ret 0x00000055 movzx ebx, si 0x00000058 push eax 0x00000059 pushad 0x0000005a push eax 0x0000005b push edx 0x0000005c jmp 00007F4860DEC96Eh 0x00000061 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8E2ACE second address: 8E2AD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8E5A29 second address: 8E5A2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8E6B15 second address: 8E6B19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8EB171 second address: 8EB18E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DEC979h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8EB18E second address: 8EB198 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4860DF3FCCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8EB198 second address: 8EB1E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 clc 0x0000000a push 00000000h 0x0000000c sub dword ptr [ebp+122D2BB7h], esi 0x00000012 mov edi, dword ptr [ebp+122D3A94h] 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007F4860DEC968h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 0000001Bh 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 mov ebx, dword ptr [ebp+122D37C8h] 0x0000003a xchg eax, esi 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f jne 00007F4860DEC966h 0x00000045 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8EB1E6 second address: 8EB1EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8EB1EC second address: 8EB1F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8EC182 second address: 8EC187 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8EC187 second address: 8EC18D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8ED254 second address: 8ED2D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push esi 0x0000000b call 00007F4860DF3FCEh 0x00000010 mov edi, dword ptr [ebp+122D1CE9h] 0x00000016 pop ebx 0x00000017 pop edi 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push eax 0x0000001d call 00007F4860DF3FC8h 0x00000022 pop eax 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 add dword ptr [esp+04h], 0000001Dh 0x0000002f inc eax 0x00000030 push eax 0x00000031 ret 0x00000032 pop eax 0x00000033 ret 0x00000034 cld 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push edx 0x0000003a call 00007F4860DF3FC8h 0x0000003f pop edx 0x00000040 mov dword ptr [esp+04h], edx 0x00000044 add dword ptr [esp+04h], 0000001Dh 0x0000004c inc edx 0x0000004d push edx 0x0000004e ret 0x0000004f pop edx 0x00000050 ret 0x00000051 jmp 00007F4860DF3FCEh 0x00000056 push eax 0x00000057 pushad 0x00000058 pushad 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8F04FD second address: 8F0522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4860DEC978h 0x00000012 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8F0522 second address: 8F0528 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8F0528 second address: 8F052E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8F13EF second address: 8F13F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8F13F5 second address: 8F13F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8FC144 second address: 8FC154 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F4860DF3FCAh 0x0000000b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8FC154 second address: 8FC163 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4860DEC966h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8FC163 second address: 8FC16E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 892D59 second address: 892D7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DEC971h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007F4860DEC96Ch 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 892D7D second address: 892DB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F4860DF3FD9h 0x00000010 jmp 00007F4860DF3FCFh 0x00000015 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90234B second address: 902351 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 902351 second address: 902357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 902357 second address: 90235D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8DEDE6 second address: 8DEDEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8E0C94 second address: 8E0C9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8E0D7B second address: 8E0D7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8E1D2D second address: 8E1D3F instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4860DEC966h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007F4860DEC96Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8E1D3F second address: 8E1DB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 add bx, B8FAh 0x0000000d push dword ptr fs:[00000000h] 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007F4860DF3FC8h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 0000001Ah 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e mov dword ptr fs:[00000000h], esp 0x00000035 push 00000000h 0x00000037 push edx 0x00000038 call 00007F4860DF3FC8h 0x0000003d pop edx 0x0000003e mov dword ptr [esp+04h], edx 0x00000042 add dword ptr [esp+04h], 00000016h 0x0000004a inc edx 0x0000004b push edx 0x0000004c ret 0x0000004d pop edx 0x0000004e ret 0x0000004f mov eax, dword ptr [ebp+122D173Dh] 0x00000055 mov dword ptr [ebp+122D2A2Eh], ebx 0x0000005b push FFFFFFFFh 0x0000005d mov ebx, dword ptr [ebp+122D2A66h] 0x00000063 push eax 0x00000064 push eax 0x00000065 push edx 0x00000066 push eax 0x00000067 push edx 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8E1DB5 second address: 8E1DB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8E1DB9 second address: 8E1DBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8E1DBD second address: 8E1DC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90EB05 second address: 90EB2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 jmp 00007F4860DF3FCEh 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4860DF3FCFh 0x00000013 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90EB2B second address: 90EB2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90CB85 second address: 90CB89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90CB89 second address: 90CB93 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90CB93 second address: 90CB97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90CCC4 second address: 90CCE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F4860DEC977h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90CCE1 second address: 90CCFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4860DF3FD8h 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90CCFD second address: 90CD01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90D2DD second address: 90D2E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90D2E3 second address: 90D2E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90D2E7 second address: 90D2F1 instructions: 0x00000000 rdtsc 0x00000002 js 00007F4860DF3FCCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90D716 second address: 90D720 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4860DEC972h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90D720 second address: 90D726 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90D868 second address: 90D86C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90D86C second address: 90D870 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90D870 second address: 90D87C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90D87C second address: 90D880 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90D880 second address: 90D884 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90DB79 second address: 90DB7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90DB7D second address: 90DB8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DEC96Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90DB8B second address: 90DBC4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DF3FD3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jmp 00007F4860DF3FD9h 0x0000000f push eax 0x00000010 push edx 0x00000011 jg 00007F4860DF3FC6h 0x00000017 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90DBC4 second address: 90DBC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90E953 second address: 90E968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4860DF3FCEh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90E968 second address: 90E973 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F4860DEC966h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90E973 second address: 90E981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90E981 second address: 90E993 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007F4860DEC966h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90E993 second address: 90E9B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DF3FD2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007F4860DF3FC6h 0x00000011 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 916557 second address: 91656F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4860DEC96Ah 0x00000009 je 00007F4860DEC97Fh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 915F78 second address: 915F7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 9160BD second address: 9160CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F4860DEC966h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 9160CC second address: 9160D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 9160D2 second address: 9160DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F4860DEC966h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 9160DF second address: 9160EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F4860DF3FC6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 9160EE second address: 9160F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 916299 second address: 91629D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 91629D second address: 9162AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F4860DEC966h 0x0000000e rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 9162AB second address: 9162B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 9162B7 second address: 9162BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8E9376 second address: 8E937C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8E937C second address: 8E9383 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8E9427 second address: 8E942B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8E942B second address: 8E943F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DEC970h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8EB418 second address: 8EB422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8ED42D second address: 8ED433 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8ED433 second address: 8ED4B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push ecx 0x00000008 jmp 00007F4860DF3FD5h 0x0000000d pop ecx 0x0000000e nop 0x0000000f and ebx, dword ptr [ebp+122D2A0Bh] 0x00000015 add di, F602h 0x0000001a push dword ptr fs:[00000000h] 0x00000021 mov dword ptr fs:[00000000h], esp 0x00000028 sub dword ptr [ebp+122D316Ch], ecx 0x0000002e mov eax, dword ptr [ebp+122D1255h] 0x00000034 push 00000000h 0x00000036 push ebp 0x00000037 call 00007F4860DF3FC8h 0x0000003c pop ebp 0x0000003d mov dword ptr [esp+04h], ebp 0x00000041 add dword ptr [esp+04h], 00000015h 0x00000049 inc ebp 0x0000004a push ebp 0x0000004b ret 0x0000004c pop ebp 0x0000004d ret 0x0000004e movsx ebx, di 0x00000051 mov dword ptr [ebp+122D2BBEh], ecx 0x00000057 push FFFFFFFFh 0x00000059 mov ebx, dword ptr [ebp+122D2C1Bh] 0x0000005f nop 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 jmp 00007F4860DF3FCCh 0x00000069 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8ED4B6 second address: 8ED4CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DEC973h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8ED4CD second address: 8ED4E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jnl 00007F4860DF3FC6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8ED4E0 second address: 8ED4E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8EE4B3 second address: 8EE4B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8F06D0 second address: 8F06EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F4860DEC966h 0x0000000a popad 0x0000000b pop edx 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F4860DEC96Ch 0x00000014 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8948DF second address: 89490C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jp 00007F4860DF3FC6h 0x0000000c jne 00007F4860DF3FC6h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jg 00007F4860DF3FC6h 0x0000001b jmp 00007F4860DF3FD2h 0x00000020 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 89490C second address: 894912 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 9315AC second address: 9315CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F4860DF3FC6h 0x0000000a jo 00007F4860DF3FC6h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jbe 00007F4860DF3FC6h 0x00000019 jns 00007F4860DF3FC6h 0x0000001f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 9315CB second address: 9315CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 9315CF second address: 9315E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F4860DF3FC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d jl 00007F4860DF3FCEh 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 933700 second address: 933721 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DEC96Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007F4860DEC972h 0x0000000f jnc 00007F4860DEC966h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 933721 second address: 933735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 jmp 00007F4860DF3FCDh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 933735 second address: 93374C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 pushad 0x00000007 jmp 00007F4860DEC96Bh 0x0000000c push ecx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 93D22E second address: 93D234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 93D234 second address: 93D238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 93D238 second address: 93D23C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 93D23C second address: 93D246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 93D246 second address: 93D24A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 93CDB8 second address: 93CDC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F4860DEC966h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 93CDC9 second address: 93CDCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 93CDCD second address: 93CDD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 93CF24 second address: 93CF28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 93CF28 second address: 93CF2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 93CF2E second address: 93CF34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 93CF34 second address: 93CF40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F4860DEC966h 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 93CF40 second address: 93CF46 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 93CF46 second address: 93CF54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F4860DEC96Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 93F7A4 second address: 93F7CD instructions: 0x00000000 rdtsc 0x00000002 jns 00007F4860DF3FD1h 0x00000008 jmp 00007F4860DF3FCBh 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F4860DF3FD4h 0x00000014 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 93F7CD second address: 93F7D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 88DBB2 second address: 88DBB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 88DBB6 second address: 88DC0A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnp 00007F4860DEC966h 0x0000000f jmp 00007F4860DEC976h 0x00000014 popad 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 jc 00007F4860DEC966h 0x0000001e jmp 00007F4860DEC96Ah 0x00000023 popad 0x00000024 popad 0x00000025 push edi 0x00000026 pushad 0x00000027 pushad 0x00000028 popad 0x00000029 push ecx 0x0000002a pop ecx 0x0000002b popad 0x0000002c pushad 0x0000002d jmp 00007F4860DEC96Dh 0x00000032 pushad 0x00000033 popad 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 941076 second address: 94108A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4860DF3FCEh 0x00000008 jnp 00007F4860DF3FC6h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 94108A second address: 941090 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8E1AE7 second address: 8E1B6F instructions: 0x00000000 rdtsc 0x00000002 je 00007F4860DF3FC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F4860DF3FD7h 0x00000012 nop 0x00000013 or dword ptr [ebp+1248708Eh], ebx 0x00000019 mov di, 32B0h 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push ecx 0x00000022 call 00007F4860DF3FC8h 0x00000027 pop ecx 0x00000028 mov dword ptr [esp+04h], ecx 0x0000002c add dword ptr [esp+04h], 00000018h 0x00000034 inc ecx 0x00000035 push ecx 0x00000036 ret 0x00000037 pop ecx 0x00000038 ret 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push ebx 0x0000003e call 00007F4860DF3FC8h 0x00000043 pop ebx 0x00000044 mov dword ptr [esp+04h], ebx 0x00000048 add dword ptr [esp+04h], 00000018h 0x00000050 inc ebx 0x00000051 push ebx 0x00000052 ret 0x00000053 pop ebx 0x00000054 ret 0x00000055 movzx ebx, si 0x00000058 push eax 0x00000059 pushad 0x0000005a push eax 0x0000005b push edx 0x0000005c jmp 00007F4860DF3FCEh 0x00000061 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8EB171 second address: 8EB18E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DF3FD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8EB18E second address: 8EB198 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4860DEC96Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8EB198 second address: 8EB1E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 clc 0x0000000a push 00000000h 0x0000000c sub dword ptr [ebp+122D2BB7h], esi 0x00000012 mov edi, dword ptr [ebp+122D3A94h] 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007F4860DF3FC8h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 0000001Bh 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 mov ebx, dword ptr [ebp+122D37C8h] 0x0000003a xchg eax, esi 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f jne 00007F4860DF3FC6h 0x00000045 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8F06D0 second address: 8F06EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F4860DF3FC6h 0x0000000a popad 0x0000000b pop edx 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F4860DF3FCCh 0x00000014 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8FC144 second address: 8FC154 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F4860DEC96Ah 0x0000000b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8FC154 second address: 8FC163 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4860DF3FC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 892D59 second address: 892D7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DF3FD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007F4860DF3FCCh 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 892D7D second address: 892DB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F4860DEC979h 0x00000010 jmp 00007F4860DEC96Fh 0x00000015 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90EB05 second address: 90EB2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 jmp 00007F4860DEC96Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4860DEC96Fh 0x00000013 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90CCC4 second address: 90CCE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F4860DF3FD7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90CCE1 second address: 90CCFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4860DEC978h 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90D2E7 second address: 90D2F1 instructions: 0x00000000 rdtsc 0x00000002 js 00007F4860DEC96Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90D716 second address: 90D720 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4860DF3FD2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90DB7D second address: 90DB8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DF3FCAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90DB8B second address: 90DBC4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DEC973h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jmp 00007F4860DEC979h 0x0000000f push eax 0x00000010 push edx 0x00000011 jg 00007F4860DEC966h 0x00000017 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90E953 second address: 90E968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4860DEC96Eh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90E968 second address: 90E973 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F4860DF3FC6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90E981 second address: 90E993 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007F4860DF3FC6h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 90E993 second address: 90E9B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DEC972h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007F4860DEC966h 0x00000011 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 916557 second address: 91656F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4860DF3FCAh 0x00000009 je 00007F4860DF3FDFh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 9160BD second address: 9160CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F4860DF3FC6h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 9160D2 second address: 9160DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F4860DF3FC6h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 9160DF second address: 9160EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F4860DEC966h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 91629D second address: 9162AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F4860DF3FC6h 0x0000000e rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 8948DF second address: 89490C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jp 00007F4860DEC966h 0x0000000c jne 00007F4860DEC966h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jg 00007F4860DEC966h 0x0000001b jmp 00007F4860DEC972h 0x00000020 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 9315AC second address: 9315CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F4860DEC966h 0x0000000a jo 00007F4860DEC966h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jbe 00007F4860DEC966h 0x00000019 jns 00007F4860DEC966h 0x0000001f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 9315CF second address: 9315E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F4860DEC966h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d jl 00007F4860DEC96Eh 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 933700 second address: 933721 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DF3FCFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007F4860DF3FD2h 0x0000000f jnc 00007F4860DF3FC6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 933721 second address: 933735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 jmp 00007F4860DEC96Dh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 933735 second address: 93374C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 pushad 0x00000007 jmp 00007F4860DF3FCBh 0x0000000c push ecx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 93CDB8 second address: 93CDC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F4860DF3FC6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 93CF34 second address: 93CF40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F4860DF3FC6h 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 93CF46 second address: 93CF54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F4860DF3FCEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 93F7A4 second address: 93F7CD instructions: 0x00000000 rdtsc 0x00000002 jns 00007F4860DEC971h 0x00000008 jmp 00007F4860DEC96Bh 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F4860DEC974h 0x00000014 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 88DBB6 second address: 88DC0A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnp 00007F4860DF3FC6h 0x0000000f jmp 00007F4860DF3FD6h 0x00000014 popad 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 jc 00007F4860DF3FC6h 0x0000001e jmp 00007F4860DF3FCAh 0x00000023 popad 0x00000024 popad 0x00000025 push edi 0x00000026 pushad 0x00000027 pushad 0x00000028 popad 0x00000029 push ecx 0x0000002a pop ecx 0x0000002b popad 0x0000002c pushad 0x0000002d jmp 00007F4860DF3FCDh 0x00000032 pushad 0x00000033 popad 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 941076 second address: 94108A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4860DEC96Eh 0x00000008 jnp 00007F4860DEC966h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 957862 second address: 957882 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F4860DEC970h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F4860DEC966h 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 957882 second address: 95788E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4860DF3FC6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 95770A second address: 95770E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 959028 second address: 95902E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 95BC03 second address: 95BC11 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4860DEC968h 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 95BC11 second address: 95BC15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 97F24A second address: 97F24E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 97F24E second address: 97F298 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F4860DF3FD3h 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F4860DF3FD5h 0x00000018 jmp 00007F4860DF3FD4h 0x0000001d rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 97F298 second address: 97F2A4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jno 00007F4860DEC966h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 97FB07 second address: 97FB0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 97FB0D second address: 97FB11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 97FB11 second address: 97FB28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DF3FD3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 97FF70 second address: 97FF7E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F4860DEC972h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 97FF7E second address: 97FF84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 97FF84 second address: 97FF88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 97FF88 second address: 97FF8D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 980121 second address: 980168 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jmp 00007F4860DEC96Ch 0x0000000c popad 0x0000000d pushad 0x0000000e push ecx 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F4860DEC96Eh 0x00000016 pop ecx 0x00000017 pushad 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a jnp 00007F4860DEC966h 0x00000020 pushad 0x00000021 popad 0x00000022 jmp 00007F4860DEC96Ah 0x00000027 popad 0x00000028 push eax 0x00000029 push edx 0x0000002a jp 00007F4860DEC966h 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 980168 second address: 98016C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 9832FA second address: 9832FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 9832FE second address: 983366 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a sbb dh, FFFFFFB1h 0x0000000d push dword ptr [ebp+122D3209h] 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F4860DF3FC8h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 0000001Dh 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d add dword ptr [ebp+122D2A16h], eax 0x00000033 push edx 0x00000034 pushad 0x00000035 cld 0x00000036 mov esi, dword ptr [ebp+122D1F80h] 0x0000003c popad 0x0000003d pop edx 0x0000003e jo 00007F4860DF3FC9h 0x00000044 mov dx, di 0x00000047 push 0B868C74h 0x0000004c pushad 0x0000004d jno 00007F4860DF3FCCh 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 983366 second address: 98336A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 986516 second address: 986525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop eax 0x00000007 jp 00007F4860DF3FD2h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 986525 second address: 986535 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F4860DEC966h 0x0000000a popad 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 986535 second address: 986539 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 9860F6 second address: 986130 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DEC96Ah 0x00000007 jmp 00007F4860DEC973h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jng 00007F4860DEC983h 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 jmp 00007F4860DEC96Fh 0x0000001d rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 988166 second address: 98817F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnl 00007F4860DF3FC6h 0x00000009 jc 00007F4860DF3FC6h 0x0000000f pop edi 0x00000010 pushad 0x00000011 jp 00007F4860DF3FC6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 98817F second address: 988185 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 957862 second address: 957882 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F4860DF3FD0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F4860DF3FC6h 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 957882 second address: 95788E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4860DEC966h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 95BC03 second address: 95BC11 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4860DF3FC8h 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 97F24E second address: 97F298 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F4860DEC973h 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F4860DEC975h 0x00000018 jmp 00007F4860DEC974h 0x0000001d rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 97F298 second address: 97F2A4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jno 00007F4860DF3FC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 97FB11 second address: 97FB28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DEC973h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 97FF70 second address: 97FF7E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F4860DF3FD2h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 980121 second address: 980168 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jmp 00007F4860DF3FCCh 0x0000000c popad 0x0000000d pushad 0x0000000e push ecx 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F4860DF3FCEh 0x00000016 pop ecx 0x00000017 pushad 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a jnp 00007F4860DF3FC6h 0x00000020 pushad 0x00000021 popad 0x00000022 jmp 00007F4860DF3FCAh 0x00000027 popad 0x00000028 push eax 0x00000029 push edx 0x0000002a jp 00007F4860DF3FC6h 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 9832FE second address: 983366 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a sbb dh, FFFFFFB1h 0x0000000d push dword ptr [ebp+122D3209h] 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F4860DEC968h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 0000001Dh 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d add dword ptr [ebp+122D2A16h], eax 0x00000033 push edx 0x00000034 pushad 0x00000035 cld 0x00000036 mov esi, dword ptr [ebp+122D1F80h] 0x0000003c popad 0x0000003d pop edx 0x0000003e jo 00007F4860DEC969h 0x00000044 mov dx, di 0x00000047 push 0B868C74h 0x0000004c pushad 0x0000004d jno 00007F4860DEC96Ch 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	RDTSC instruction interceptor: First address: 986516 second address: 986535 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop eax 0x00000007 jp 00007F4860DEC972h 0x0000000d popad 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: FD0270 second address: FCFBA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DF3FCDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c jmp 00007F4860DF3FD2h 0x00000011 push dword ptr [ebp+122D0F11h] 0x00000017 cld 0x00000018 call dword ptr [ebp+122D1CB6h] 0x0000001e pushad 0x0000001f xor dword ptr [ebp+122D2535h], ebx 0x00000025 xor eax, eax 0x00000027 xor dword ptr [ebp+122D2535h], edx 0x0000002d mov edx, dword ptr [esp+28h] 0x00000031 jmp 00007F4860DF3FCAh 0x00000036 mov dword ptr [ebp+122D38ACh], eax 0x0000003c cmc 0x0000003d mov esi, 0000003Ch 0x00000042 pushad 0x00000043 mov ebx, dword ptr [ebp+122D37ECh] 0x00000049 mov ch, dh 0x0000004b popad 0x0000004c add esi, dword ptr [esp+24h] 0x00000050 sub dword ptr [ebp+122D2535h], edi 0x00000056 lodsw 0x00000058 jmp 00007F4860DF3FD7h 0x0000005d add eax, dword ptr [esp+24h] 0x00000061 jmp 00007F4860DF3FD4h 0x00000066 mov ebx, dword ptr [esp+24h] 0x0000006a mov dword ptr [ebp+122D299Dh], ecx 0x00000070 push eax 0x00000071 push edx 0x00000072 pushad 0x00000073 jmp 00007F4860DF3FCDh 0x00000078 push eax 0x00000079 push edx 0x0000007a rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 1155142 second address: 1155151 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F4860DEC966h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 1155151 second address: 1155157 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 1155157 second address: 1155175 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4860DEC972h 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007F4860DEC966h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 1155175 second address: 1155179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 1155179 second address: 115517D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 114809D second address: 11480BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F4860DF3FD8h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 11480BF second address: 11480DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4860DEC977h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 11480DB second address: 11480EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4860DF3FCBh 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 1154737 second address: 115476D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnc 00007F4860DEC966h 0x0000000d ja 00007F4860DEC966h 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F4860DEC977h 0x0000001c ja 00007F4860DEC96Ch 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 115476D second address: 1154771 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 1154771 second address: 1154785 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4860DEC96Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 1154785 second address: 1154789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 1154A07 second address: 1154A0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 1154A0B second address: 1154A1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jbe 00007F4860DF3FC6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 1154A1C second address: 1154A24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 1154A24 second address: 1154A46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c jmp 00007F4860DF3FD6h 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 1154A46 second address: 1154A4E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 1154A4E second address: 1154A54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 1154A54 second address: 1154A58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 117763B second address: 1177661 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F4860DF3FD2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b ja 00007F4860DF3FCEh 0x00000011 js 00007F4860DF3FC6h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	RDTSC instruction interceptor: First address: 1177661 second address: 117767E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4860DEC979h 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Special instruction interceptor: First address: AFFB3A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Special instruction interceptor: First address: AFFBFF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Special instruction interceptor: First address: CF7A33 instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: 71FB3A instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: 71FBFF instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: 917A33 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: FCFB3A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: FCFBFF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: 11C7A33 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Window / User API: threadDelayed 1346	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Window / User API: threadDelayed 1067	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 630	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 396	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1445	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1258	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1207	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe TID: 6592	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe TID: 6568	Thread sleep count: 1346 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe TID: 6568	Thread sleep time: -2693346s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe TID: 6552	Thread sleep count: 1067 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe TID: 6552	Thread sleep time: -2135067s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe TID: 6448	Thread sleep count: 190 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe TID: 3732	Thread sleep count: 236 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5684	Thread sleep count: 103 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5684	Thread sleep time: -206103s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4500	Thread sleep count: 138 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4500	Thread sleep time: -276138s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 928	Thread sleep count: 109 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 928	Thread sleep time: -218109s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4412	Thread sleep count: 111 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4412	Thread sleep time: -222111s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1364	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1364	Thread sleep count: 630 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1364	Thread sleep time: -63630s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7020	Thread sleep count: 334 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7020	Thread sleep count: 94 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3328	Thread sleep count: 128 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3328	Thread sleep time: -256128s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6228	Thread sleep count: 123 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6228	Thread sleep time: -246123s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5436	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5436	Thread sleep count: 396 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5436	Thread sleep time: -39996s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7084	Thread sleep count: 342 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7084	Thread sleep count: 59 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3760	Thread sleep count: 68 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3760	Thread sleep time: -136068s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7244	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7228	Thread sleep count: 1445 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7228	Thread sleep time: -2891445s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7200	Thread sleep count: 196 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7336	Thread sleep count: 229 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7224	Thread sleep count: 1258 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7224	Thread sleep time: -2517258s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7232	Thread sleep count: 1207 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7232	Thread sleep time: -2415207s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7492	Thread sleep count: 46 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7492	Thread sleep time: -92046s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7500	Thread sleep count: 46 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7500	Thread sleep time: -92046s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7460	Thread sleep count: 220 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7664	Thread sleep count: 240 > 30	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_00A29610 GetKeyboardLayoutList followed by cmp: cmp ecx, edx and CTI: je 00A2962Ah	0_2_00A29610
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_00A27780 GetKeyboardLayoutList followed by cmp: cmp eax, 21h and CTI: jc 00A27790h country: Indonesian (id)	0_2_00A27780
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_00A27750 GetKeyboardLayoutList followed by cmp: cmp eax, 0eh and CTI: jc 00A27760h country: Hungarian (hu)	0_2_00A27750
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_00A27D40 GetKeyboardLayoutList followed by cmp: cmp eax, 2eh and CTI: jc 00A27D50h country: Upper Sorbian (hsb)	0_2_00A27D40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00647D40 GetKeyboardLayoutList followed by cmp: cmp eax, 2eh and CTI: jc 00647D50h country: Upper Sorbian (hsb)	5_2_00647D40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00649610 GetKeyboardLayoutList followed by cmp: cmp ecx, edx and CTI: je 0064962Ah	5_2_00649610
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00647750 GetKeyboardLayoutList followed by cmp: cmp eax, 0eh and CTI: jc 00647760h country: Hungarian (hu)	5_2_00647750
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00647780 GetKeyboardLayoutList followed by cmp: cmp eax, 21h and CTI: jc 00647790h country: Indonesian (id)	5_2_00647780
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00649610 GetKeyboardLayoutList followed by cmp: cmp ecx, edx and CTI: je 0064962Ah	6_2_00649610
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00647750 GetKeyboardLayoutList followed by cmp: cmp eax, 0eh and CTI: jc 00647760h country: Hungarian (hu)	6_2_00647750
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00647780 GetKeyboardLayoutList followed by cmp: cmp eax, 21h and CTI: jc 00647790h country: Indonesian (id)	6_2_00647780
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00647D40 GetKeyboardLayoutList followed by cmp: cmp eax, 2eh and CTI: jc 00647D50h country: Upper Sorbian (hsb)	6_2_00647D40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00EF7D40 GetKeyboardLayoutList followed by cmp: cmp eax, 2eh and CTI: jc 00EF7D50h country: Upper Sorbian (hsb)	7_2_00EF7D40
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00EF9610 GetKeyboardLayoutList followed by cmp: cmp ecx, edx and CTI: je 00EF962Ah	7_2_00EF9610
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00EF7780 GetKeyboardLayoutList followed by cmp: cmp eax, 21h and CTI: jc 00EF7790h country: Indonesian (id)	7_2_00EF7780
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00EF7750 GetKeyboardLayoutList followed by cmp: cmp eax, 0eh and CTI: jc 00EF7760h country: Hungarian (hu)	7_2_00EF7750

Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000009.00000002.2909193362.000000000115E000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: RageMP131.exe, 00000009.00000002.2907853014.0000000000DBE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}6Y
Source: LisectAVT_2403002A_151.exe, 00000000.00000002.2909714951.00000000012FC000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}hZ7
Source: RageMP131.exe, 00000009.00000003.1907381206.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: RageMP131.exe, 00000007.00000002.2910091238.000000000146E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: RageMP131.exe, 00000009.00000002.2907853014.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: scsi#disk&ven_vmware&pro
Source: MPGPH131.exe, 00000005.00000002.2909594920.00000000010FC000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}0
Source: RageMP131.exe, 00000007.00000002.2910091238.000000000145C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlla
Source: MPGPH131.exe, 00000006.00000002.2909798840.0000000000B18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}n
Source: LisectAVT_2403002A_151.exe, 00000000.00000002.2909823323.000000000133E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000002.2907853014.0000000000DBE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: RageMP131.exe, 00000009.00000002.2907853014.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}rX
Source: LisectAVT_2403002A_151.exe, 00000000.00000002.2909823323.000000000133E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: RageMP131.exe, 00000007.00000002.2910091238.000000000145C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000nes\AppData\Local\Temp\heidiN
Source: RageMP131.exe, 00000007.00000002.2910091238.0000000001420000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000g
Source: MPGPH131.exe, 00000005.00000002.2909692267.00000000012FD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllw
Source: MPGPH131.exe, 00000005.00000002.2909692267.000000000133D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 00000006.00000002.2909798840.0000000000B18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&k8
Source: RageMP131.exe, 00000009.00000003.1907381206.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}sX
Source: RageMP131.exe, 00000009.00000002.2907853014.0000000000DBE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&QY
Source: MPGPH131.exe, 00000006.00000002.2909798840.0000000000B52000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_B35512B6
Source: MPGPH131.exe, 00000006.00000002.2909798840.0000000000B18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllF
Source: MPGPH131.exe, 00000005.00000002.2909692267.00000000012FD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000nes\AppData\Local\Temp\heidiv
Source: RageMP131.exe, 00000007.00000002.2910091238.000000000146E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_B35512B6
Source: LisectAVT_2403002A_151.exe, 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000009.00000002.2909193362.000000000115E000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: LisectAVT_2403002A_151.exe, 00000000.00000002.2909823323.000000000137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}6
Source: MPGPH131.exe, 00000005.00000002.2909692267.00000000012FD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000

Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe

Code function: 0_2_009D9F50 LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,

0_2_009D9F50

Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_009D5B90 mov ecx, dword ptr fs:[00000030h]	0_2_009D5B90
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_009DC0A0 mov eax, dword ptr fs:[00000030h]	0_2_009DC0A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_009DC0A0 mov eax, dword ptr fs:[00000030h]	0_2_009DC0A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_009D4100 mov eax, dword ptr fs:[00000030h]	0_2_009D4100
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_009DC0A0 mov eax, dword ptr fs:[00000030h]	0_2_009DC0A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_009D5498 mov eax, dword ptr fs:[00000030h]	0_2_009D5498
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_009DC0A0 mov eax, dword ptr fs:[00000030h]	0_2_009DC0A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_009D57B8 mov eax, dword ptr fs:[00000030h]	0_2_009D57B8
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_009D48E0 mov eax, dword ptr fs:[00000030h]	0_2_009D48E0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_009D48E0 mov eax, dword ptr fs:[00000030h]	0_2_009D48E0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_009D48E0 mov eax, dword ptr fs:[00000030h]	0_2_009D48E0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_009D48E0 mov eax, dword ptr fs:[00000030h]	0_2_009D48E0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_009D48E0 mov eax, dword ptr fs:[00000030h]	0_2_009D48E0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_009D48E0 mov eax, dword ptr fs:[00000030h]	0_2_009D48E0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_009D48E0 mov eax, dword ptr fs:[00000030h]	0_2_009D48E0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_009D48E0 mov eax, dword ptr fs:[00000030h]	0_2_009D48E0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_009D48E0 mov eax, dword ptr fs:[00000030h]	0_2_009D48E0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_009D48E0 mov eax, dword ptr fs:[00000030h]	0_2_009D48E0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_009D48E0 mov eax, dword ptr fs:[00000030h]	0_2_009D48E0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_009D48E0 mov eax, dword ptr fs:[00000030h]	0_2_009D48E0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_009DC0A0 mov eax, dword ptr fs:[00000030h]	0_2_009DC0A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Code function: 0_2_009D4DC9 mov eax, dword ptr fs:[00000030h]	0_2_009D4DC9
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005F48E0 mov eax, dword ptr fs:[00000030h]	5_2_005F48E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005F48E0 mov eax, dword ptr fs:[00000030h]	5_2_005F48E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005F48E0 mov eax, dword ptr fs:[00000030h]	5_2_005F48E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005F48E0 mov eax, dword ptr fs:[00000030h]	5_2_005F48E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005F48E0 mov eax, dword ptr fs:[00000030h]	5_2_005F48E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005F48E0 mov eax, dword ptr fs:[00000030h]	5_2_005F48E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005F48E0 mov eax, dword ptr fs:[00000030h]	5_2_005F48E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005F48E0 mov eax, dword ptr fs:[00000030h]	5_2_005F48E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005F48E0 mov eax, dword ptr fs:[00000030h]	5_2_005F48E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005F48E0 mov eax, dword ptr fs:[00000030h]	5_2_005F48E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005F48E0 mov eax, dword ptr fs:[00000030h]	5_2_005F48E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005F48E0 mov eax, dword ptr fs:[00000030h]	5_2_005F48E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005FC0A0 mov eax, dword ptr fs:[00000030h]	5_2_005FC0A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005FC0A0 mov eax, dword ptr fs:[00000030h]	5_2_005FC0A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005F4100 mov eax, dword ptr fs:[00000030h]	5_2_005F4100
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005FC0A0 mov eax, dword ptr fs:[00000030h]	5_2_005FC0A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005FC0A0 mov eax, dword ptr fs:[00000030h]	5_2_005FC0A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005F5498 mov eax, dword ptr fs:[00000030h]	5_2_005F5498
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005F4DC9 mov eax, dword ptr fs:[00000030h]	5_2_005F4DC9
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005FC0A0 mov eax, dword ptr fs:[00000030h]	5_2_005FC0A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005F57B8 mov eax, dword ptr fs:[00000030h]	5_2_005F57B8
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005F5B90 mov ecx, dword ptr fs:[00000030h]	6_2_005F5B90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005FC0A0 mov eax, dword ptr fs:[00000030h]	6_2_005FC0A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005FC0A0 mov eax, dword ptr fs:[00000030h]	6_2_005FC0A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005F4100 mov eax, dword ptr fs:[00000030h]	6_2_005F4100
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005FC0A0 mov eax, dword ptr fs:[00000030h]	6_2_005FC0A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005F5498 mov eax, dword ptr fs:[00000030h]	6_2_005F5498
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005FC0A0 mov eax, dword ptr fs:[00000030h]	6_2_005FC0A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005F57B8 mov eax, dword ptr fs:[00000030h]	6_2_005F57B8
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005F48E0 mov eax, dword ptr fs:[00000030h]	6_2_005F48E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005F48E0 mov eax, dword ptr fs:[00000030h]	6_2_005F48E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005F48E0 mov eax, dword ptr fs:[00000030h]	6_2_005F48E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005F48E0 mov eax, dword ptr fs:[00000030h]	6_2_005F48E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005F48E0 mov eax, dword ptr fs:[00000030h]	6_2_005F48E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005F48E0 mov eax, dword ptr fs:[00000030h]	6_2_005F48E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005F48E0 mov eax, dword ptr fs:[00000030h]	6_2_005F48E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005F48E0 mov eax, dword ptr fs:[00000030h]	6_2_005F48E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005F48E0 mov eax, dword ptr fs:[00000030h]	6_2_005F48E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005F48E0 mov eax, dword ptr fs:[00000030h]	6_2_005F48E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005F48E0 mov eax, dword ptr fs:[00000030h]	6_2_005F48E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005F48E0 mov eax, dword ptr fs:[00000030h]	6_2_005F48E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005FC0A0 mov eax, dword ptr fs:[00000030h]	6_2_005FC0A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005F4DC9 mov eax, dword ptr fs:[00000030h]	6_2_005F4DC9
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00EA48E0 mov eax, dword ptr fs:[00000030h]	7_2_00EA48E0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00EA48E0 mov eax, dword ptr fs:[00000030h]	7_2_00EA48E0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00EA48E0 mov eax, dword ptr fs:[00000030h]	7_2_00EA48E0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00EA48E0 mov eax, dword ptr fs:[00000030h]	7_2_00EA48E0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00EA48E0 mov eax, dword ptr fs:[00000030h]	7_2_00EA48E0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00EA48E0 mov eax, dword ptr fs:[00000030h]	7_2_00EA48E0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00EA48E0 mov eax, dword ptr fs:[00000030h]	7_2_00EA48E0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00EA48E0 mov eax, dword ptr fs:[00000030h]	7_2_00EA48E0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00EA48E0 mov eax, dword ptr fs:[00000030h]	7_2_00EA48E0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00EA48E0 mov eax, dword ptr fs:[00000030h]	7_2_00EA48E0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00EA48E0 mov eax, dword ptr fs:[00000030h]	7_2_00EA48E0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00EA48E0 mov eax, dword ptr fs:[00000030h]	7_2_00EA48E0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00EAC0A0 mov eax, dword ptr fs:[00000030h]	7_2_00EAC0A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00EA4100 mov eax, dword ptr fs:[00000030h]	7_2_00EA4100
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00EAC0A0 mov eax, dword ptr fs:[00000030h]	7_2_00EAC0A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00EAC0A0 mov eax, dword ptr fs:[00000030h]	7_2_00EAC0A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00EAC0A0 mov eax, dword ptr fs:[00000030h]	7_2_00EAC0A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00EA5498 mov eax, dword ptr fs:[00000030h]	7_2_00EA5498
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00EA4DC9 mov eax, dword ptr fs:[00000030h]	7_2_00EA4DC9
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00EAC0A0 mov eax, dword ptr fs:[00000030h]	7_2_00EAC0A0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00EA57B8 mov eax, dword ptr fs:[00000030h]	7_2_00EA57B8

Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe

Code function: 0_2_009D4400 cpuid

0_2_009D4400

Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe

Code function: 0_2_00A9F26A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_00A9F26A

Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe

Code function: 0_2_009D7DC0 GetUserNameA,GetFileAttributesA,__Mtx_unlock,__Mtx_unlock,CopyFileA,RegOpenKeyExA,RegSetValueExA,GetFileAttributesA,__Mtx_unlock,__Mtx_unlock,CopyFileA,

0_2_009D7DC0

Source: C:\Users\user\Desktop\LisectAVT_2403002A_151.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected RisePro Stealer

Source: Yara match	File source: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1655205420.0000000004DC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1894436988.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.1713791639.0000000004B60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1715659153.0000000004320000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2908237269.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1808878932.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_151.exe PID: 6456, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 5804, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 2932, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7196, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7456, type: MEMORYSTR

Remote Access Functionality

Yara detected RisePro Stealer

Source: Yara match	File source: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1655205420.0000000004DC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1894436988.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.1713791639.0000000004B60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1715659153.0000000004320000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2908237269.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1808878932.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_151.exe PID: 6456, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 5804, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 2932, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7196, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7456, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	2 Virtualization/Sandbox Evasion	LSASS Memory	311 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 Process Injection	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	233 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
LisectAVT_2403002A_151.exe	100%	Avira	TR/Crypt.TPM.Gen
LisectAVT_2403002A_151.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.winimage.com/zLibDll	0%	URL Reputation	safe
https://ipinfo.io/	0%	URL Reputation	safe
https://t.me/RiseProSUPPORT	0%	Avira URL Cloud	safe
https://www.maxmind.com/en/locate-my-ip-address	0%	Avira URL Cloud	safe
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORT2	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	LisectAVT_2403002A_151.exe, 00000000.00000003.1655205420.0000000004DC0000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002A_151.exe, 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000005.00000003.1713791639.0000000004B60000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1715659153.0000000004320000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000003.1808878932.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000003.1894436988.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000002.2908237269.0000000000E91000.00000040.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDll	MPGPH131.exe, MPGPH131.exe, 00000006.00000003.1715659153.0000000004320000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000003.1808878932.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000003.1894436988.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000002.2908237269.0000000000E91000.00000040.00000001.01000000.00000005.sdmp	false	URL Reputation: safe	unknown
https://t.me/RiseProSUPPORT	RageMP131.exe, 00000009.00000002.2907853014.0000000000D98000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/	MPGPH131.exe, RageMP131.exe	false	URL Reputation: safe	unknown
https://t.me/RiseProSUPPORT2	MPGPH131.exe, 00000006.00000002.2909798840.0000000000B18000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.maxmind.com/en/locate-my-ip-address	MPGPH131.exe, RageMP131.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.233.132.62	unknown	Russian Federation		2895	FREE-NET-ASFREEnetEU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1482488
Start date and time:	2024-07-25 23:41:34 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LisectAVT_2403002A_151.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@11/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: LisectAVT_2403002A_151.exe

Simulations

Behavior and APIs

Time	Type	Description
17:42:55	API Interceptor	1811859x Sleep call for process: LisectAVT_2403002A_151.exe modified
17:43:01	API Interceptor	3379x Sleep call for process: MPGPH131.exe modified
17:43:10	API Interceptor	1526777x Sleep call for process: RageMP131.exe modified
22:42:28	Task Scheduler	Run new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
22:42:28	Task Scheduler	Run new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
22:42:30	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
22:42:38	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.233.132.62	SecuriteInfo.com.Win32.PWSX-gen.14899.4987.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	193.233.132.62:57893/hera/amadka.exe
	SecuriteInfo.com.Win32.PWSX-gen.580.27252.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	193.233.132.62:57893/hera/amadka.exe
	SecuriteInfo.com.Win32.PWSX-gen.15960.19323.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	193.233.132.62:57893/hera/amadka.exe
	9iz0QM9rMM.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	193.233.132.62:57893/hera/amadka.exe
	4fMLTRkOfB.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	193.233.132.62:57893/hera/amadka.exe
	q7a5JOlhLZ.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	193.233.132.62:57893/hera/amadka.exe
	7jv1U7CgKF.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	193.233.132.62:57893/hera/amadka.exe
	file.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	193.233.132.62:57893/hera/amadka.exe
	SecuriteInfo.com.Win32.PWSX-gen.10022.32492.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	193.233.132.62:57893/hera/amadka.exe
	file.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	193.233.132.62:57893/hera/amadka.exe

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FREE-NET-ASFREEnetEU	LisectAVT_2403002A_163.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.74
	LisectAVT_2403002A_185.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.74
	LisectAVT_2403002A_191.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.62
	LisectAVT_2403002A_218.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.74
	LisectAVT_2403002A_228.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.74
	LisectAVT_2403002A_30.exe	Get hash	malicious	Amadey	Browse	193.233.132.56
	LisectAVT_2403002A_33.exe	Get hash	malicious	Amadey	Browse	193.233.132.56
	LisectAVT_2403002A_376.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.74
	LisectAVT_2403002A_389.exe	Get hash	malicious	Amadey	Browse	193.233.132.56
	LisectAVT_2403002A_419.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.67

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_151.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3193864
Entropy (8bit):	6.666134011697499
Encrypted:	false
SSDEEP:	49152:UHXp7rU8ffCFoGysq/4iNmPP/n6sfFS9ATuTse7lWxN:U5c8ffCFoTsqAiM3/n/XtUlQ
MD5:	A528D71182717541346487642BB54DD2
SHA1:	7C9B47714DFCE098237D5DF9381FCBE1D856F41D
SHA-256:	F4880369EC64EBB35BBF6231F9275D82A878E6C3CDFB75468EA1D529B895892D
SHA-512:	3C1528C17274B79E087684DF0B996EECDAA32F675C94B1626240E28C5BF4D78721E297D86DC081C62C127C6203724DE26B643E31064DA690E4396B6C9C2EEAF3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$......."...f.{Tf.{Tf.{T-.xUk.{T-.~U..{T-.\|Ug.{T)..Tb.{T)..Ut.{T).xUq.{T).~U3.{T-..U..{T-.}Ug.{T-.zU}.{Tf.zT@.{T..rUz.{T..{Ug.{T...Tg.{Tf..Tg.{T..yUg.{TRichf.{T................PE..L.....e...............".....0.......0;...........@..........................`;......T1...@...........................;.L...m...........X+.......................................................................................................... . .p..........................@....rsrc...X+.......,..................@....idata .............B..............@...qzmhftlj.`'......T'..D..............@...bkynihaq..... ;.......0.............@....taggant.0...0;.."....0.............@...........................................................................................................................................................................................................................

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_151.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_151.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3193864
Entropy (8bit):	6.666134011697499
Encrypted:	false
SSDEEP:	49152:UHXp7rU8ffCFoGysq/4iNmPP/n6sfFS9ATuTse7lWxN:U5c8ffCFoTsqAiM3/n/XtUlQ
MD5:	A528D71182717541346487642BB54DD2
SHA1:	7C9B47714DFCE098237D5DF9381FCBE1D856F41D
SHA-256:	F4880369EC64EBB35BBF6231F9275D82A878E6C3CDFB75468EA1D529B895892D
SHA-512:	3C1528C17274B79E087684DF0B996EECDAA32F675C94B1626240E28C5BF4D78721E297D86DC081C62C127C6203724DE26B643E31064DA690E4396B6C9C2EEAF3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$......."...f.{Tf.{Tf.{T-.xUk.{T-.~U..{T-.\|Ug.{T)..Tb.{T)..Ut.{T).xUq.{T).~U3.{T-..U..{T-.}Ug.{T-.zU}.{Tf.zT@.{T..rUz.{T..{Ug.{T...Tg.{Tf..Tg.{T..yUg.{TRichf.{T................PE..L.....e...............".....0.......0;...........@..........................`;......T1...@...........................;.L...m...........X+.......................................................................................................... . .p..........................@....rsrc...X+.......,..................@....idata .............B..............@...qzmhftlj.`'......T'..D..............@...bkynihaq..... ;.......0.............@....taggant.0...0;.."....0.............@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_151.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_151.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	13
Entropy (8bit):	2.66122625626979
Encrypted:	false
SSDEEP:	3:LEYP:X
MD5:	F289676D32BF503D94A48E99F6B621B7
SHA1:	E5DF0C0E372CDAF03440C8862C6070B41640D8C4
SHA-256:	67C98213012F8EAD0DCE0792E05A28CBC899CAA652B475415075EF73BF85A4EA
SHA-512:	8F4B99795A7842A230CC663C1A774921A3552EB2DF2FEE55B6D284185F185A2D30FFDA5E71D7DC6E2DC0B79034FA0DC808AE4F39DC5EC91B82408B40DDAE7EC7
Malicious:	false
Preview:	1721949717833

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.666134011697499
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	LisectAVT_2403002A_151.exe
File size:	3'193'864 bytes
MD5:	a528d71182717541346487642bb54dd2
SHA1:	7c9b47714dfce098237d5df9381fcbe1d856f41d
SHA256:	f4880369ec64ebb35bbf6231f9275d82a878e6c3cdfb75468ea1d529b895892d
SHA512:	3c1528c17274b79e087684df0b996eecdaa32f675c94b1626240e28c5bf4d78721e297d86dc081c62c127c6203724de26b643e31064da690e4396b6c9c2eeaf3
SSDEEP:	49152:UHXp7rU8ffCFoGysq/4iNmPP/n6sfFS9ATuTse7lWxN:U5c8ffCFoTsqAiM3/n/XtUlQ
TLSH:	CEE57EA2F505B2CFE5CF17784167CE82695D0BB9472089C3986C74BABDB7CC115BAC28
File Content Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$......."...f.{Tf.{Tf.{T-.xUk.{T-.~U..{T-.\|Ug.{T)..Tb.{T)..Ut.{T).xUq.{T).~U3.{T-..U..{T-.}Ug.{T-.zU}.{Tf.zT@.{T..rUz.{T..{Ug.{T...Tg.{

File Icon


Icon Hash:	c769eccc64f6e2bb

Static PE Info

General

Entrypoint:	0x7b3000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x65FE94C6 [Sat Mar 23 08:37:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	baa93d47220682c04d92f7797d9224ce

Entrypoint Preview

Instruction
jmp 00007F486126435Ah
setp byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x3b11b8	0x4c	qzmhftlj
IMAGE_DIRECTORY_ENTRY_IMPORT	0x13b06d	0x95	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x138000	0x2b58	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x13b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x137000	0x90600	3ff3975b52a6263266e3466c46b9da0b	False	0.9991561823593074	OpenPGP Secret Key	7.983746449936841	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x138000	0x2b58	0x2c00	b606861556e06d174e42b11831f5e5db	False	0.22487571022727273	data	3.9665421773066165	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x13b000	0x1000	0x200	37f5282c0fa356b1e50be5becbf91e72	False	0.181640625	data	1.3087225765280863	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qzmhftlj	0x13c000	0x276000	0x275400	54ad86fc5dab3d40281d9c652556627e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
bkynihaq	0x3b2000	0x1000	0x200	f19573cbb9dea92408db637454855fb8	False	0.50390625	data	3.9591367366889094	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x3b3000	0x3000	0x2200	42ba1ccc62328903cb8fb1ac8deb2b68	False	0.006548713235294118	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x138418	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Russian	Russia	0.1892116182572614
RT_GROUP_ICON	0x13a9c0	0x14	data	Russian	Russia	1.15
RT_VERSION	0x138130	0x2e4	data	Russian	Russia	0.4689189189189189
RT_MANIFEST	0x13a9d8	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy
comctl32.dll	InitCommonControls

Exports

Name	Ordinal	Address
Start	1	0x466e80

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-25T23:42:32.818118+0200	TCP	2049060	ET MALWARE RisePro TCP Heartbeat Packet	49731	58709	192.168.2.4	193.233.132.62
2024-07-25T23:42:46.250615+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49734	40.68.123.157	192.168.2.4
2024-07-25T23:42:27.536551+0200	TCP	2049060	ET MALWARE RisePro TCP Heartbeat Packet	49730	58709	192.168.2.4	193.233.132.62
2024-07-25T23:42:35.811823+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49731	58709	192.168.2.4	193.233.132.62
2024-07-25T23:42:35.811723+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49732	58709	192.168.2.4	193.233.132.62
2024-07-25T23:42:30.525266+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49730	58709	192.168.2.4	193.233.132.62
2024-07-25T23:42:53.202466+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49740	58709	192.168.2.4	193.233.132.62
2024-07-25T23:42:45.437263+0200	TCP	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	49733	58709	192.168.2.4	193.233.132.62
2024-07-25T23:43:26.815937+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49741	40.68.123.157	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 23:42:27.519278049 CEST	49730	58709	192.168.2.4	193.233.132.62
Jul 25, 2024 23:42:27.524693966 CEST	58709	49730	193.233.132.62	192.168.2.4
Jul 25, 2024 23:42:27.524842024 CEST	49730	58709	192.168.2.4	193.233.132.62
Jul 25, 2024 23:42:27.536550999 CEST	49730	58709	192.168.2.4	193.233.132.62
Jul 25, 2024 23:42:27.541858912 CEST	58709	49730	193.233.132.62	192.168.2.4
Jul 25, 2024 23:42:30.525265932 CEST	49730	58709	192.168.2.4	193.233.132.62
Jul 25, 2024 23:42:30.530371904 CEST	58709	49730	193.233.132.62	192.168.2.4
Jul 25, 2024 23:42:32.790724993 CEST	49731	58709	192.168.2.4	193.233.132.62
Jul 25, 2024 23:42:32.791390896 CEST	49732	58709	192.168.2.4	193.233.132.62
Jul 25, 2024 23:42:32.795874119 CEST	58709	49731	193.233.132.62	192.168.2.4
Jul 25, 2024 23:42:32.795984030 CEST	49731	58709	192.168.2.4	193.233.132.62
Jul 25, 2024 23:42:32.796241045 CEST	58709	49732	193.233.132.62	192.168.2.4
Jul 25, 2024 23:42:32.796303034 CEST	49732	58709	192.168.2.4	193.233.132.62
Jul 25, 2024 23:42:32.818118095 CEST	49732	58709	192.168.2.4	193.233.132.62
Jul 25, 2024 23:42:32.818118095 CEST	49731	58709	192.168.2.4	193.233.132.62
Jul 25, 2024 23:42:32.823560953 CEST	58709	49732	193.233.132.62	192.168.2.4
Jul 25, 2024 23:42:32.824506044 CEST	58709	49731	193.233.132.62	192.168.2.4
Jul 25, 2024 23:42:35.811722994 CEST	49732	58709	192.168.2.4	193.233.132.62
Jul 25, 2024 23:42:35.811822891 CEST	49731	58709	192.168.2.4	193.233.132.62
Jul 25, 2024 23:42:35.816945076 CEST	58709	49732	193.233.132.62	192.168.2.4
Jul 25, 2024 23:42:35.818476915 CEST	58709	49731	193.233.132.62	192.168.2.4
Jul 25, 2024 23:42:42.432673931 CEST	49733	58709	192.168.2.4	193.233.132.62
Jul 25, 2024 23:42:42.437841892 CEST	58709	49733	193.233.132.62	192.168.2.4
Jul 25, 2024 23:42:42.437932014 CEST	49733	58709	192.168.2.4	193.233.132.62
Jul 25, 2024 23:42:42.444668055 CEST	49733	58709	192.168.2.4	193.233.132.62
Jul 25, 2024 23:42:42.449462891 CEST	58709	49733	193.233.132.62	192.168.2.4
Jul 25, 2024 23:42:45.437263012 CEST	49733	58709	192.168.2.4	193.233.132.62
Jul 25, 2024 23:42:45.498663902 CEST	58709	49733	193.233.132.62	192.168.2.4
Jul 25, 2024 23:42:48.905076027 CEST	58709	49730	193.233.132.62	192.168.2.4
Jul 25, 2024 23:42:48.905220985 CEST	49730	58709	192.168.2.4	193.233.132.62
Jul 25, 2024 23:42:50.195204973 CEST	49740	58709	192.168.2.4	193.233.132.62
Jul 25, 2024 23:42:50.200809002 CEST	58709	49740	193.233.132.62	192.168.2.4
Jul 25, 2024 23:42:50.200906038 CEST	49740	58709	192.168.2.4	193.233.132.62
Jul 25, 2024 23:42:50.207904100 CEST	49740	58709	192.168.2.4	193.233.132.62
Jul 25, 2024 23:42:50.213340998 CEST	58709	49740	193.233.132.62	192.168.2.4
Jul 25, 2024 23:42:53.202466011 CEST	49740	58709	192.168.2.4	193.233.132.62
Jul 25, 2024 23:42:53.207403898 CEST	58709	49740	193.233.132.62	192.168.2.4
Jul 25, 2024 23:42:54.182534933 CEST	58709	49732	193.233.132.62	192.168.2.4
Jul 25, 2024 23:42:54.182650089 CEST	49732	58709	192.168.2.4	193.233.132.62
Jul 25, 2024 23:42:54.183665991 CEST	58709	49731	193.233.132.62	192.168.2.4
Jul 25, 2024 23:42:54.183854103 CEST	49731	58709	192.168.2.4	193.233.132.62
Jul 25, 2024 23:43:03.839595079 CEST	58709	49733	193.233.132.62	192.168.2.4
Jul 25, 2024 23:43:03.839826107 CEST	49733	58709	192.168.2.4	193.233.132.62
Jul 25, 2024 23:43:11.585432053 CEST	58709	49740	193.233.132.62	192.168.2.4
Jul 25, 2024 23:43:11.585582018 CEST	49740	58709	192.168.2.4	193.233.132.62

Target ID:	0
Start time:	17:42:23
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\LisectAVT_2403002A_151.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LisectAVT_2403002A_151.exe"
Imagebase:	0x9c0000
File size:	3'193'864 bytes
MD5 hash:	A528D71182717541346487642BB54DD2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000003.1655205420.0000000004DC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	17:42:26
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0xcc0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:42:26
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:42:26
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0xcc0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:42:26
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:42:28
Start date:	25/07/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x5e0000
File size:	3'193'864 bytes
MD5 hash:	A528D71182717541346487642BB54DD2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000005.00000003.1713791639.0000000004B60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	17:42:28
Start date:	25/07/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x5e0000
File size:	3'193'864 bytes
MD5 hash:	A528D71182717541346487642BB54DD2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000006.00000003.1715659153.0000000004320000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	17:42:38
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0xe90000
File size:	3'193'864 bytes
MD5 hash:	A528D71182717541346487642BB54DD2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000003.1808878932.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	17:42:47
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0xe90000
File size:	3'193'864 bytes
MD5 hash:	A528D71182717541346487642BB54DD2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000009.00000003.1894436988.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000009.00000002.2908237269.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	40.5%
Total number of Nodes:	893
Total number of Limit Nodes:	115

Executed Functions

Function 009D7DC0 Relevance: 26.8, APIs: 11, Strings: 3, Instructions: 2344registryfileCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,00000104,?,?,?), ref: 009D8006
GetFileAttributesA.KERNELBASE(?,00000001,?,?,?,?), ref: 009D815D
__Mtx_unlock.LIBCPMT ref: 009D8186
__Mtx_unlock.LIBCPMT ref: 009D8195
CopyFileA.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,0000005D), ref: 009D8442
RegOpenKeyExA.KERNELBASE(80000001,E0F5FDC2,00000000,00020006,00000000), ref: 009D8500
RegSetValueExA.KERNELBASE(00000000,?,00000000,00000001,?,?), ref: 009D8537
GetFileAttributesA.KERNELBASE(?,00000001,?,?,?,?,?,?), ref: 009D8751
__Mtx_unlock.LIBCPMT ref: 009D877A

Part of subcall function 00A306C0: Concurrency::cancel_current_task.LIBCPMT ref: 00A30807

__Mtx_unlock.LIBCPMT ref: 009D87D7
CopyFileA.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 009D8AF9

Strings

131, xrefs: 009D7E37, 009D7E3E, 009D7E44, 009D7EB2, 009D7EB9, 009D7EBF, 009D7F2A, 009D7F31, 009D7F37, 009D9A45, 009D9A4C, 009D9A52
+, xrefs: 009D9B19
\, xrefs: 009D8896

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: FileMtx_unlock$AttributesCopy$Concurrency::cancel_current_taskNameOpenUserValue
String ID: +$131$\
API String ID: 816876003-78135455
Opcode ID: 034e1c1973b88fb30e6f4138663eb80e1fda18ba8439b9b3641ec5e54a3f97f4
Instruction ID: db646e14ae80bc6770e6edc364ec0d4cb071ec237277d6f6c1e6725441e54125
Opcode Fuzzy Hash: 034e1c1973b88fb30e6f4138663eb80e1fda18ba8439b9b3641ec5e54a3f97f4
Instruction Fuzzy Hash: 8C237D709002598FDB28DF68CD94BEEBBB5AF45304F1481EEE409AB382D7719A85CF51

Function 009D5B90 Relevance: 18.2, APIs: 5, Strings: 4, Instructions: 2429processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,?,?,?,?), ref: 009D5CBF

Strings

131, xrefs: 009D6037, 009D603E, 009D6044, 009D60BA, 009D60C1, 009D60C7, 009D613A, 009D6141, 009D6147
\, xrefs: 009D69E5
*, xrefs: 009D7A17
D, xrefs: 009D5BCD

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: *$131$D$\
API String ID: 963392458-1470618592
Opcode ID: 0f1809c3d434f70356b7d77246aec50dca41a62f43da190398fd94a0f742d478
Instruction ID: a5bca5a22f466ec471d0ca7153340ac8f5172cf5f46f2b8ade9ee5cc3394a37d
Opcode Fuzzy Hash: 0f1809c3d434f70356b7d77246aec50dca41a62f43da190398fd94a0f742d478
Instruction Fuzzy Hash: E4239F709042598FDB18CF68CC94BEDBBB5AF09304F1481EED449AB382E7759A85CF91

Function 009CB6A0 Relevance: 14.8, APIs: 4, Strings: 4, Instructions: 840
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,C0D5DDC2,00000000,00020019,00000000,FAF8FCC4,FAF8FCC5), ref: 009CB947

Strings

_, xrefs: 009CBAC6
_, xrefs: 009CBB32
:, xrefs: 009CB443
_, xrefs: 009CBB25

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: Open
String ID: :$_$_$_
API String ID: 71445658-4119709311
Opcode ID: 3e37df9ee472a7be6f308664dfb44132c577ea80b726c7eabe368cb3425df6b9
Instruction ID: 08e1f58c70529c87f88f8a56dec25c85b72794855a219343724b362791038605
Opcode Fuzzy Hash: 3e37df9ee472a7be6f308664dfb44132c577ea80b726c7eabe368cb3425df6b9
Instruction Fuzzy Hash: 0F72C3B0D002599FDF18CF68CC85BEEBBB5AF45304F1481ADE449AB282D7749A85CF61

Function 009DE0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 009DE0CB
socket.WS2_32(?,?,?,?,?,?,00AF7320,?,?,?,?,?,?), ref: 009DE17F
connect.WS2_32(00000000,?,00000000,?,?,?,00AF7320,?,?,?,?,?,?), ref: 009DE193
closesocket.WS2_32(00000000), ref: 009DE19E

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: 50e87fa983c314c57accca48556bc0cd06cdf2c2fbb1d075e3c84405af64b4eb
Instruction ID: a3b48a49e3befaafe3d167f29256fa542e6dece079865463c2ef6b4e4c0cefad
Opcode Fuzzy Hash: 50e87fa983c314c57accca48556bc0cd06cdf2c2fbb1d075e3c84405af64b4eb
Instruction Fuzzy Hash: 9F31B6717493005FE7209F65884872BB7E8EB86764F004F1EF9A8963D0D37599044BA2

Function 009D8C58 Relevance: 3.6, Strings: 2, Instructions: 1132COMMON

Download Yara Rule

Strings

131, xrefs: 009D9A45, 009D9A4C, 009D9A52
+, xrefs: 009D9B19

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID:
String ID: +$131
API String ID: 0-3749657548
Opcode ID: 13130e6c882094c9d7f852cd9ca2af88249f41f397924823f83a14ea271f55eb
Instruction ID: ebd95b6a9757bf7370ef1699f9df3a23e44993c0926030032aefe8eaa1b7bef1
Opcode Fuzzy Hash: 13130e6c882094c9d7f852cd9ca2af88249f41f397924823f83a14ea271f55eb
Instruction Fuzzy Hash: 53B26C70D002598FDB28DF28CD987DDBBB5AF49304F1482EAD409AB782D7759A85CF90

Function 009D9259 Relevance: 3.3, Strings: 2, Instructions: 787COMMON

Download Yara Rule

Strings

131, xrefs: 009D9A45, 009D9A4C, 009D9A52
+, xrefs: 009D9B19

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID:
String ID: +$131
API String ID: 0-3749657548
Opcode ID: c40e115326674d6298e014117a5b5866911f56e4811afbed0c09d9dff8e054cf
Instruction ID: 1f5d2ef0122abed7b084c1617704a7dfb7f432f373365a2aecc03f8e7c8b04d3
Opcode Fuzzy Hash: c40e115326674d6298e014117a5b5866911f56e4811afbed0c09d9dff8e054cf
Instruction Fuzzy Hash: F6729D709002598FDB18DF68CD98BEDBBB5AF45304F2482EED019AB782D7749A85CF50

Function 00A3A520 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 234
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00A3A656

Strings

pected , xrefs: 00A3A564
unexpected , xrefs: 00A3A531

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: pected $unexpected
API String ID: 118556049-356062554
Opcode ID: a488096d346ddb20ad401a233e08d86b5c368dbbab1f4f7ebdf35b9828553d39
Instruction ID: 8df9bf15d2e3d6343c41cc4f4997b2b20c4304e511673dd9ef78d9bacf5a0b48
Opcode Fuzzy Hash: a488096d346ddb20ad401a233e08d86b5c368dbbab1f4f7ebdf35b9828553d39
Instruction Fuzzy Hash: 27515A726001209FDB18EF28DD81A6EB7E5EF95310F24462DF886CB686DB30ED4187D2

Function 009CA690 Relevance: 4.6, APIs: 3, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE ref: 009CA6BF
__Mtx_unlock.LIBCPMT ref: 009CA6EE
__Mtx_unlock.LIBCPMT ref: 009CA733

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$AttributesFile
String ID:
API String ID: 1886074773-0
Opcode ID: 4431b051a9b591b744f1877221082096fe3d1b44a4aca31e4795d0046187f9c3
Instruction ID: 03131cd43c624cc0baed9e7abf51cf07fe0258d778aa8af7ff86981e4ad8f862
Opcode Fuzzy Hash: 4431b051a9b591b744f1877221082096fe3d1b44a4aca31e4795d0046187f9c3
Instruction Fuzzy Hash: 24014991F40129226D34A5B42E86EBF654C88933AC71D4D3AFC41D7347F447CD4041E3

Function 009CA090 Relevance: 3.3, APIs: 2, Instructions: 342
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 009CA1B6
__fread_nolock.LIBCMT ref: 009CA343

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 6ad00d6ebb3e1e3234bc2e7a8cbb054864a5c8b3e6944d5dd940b992d216183e
Instruction ID: a3494f98f19e308f7e98da6387b6597decab6796fc95e15bb319526c902a7ae2
Opcode Fuzzy Hash: 6ad00d6ebb3e1e3234bc2e7a8cbb054864a5c8b3e6944d5dd940b992d216183e
Instruction Fuzzy Hash: 8EB14570900249AFDB18DF28CD45FAFBBE8EF46304F10856DF4059B682D3B49A41CBA2

Function 00AB4623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a66df2477907882cf8fb7e9948232d24ed2e6165096c230851c8824ff3bc262
Instruction ID: 335c36f1baaf5c9b8f4e191d0d660ccfdd978e84ed3d6184eb9877552e74eea7
Opcode Fuzzy Hash: 4a66df2477907882cf8fb7e9948232d24ed2e6165096c230851c8824ff3bc262
Instruction Fuzzy Hash: E6B1C270A04245AFEB11DFE8D981BFEBBB9AF4E310F144158E595AB283C7719D42CB60

Function 00AB549C Relevance: 1.7, APIs: 1, Instructions: 198
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000000,00AA9087,?,00000000,00000000,00000000,?,00000000,?,00A9E5B1,00AA9087,00000000,00A9E5B1,?,?), ref: 00AB5622

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 4898ace1715669549befadd0c57a55357d572d95517a41dc8949598f6f996009
Instruction ID: 6f71359e009e5083f3ab8bb404bc8f2ce0f292f88ef7c3e9218436aa4c556c32
Opcode Fuzzy Hash: 4898ace1715669549befadd0c57a55357d572d95517a41dc8949598f6f996009
Instruction Fuzzy Hash: 8D618A71D04519AFDF11DFB8C984BEEBBBEAB49304F180149E804A7256D372DA128BA0

Function 00AA4942 Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae92c7eb9fb5b618f69f2520a7a31f5119956e42bddec90398092efef3457ba0
Instruction ID: 9df91193ad47d8e328cc5e64cf055d7c8224324f92d6d42b1705999b0131d1c4
Opcode Fuzzy Hash: ae92c7eb9fb5b618f69f2520a7a31f5119956e42bddec90398092efef3457ba0
Instruction Fuzzy Hash: 4451C870A00108AFDF14CF58CC41AAABFB5EF8E354F248159F8499B292D3B1DE51CB94

Function 00A30560 Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00A306AE

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 704878a6fb962aec51445f9c7907984ce5d7d965d91800b1a8fb89f3cbd27ced
Instruction ID: 1ad68154c4365241c4c180f7a32d4147a4daf80eac10e96cbc092814763ec26a
Opcode Fuzzy Hash: 704878a6fb962aec51445f9c7907984ce5d7d965d91800b1a8fb89f3cbd27ced
Instruction Fuzzy Hash: 5E410472A002189FCB15DF68DD91AAEBBE5AF89310F144169FC05EB346D770DE608BE1

Function 00AB4B12 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,00AB49F9,00000000,CF830579,00AF1140,0000000C,00AB4AB5,00AA8BBD,?), ref: 00AB4B69

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 87cb92b2ab3e9b794b205cc63b85cea529505bcc1145bcffcb5b6bd405af1164
Instruction ID: 666a185781d370e96541e27518a7ea4c295a0ad99284c358350717f06cdfd1f8
Opcode Fuzzy Hash: 87cb92b2ab3e9b794b205cc63b85cea529505bcc1145bcffcb5b6bd405af1164
Instruction Fuzzy Hash: 1F118E3370412416D72463746951BFE6B4DCBDA770F2A0609FA549B0C3FE31DC424155

Function 00AAE05C Relevance: 1.6, APIs: 1, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00AF0DF8,00A9E5B1,00000002,00A9E5B1,00000000,?,?,?,00AAE166,00000000,?,00A9E5B1,00000002,00AF0DF8), ref: 00AAE099

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 313070b58582bfc98f9b3b3032886fdf3d5952510f0847bb13a37888ec860805
Instruction ID: 305b7e2969cc3eb88c4787ad80fa5b8506d4fb964bfe6fa67d0191c19bebe167
Opcode Fuzzy Hash: 313070b58582bfc98f9b3b3032886fdf3d5952510f0847bb13a37888ec860805
Instruction Fuzzy Hash: 7D012632210155ABCF05CF58CC45DAE3B29DB86330B240248F8909B2D1E7B1ED518BD0

Function 00A9F290 Relevance: 1.6, APIs: 1, Instructions: 51
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 009C220E

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: f1040d02a7b8af5927d359f123d5d53e73013dcd4f601495220b349b61233c9b
Instruction ID: 75ab64f9485b52fe4ffeabe541f52b020d2a8f439af09e1108efcf3d5521558b
Opcode Fuzzy Hash: f1040d02a7b8af5927d359f123d5d53e73013dcd4f601495220b349b61233c9b
Instruction Fuzzy Hash: 9601DB7560430DAFCF14AFA8DC01E9977EC9A01310B544439FA19DB591EB70E9548795

Function 00AB63F3 Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,00A9D6FA,00000004,?,00AB5D79,00000001,00000364,00000004,00000007,000000FF,?,00AA067B,00000002,00000000,?,?), ref: 00AB6435

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 961155da5c835c7716a9c0c6f7e3ab623a8b5d9186aff92a399cbda8b11bf5f5
Instruction ID: 35534e36daa6a7193ed62bfcb7ac61687439c0caf309e813ecc6901361594610
Opcode Fuzzy Hash: 961155da5c835c7716a9c0c6f7e3ab623a8b5d9186aff92a399cbda8b11bf5f5
Instruction Fuzzy Hash: 6BF0E931501924669B216B629F02BEB3B5C9F81764F258011EC0697082CF34D81186F1

Function 00AB6E2D Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000004,00000000,?,00AA067B,00000002,00000000,?,?,?,009C303D,00A9D6FA,00000004,00000000,00A9D6FA), ref: 00AB6E60

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8c3fe27c9d730e36894d9f14d05e3c0335e2990315157532132a127246ac8d43
Instruction ID: 16417ffbf9fa17b5026b0138637c36b2b40b414abd38c74b796ba8e8ac9a5597
Opcode Fuzzy Hash: 8c3fe27c9d730e36894d9f14d05e3c0335e2990315157532132a127246ac8d43
Instruction Fuzzy Hash: 91E0ED3A1006216ADA3123A5CE00BEB765D9F823A0F150520EC46970D3CF28C80087A4

Non-executed Functions

Function 009D9F50 Relevance: 21.6, APIs: 2, Strings: 9, Instructions: 2331injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(00000000,00000000,?,00000218,00000000,00AF4D8C,0000000E,0000003A,?), ref: 009DA1BC
WriteProcessMemory.KERNEL32(00AC6605,00000218,009D9E30,00000110,00000000), ref: 009DA1DB

Strings

., xrefs: 009DAB30
%s|%s, xrefs: 009DA198
131, xrefs: 009DA178, 009DA17F, 009DA190
., xrefs: 009DB0E2
,, xrefs: 009DA5D2
type must be boolean, but is , xrefs: 009DBF3C, 009DBF6D, 009DC02B
$, xrefs: 009DBD6D
:, xrefs: 009DA097
,, xrefs: 009DA6AF

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: MemoryProcessWrite
String ID: $$%s|%s$,$,$.$.$131$:$type must be boolean, but is
API String ID: 3559483778-3347632522
Opcode ID: d5719ba756367e688d188f8598775700cf0ae8ac829fab61975f3020b66565e3
Instruction ID: 8bc1a67c68a09a1eb09a056266cc0ce3ebbc384d07e8c02e522974f8542872ec
Opcode Fuzzy Hash: d5719ba756367e688d188f8598775700cf0ae8ac829fab61975f3020b66565e3
Instruction Fuzzy Hash: C523BE70D40259CFDF24DF68C958BEDBBB4AF05300F1481AAE449AB392DB359A85CF91

Function 00A43F80 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 263libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,DCFDFBC6), ref: 00A440CC
GetProcAddress.KERNEL32(00000000,DCFDFBC6), ref: 00A44116
GetProcAddress.KERNEL32(00000000,DCFDFBC6), ref: 00A4414E
GetProcAddress.KERNEL32(00000000,DCFDFBC6), ref: 00A44196
GetProcAddress.KERNEL32(00000000,DCFDFBC6), ref: 00A441E9

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36, xrefs: 00A44037

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
API String ID: 190572456-383447037
Opcode ID: 8359fe96b08b882d011e327344922773e4e3b01436caf623ae0e8a2baf98a27c
Instruction ID: 12d1c3f1aef296936772a61bb055363159df2285a71087182985ac6543109fa4
Opcode Fuzzy Hash: 8359fe96b08b882d011e327344922773e4e3b01436caf623ae0e8a2baf98a27c
Instruction Fuzzy Hash: EEC13BB08183999FDB04CFA8D495BEDBFF9EF19304F1040AEE845AB652E3744509CB69

Function 009C91A0 Relevance: 9.9, APIs: 2, Strings: 3, Instructions: 1146COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32(00000000,00000128), ref: 009C92B0

Strings

/\/, xrefs: 009C956A, 009C959C
/, xrefs: 009C94E2
\, xrefs: 009C9528

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: NextProcess32
String ID: /$/\/$\
API String ID: 1850201408-1523196992
Opcode ID: 5b6ab1ae438a9043ee5e6223bc86418be68334faa98a8209ce18782eae1bbd12
Instruction ID: 96e2757bcce2a8c4f008d9d8598c4d622ba4a8bb2e13bade7b15e82e141fa3e5
Opcode Fuzzy Hash: 5b6ab1ae438a9043ee5e6223bc86418be68334faa98a8209ce18782eae1bbd12
Instruction Fuzzy Hash: AA921771D002599FDF18CFA8C898BEEFBB9BF45314F1442ADD445AB281E7309A46CB52

Function 009D48E0 Relevance: 7.1, APIs: 4, Instructions: 1131registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(?,C0D5DDC2,00000000,00000000,00000000,00020006,00000000,?,00000000), ref: 009D4A3A

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 857af718fe2d50ebbe441ad4489b88b871ab2e6bd1dae7a5aff6911d6c7b1d97
Instruction ID: fbff3a41bb419b657cb4931cf55e3c063286512168a8688233a93e6c1197d620
Opcode Fuzzy Hash: 857af718fe2d50ebbe441ad4489b88b871ab2e6bd1dae7a5aff6911d6c7b1d97
Instruction Fuzzy Hash: 8CB28770A542A98FDB28CF58C8A4BAEBBB1FF44704F15808ED4496F352D771AA45CF90

Function 00A49880 Relevance: 7.0, Strings: 5, Instructions: 748COMMON

Download Yara Rule

Strings

unknown compression method, xrefs: 00A49A3F, 00A49B22
unknown header flags set, xrefs: 00A49B39
header crc mismatch, xrefs: 00A49FE8
incorrect header check, xrefs: 00A49ADE
invalid window size, xrefs: 00A49ACF

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID:
String ID: header crc mismatch$incorrect header check$invalid window size$unknown compression method$unknown header flags set
API String ID: 0-3633268661
Opcode ID: 15ca366e75fa8c10c254f908ee94aa9492cce4dde3d54722813fb4d1f5fc96c3
Instruction ID: 9e7956d0a63558c0573ad5c2003a7336dd8715a4db41fc44039db14c12ea1133
Opcode Fuzzy Hash: 15ca366e75fa8c10c254f908ee94aa9492cce4dde3d54722813fb4d1f5fc96c3
Instruction Fuzzy Hash: 46628EB8E002149FDB14CF59C5847AEBBF1AFC8304F2881ADD818AB346D735D956CB91

Function 009D6689 Relevance: 6.7, APIs: 1, Strings: 2, Instructions: 1432COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 009D68D0

Strings

\, xrefs: 009D69E5
*, xrefs: 009D7A17

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID: *$\
API String ID: 1418687624-1504634461
Opcode ID: c022c4fa5e122ecf5f927597bb4d891e9c62edd807108eb7e45cb40199314abe
Instruction ID: ac382e2c54958e055d70e493c0d52ce76395f37677ce84baa3db0234365f57ad
Opcode Fuzzy Hash: c022c4fa5e122ecf5f927597bb4d891e9c62edd807108eb7e45cb40199314abe
Instruction Fuzzy Hash: 6DD27B709042598FDB68CF68CD947DDBBB1BF09304F1482EAD449AB382E7749A85CF91

Function 00AA84A0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f97ce6278b5da815f6c389bae476adc5dc884afc24939f4c376b69ad4ad6edd
Instruction ID: 39c395ea247047d93d92e9e3b953af9ffbeb4cc6f809ce1ff5d5acd03843d51f
Opcode Fuzzy Hash: 3f97ce6278b5da815f6c389bae476adc5dc884afc24939f4c376b69ad4ad6edd
Instruction Fuzzy Hash: 03021A71E012199FDF14CFA9C980AAEFBF1FF49314F248269D919E7380DB35A9418B94

Function 009DC0A0 Relevance: 6.3, Strings: 4, Instructions: 1274COMMON

Download Yara Rule

Strings

https://ipinfo.io/, xrefs: 009DCABC
Content-Type: application/x-www-form-urlencoded, xrefs: 009DC1B1, 009DC43F, 009DCDA2
https://www.maxmind.com/en/locate-my-ip-address, xrefs: 009DD28A
C, xrefs: 009DDF64

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: AddressConcurrency::cancel_current_taskProc
String ID: C$Content-Type: application/x-www-form-urlencoded$https://ipinfo.io/$https://www.maxmind.com/en/locate-my-ip-address
API String ID: 3114269349-2400714340
Opcode ID: b64d336c96de62e637af15463609e9fd1197f89b54c21b0a77184c78d593815f
Instruction ID: d926ed43a6c26516750bd5dbd53b56b0b3915fdf8fb9483c1f31182eac5ffec4
Opcode Fuzzy Hash: b64d336c96de62e637af15463609e9fd1197f89b54c21b0a77184c78d593815f
Instruction Fuzzy Hash: 1AC27F70D042689ADF25EB68CD56BEDBB78AF15304F0040E9E54977282EB701F89CF66

Function 00A46C00 Relevance: 3.6, Strings: 2, Instructions: 1073COMMON

Download Yara Rule

Strings

stream error, xrefs: 00A47816
buffer error, xrefs: 00A46D3D

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID:
String ID: buffer error$stream error
API String ID: 0-1018483818
Opcode ID: e21fd3bce77d302f0e81b36522a3e9a510c4b4fe917176cd98be63db006458db
Instruction ID: ca60dba9121cde46521c219018baf8e483ccd18cd8b3767b122badee30fc4a01
Opcode Fuzzy Hash: e21fd3bce77d302f0e81b36522a3e9a510c4b4fe917176cd98be63db006458db
Instruction Fuzzy Hash: 11A26B78A04A42DFCB24CF68D180A6AB7F1FF89304B14866DD4458BB51D734F996CBA2

Function 00A568C0 Relevance: 1.7, APIs: 1, Instructions: 234COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00A56946

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: __allrem
String ID:
API String ID: 2933888876-0
Opcode ID: d68308bb606b7786100e1441d07846ff0e98ad75e9aee0bbeb807362fecbbeb3
Instruction ID: 3169e6ba65b861f2cf4c18b5ea0f3cc86386854d5eb412f30e4e8d31bead8767
Opcode Fuzzy Hash: d68308bb606b7786100e1441d07846ff0e98ad75e9aee0bbeb807362fecbbeb3
Instruction Fuzzy Hash: 10818075A011459FDB08CF9CCC80BAEBBB5AF99300F5480A9ED15EB342D275EE05CB91

Function 00A563D0 Relevance: 1.7, APIs: 1, Instructions: 168COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00A56449

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: __allrem
String ID:
API String ID: 2933888876-0
Opcode ID: fb8d51b74640016ad67efaf679fb633d377aeed372739de2500c462ff0dbf93c
Instruction ID: 3ce1bd2ca1fad1ab1118d478d21b18522f99800154dc85921d452d175ccb235d
Opcode Fuzzy Hash: fb8d51b74640016ad67efaf679fb633d377aeed372739de2500c462ff0dbf93c
Instruction Fuzzy Hash: AA616B716107409FCB28CF6DC88096AFBF5AF95300B548AAEDC86DB752D630E955CB90

Function 00AABEAF Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

0, xrefs: 00AAC01F

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: d1e01285008eef21aaa1c5ee474bf5d9151a34602e4e31146ef491a3a414d072
Instruction ID: 1b5cf49925f47e70933420decf137b31488bac9725f75c6df869d96296f31216
Opcode Fuzzy Hash: d1e01285008eef21aaa1c5ee474bf5d9151a34602e4e31146ef491a3a414d072
Instruction Fuzzy Hash: 41C1CF74A0064ACFEB24CF68C984A7EBBB1AF07320F184619D856976D2D731ED45CF61

Function 00AABB6D Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 00AABCF1

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: c6bb5f23fa7c0b5f510aae38f377518c23ca2af4f7402271d35970703ee522a7
Instruction ID: cee9b13e42bf7d0eef9fc30f2ff0671c06f4b637dd0967937719c2563d313c2e
Opcode Fuzzy Hash: c6bb5f23fa7c0b5f510aae38f377518c23ca2af4f7402271d35970703ee522a7
Instruction Fuzzy Hash: EBB1C57092060A8BCB34CF68C5A5ABEBBB1AF07320F14061ED5529B6D3DB359D05CB71

Function 00A9F26A Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00A9EC78,?,?,?,?,009D40EB,?,009DF5EB), ref: 00A9F283

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 1eaed247c2ff0f98af286f4437f8d3b31abd26ccf42a85c8b90bdc5619756025
Instruction ID: ca757cc8ed4cee6be7c361115e4bcb911f71a84874df7944dc3237922bde63f2
Opcode Fuzzy Hash: 1eaed247c2ff0f98af286f4437f8d3b31abd26ccf42a85c8b90bdc5619756025
Instruction Fuzzy Hash: 15D022327012386B8E01ABD0EC009FD7BA8CA88B90301003AE808AF218CA111C008BC4

Function 00A4F360 Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

-, xrefs: 00A4F3DF

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: ffad52e287b60b8b48c8f6c01dcfbe838c716be90c45fb450b26370899277487
Instruction ID: 0e956080e72c6849a792ad2e0c42bce07732165d13a258eeea7d7ef3ea03e908
Opcode Fuzzy Hash: ffad52e287b60b8b48c8f6c01dcfbe838c716be90c45fb450b26370899277487
Instruction Fuzzy Hash: 3181A274911648AEEF219AB4C840BEDFFF0EF45201F1489E8E8D1E3B41D678E64AC761

Function 00A45B20 Relevance: .8, Instructions: 759COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c5316f1b48f63a7bb38c0e6b3ea4f58914c08cb1eb6d5d8162fff3f7cf674ca
Instruction ID: 15fde7e20a0e79bc80b03614ea78d0bfb18689b2cddb5506daea02242c2201b3
Opcode Fuzzy Hash: 0c5316f1b48f63a7bb38c0e6b3ea4f58914c08cb1eb6d5d8162fff3f7cf674ca
Instruction Fuzzy Hash: 523241B7F5161447DB0CCE5DDCA16EDB2E3AFD8224B1E803DA80AE3345EA79DD058684

Function 00A4BD50 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b80b37ecb74186be8c734b10355c4c601250e8bd0ee9413014499d52b291190a
Instruction ID: 2e06c4fb287e1f1a6bbb2cf1e453baafada281f92d93c5c5bb79ed7e8d0ef4ff
Opcode Fuzzy Hash: b80b37ecb74186be8c734b10355c4c601250e8bd0ee9413014499d52b291190a
Instruction Fuzzy Hash: 5A024175909215CFCB09CF58D4D48F97BF1EFA9310B1A82EDD8899B366D3319980CB91

Function 00A4E490 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7acbd11ad7c86b5b50aa6d0cc179040a8f8603e2df70251344679114ae10a6f6
Instruction ID: bb53ef79f4b7d904ea6e56af1f1ffb1b11eae8fa69cf39b0cb8b9feda13dd437
Opcode Fuzzy Hash: 7acbd11ad7c86b5b50aa6d0cc179040a8f8603e2df70251344679114ae10a6f6
Instruction Fuzzy Hash: 13D19D74600B418BE764CF39C490796BBE1FF98314F1486ADD4EA8B781EB74A489CB91

Function 00A4E140 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a2e03b90355dc0d59000aeef2c7e7f9d6bd4af588e3a47cd3e57602e03e1696
Instruction ID: 8e2e1910d687b3e6f1d42335f849a44caaf358470fbacae107b20df120014a82
Opcode Fuzzy Hash: 2a2e03b90355dc0d59000aeef2c7e7f9d6bd4af588e3a47cd3e57602e03e1696
Instruction Fuzzy Hash: 27B19035A007059FEB31CBA8CC40ABEF7F5FF84310F104A59E9A6D2690D3B1A956CB61

Function 00A4F810 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef7c3bc278ec1be74c412d1d410004a4df5d21a6df1fc4201c5dbd1b215ea9a0
Instruction ID: 6de4d2134fa202ef1083c80879a57fcce92c9125c3b7f41b9019258dac88f5b0
Opcode Fuzzy Hash: ef7c3bc278ec1be74c412d1d410004a4df5d21a6df1fc4201c5dbd1b215ea9a0
Instruction Fuzzy Hash: E9B1AD756047019FD720CF64C880A6BBBE4FFC9324F148A3DF9AA87690D774E9498B52

Function 00AB9824 Relevance: .3, Instructions: 270COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e0110d37a832741cbfa0bcadf1ef546e35509656148e6bc427bb078400eb7b2
Instruction ID: 960965f7cb3ad1d35b2f818fca42f68d8df3cd5fd321e5e0147da11c08f86e45
Opcode Fuzzy Hash: 6e0110d37a832741cbfa0bcadf1ef546e35509656148e6bc427bb078400eb7b2
Instruction Fuzzy Hash: A9B13C316106089FD715CF28C486BA67BE4FF45364F29865CEAD9CF2A2C335E992CB40

Function 009C24F0 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3370e07b085594239fe4dcb0d36e318b0f4e9fd2e356d89514dfa6b5abee0c9d
Instruction ID: c1aa1e538d5d432af71a43f462333d6937d7109a6521d653363e1d77928a2641
Opcode Fuzzy Hash: 3370e07b085594239fe4dcb0d36e318b0f4e9fd2e356d89514dfa6b5abee0c9d
Instruction Fuzzy Hash: 457105B4D002868FDB14CFA8C9D0BBFBBB4EB19314F04016DE85597782C7249946CBA2

Function 00A4F600 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41d31ba86242bfd7bd76f9ba221a1519e07e8bc4f3f0aa95c67da6b44e1bb030
Instruction ID: 65b28cee2eac6f6cf6d45b71861c617ca95979a339873f73637ac13b97b4d039
Opcode Fuzzy Hash: 41d31ba86242bfd7bd76f9ba221a1519e07e8bc4f3f0aa95c67da6b44e1bb030
Instruction Fuzzy Hash: 8161B535500649AFDB30CAB8CC80BEEFBF5EF85310F208AB9E595D27A0D275A685C751

Function 00A46550 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38fecc659fb7173984813311a39dbe0c1500e79f879aa17b4e8b06ddf9a15555
Instruction ID: b3b6a02b48b9e019f4b66f2e37285b5e78824acaca45cb32f50d63903aba9db2
Opcode Fuzzy Hash: 38fecc659fb7173984813311a39dbe0c1500e79f879aa17b4e8b06ddf9a15555
Instruction Fuzzy Hash: D26142356211658FD718CF9EECD04263362A78A311387425BEBD2DB3A6C735E927C7A0

Function 009D4100 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3fc4c93f923b7ee093d18b2828e4e4930910a31c29a76f25b759c50d02cdba6
Instruction ID: d128305db90ad55c247212ed0235bfffc1061fb83b45c5cdd3a9b92114c15861
Opcode Fuzzy Hash: c3fc4c93f923b7ee093d18b2828e4e4930910a31c29a76f25b759c50d02cdba6
Instruction Fuzzy Hash: C6519F71E042199FCB14DF98D981AEEBBB9FB59310F14856EE529B7340D7309E44CBA0

Function 00AA646A Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 920c44e739ca4d08db5b5969fbc7a5a158caad0a814d8dad7807257cb044add9
Instruction ID: 4a28a0fdfff8a2d7d18b12e83f58a8fc371addf1d0c5da0fdcbb4a8e774f0e40
Opcode Fuzzy Hash: 920c44e739ca4d08db5b5969fbc7a5a158caad0a814d8dad7807257cb044add9
Instruction Fuzzy Hash: 50519F72D0021AEFDF04CF99C941AEEBBB2FF89300F198458E915AB241D734AA50CF90

Function 00A4E910 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 854d7f0168f0dc93b040c5b83782ce3004fb363419dbd7899f20dfa3d1eb45b6
Instruction ID: f6bc399d9f530788a6568761cc8f058cb052674667ab5e4f743c8840a0175683
Opcode Fuzzy Hash: 854d7f0168f0dc93b040c5b83782ce3004fb363419dbd7899f20dfa3d1eb45b6
Instruction Fuzzy Hash: 8D316F31600B158FC365CEB9C8817A3F7E5FB89310F150A6ED6EAC7281C6B4B984CB60

Function 00AA2CE0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 003b696ac97f426493bf3b633655a28f95e50146494d3028ddd57524b0139d64
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 58113AB724018243D6148B3DD8B47B7A396EBCB32072C437AD0428B7DAD322E9759B00

Function 009D4400 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cfb95c149f0463e4b641523fec08800f73bcecedb22266f242cad393be72faf
Instruction ID: a99292ee69b1909802bc29c9ac32427a234f1a83ee70c8625d7395c9c097835b
Opcode Fuzzy Hash: 3cfb95c149f0463e4b641523fec08800f73bcecedb22266f242cad393be72faf
Instruction Fuzzy Hash: 9F015BB1915219AFDB10CFA9C8856CEFBF8EF08310F5085AAD459EB241E3756615CBA0

Function 009D5498 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f57c5513b2a6ddb8df53c919b5ef77e69e08df4e3d3e96d3fc4e754907942400
Instruction ID: 9c140e5ba4993787863df00baeedee07485520a306e14e42b73f3c80de71b79b
Opcode Fuzzy Hash: f57c5513b2a6ddb8df53c919b5ef77e69e08df4e3d3e96d3fc4e754907942400
Instruction Fuzzy Hash: 1311BC30A54661CBCB2ACF08D0A0BA9B7A6AF45744B6A808ED8852F712D331AD45CB80

Function 009D57B8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6a0d817ca145215bc037eb701ec72e99ba6f7c24fda562093728c0da0a65e5c
Instruction ID: 5422ab2fc49ce4aaa8097c66b0b5a4b598e96f49457ff7ab99f1a5dae44736f0
Opcode Fuzzy Hash: f6a0d817ca145215bc037eb701ec72e99ba6f7c24fda562093728c0da0a65e5c
Instruction Fuzzy Hash: F1118C34A546A58FCB19CF18C0A0BA9BBB5EF45B44B6A808EC8851F712D731AD45CBC0

Function 009D4DC9 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2331c35f67e26b467e86bfc6563afaf605379b36677bac8d8242ce75225f09fc
Instruction ID: 75095e0fac7d13a65ddcfb9ecf5207040203e423e595e1c71bd6b0a06ca5f0c6
Opcode Fuzzy Hash: 2331c35f67e26b467e86bfc6563afaf605379b36677bac8d8242ce75225f09fc
Instruction Fuzzy Hash: 41118C30A942A58BCB29CF18C0A0B69B7A5FF54B58F29818EC8951F716D771AD05CBD0

Function 00A27D40 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d612fa485dbe76ae60773ae33d8315ac9e875e2fc8dd6338d585fd5b0774defa
Instruction ID: caa63d78eb48a85fbbb348eeae26c1b3a57311cb1e6416fa854bff0ad75f471d
Opcode Fuzzy Hash: d612fa485dbe76ae60773ae33d8315ac9e875e2fc8dd6338d585fd5b0774defa
Instruction Fuzzy Hash: A5D0A73102C2B0CFC736CA3CB084BA77F844F06704F560DEDC0828B061D5A09984CB58

Function 00A27780 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb43d5ebd18ffb5bfa975f8970044cafa813baba2386a534dcfbb36c7b008315
Instruction ID: 0efff11946dbbd271eadd0bc065218e7a7d4b4ef47abd5fcbe0ba1a1b00c80c6
Opcode Fuzzy Hash: fb43d5ebd18ffb5bfa975f8970044cafa813baba2386a534dcfbb36c7b008315
Instruction Fuzzy Hash: E3D0A73203D6B18DD32EC62CA044F877BE54F47314F160DDDC0828B051E5A0D5C9C358

Function 00A27750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac8b70dc6646eac00bb8f7aeb5e9057f0b1fa3d1da44066a827c1914688b07cf
Instruction ID: b8506684b8c3c8a260caa876a5ad72b7c0f2b98747af9bee7cbcea6493a0616b
Opcode Fuzzy Hash: ac8b70dc6646eac00bb8f7aeb5e9057f0b1fa3d1da44066a827c1914688b07cf
Instruction Fuzzy Hash: 02D0A73142C2B5CEC326C66CE084F877F954F02704F168CDDC0A28B155D5E0D984C354

Function 00A29610 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4a58f2acd26a6c84f23a47943215d251ee13493331cefdf2c4a931ee6dde283
Instruction ID: 591873e76c15250dd7f66a3d6dd1ebf7148b6181fd2a528ca3b93750cf485b30
Opcode Fuzzy Hash: f4a58f2acd26a6c84f23a47943215d251ee13493331cefdf2c4a931ee6dde283
Instruction Fuzzy Hash: 2EC012705041204BD738DF1CF581857B3E6AF58700724893DE48B43700E672ED0087C0

Function 00A2F810 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00A2F833
std::_Lockit::_Lockit.LIBCPMT ref: 00A2F855
std::_Lockit::~_Lockit.LIBCPMT ref: 00A2F875
std::_Lockit::~_Lockit.LIBCPMT ref: 00A2F89F
std::_Lockit::_Lockit.LIBCPMT ref: 00A2F90D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00A2F959
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00A2F973
std::_Lockit::~_Lockit.LIBCPMT ref: 00A2FA08
std::_Facet_Register.LIBCPMT ref: 00A2FA15

Strings

bad locale name, xrefs: 00A2FA2F
Ps, xrefs: 00A2F96B, 00A2F972

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$Ps
API String ID: 3375549084-1174896957
Opcode ID: 24f8065e3276e726b2f2d9852d9d5499441cbd6f8cba0bea55dc8b835542a960
Instruction ID: ed83f6d83be1484a9cdd97d6e2187eb829230704d137e6e428f497e75d44cccf
Opcode Fuzzy Hash: 24f8065e3276e726b2f2d9852d9d5499441cbd6f8cba0bea55dc8b835542a960
Instruction Fuzzy Hash: 2761BEB1E00218AFEF10DFA8E945B9EBBF4AF14310F144179E845AB381E734E945CBA1

Function 009C8D70 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(F8F7E6FF,?,?,00AF56BC), ref: 009C8E0E
GetProcAddress.KERNEL32(00000000,E1D7E6DF), ref: 009C8E1B
GetModuleHandleA.KERNEL32(F8F7E6FF), ref: 009C8E85
GetProcAddress.KERNEL32(00000000,E1C2E6DF), ref: 009C8E8C
CloseHandle.KERNEL32(00000000), ref: 009C9092
CloseHandle.KERNEL32(00000000), ref: 009C90F4
CloseHandle.KERNEL32(00000000), ref: 009C9121

Strings

File, xrefs: 009C8F73

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: Handle$Close$AddressModuleProc
String ID: File
API String ID: 4110381430-749574446
Opcode ID: e6475d13040ce0bd52e2f3e7b80cfa002a916f00afb479ebae065a83fc6a3c61
Instruction ID: 350783dd0a0a5413c2846b30d5bd7d7c3cdfc4a3425abbc30557ce1b812426bd
Opcode Fuzzy Hash: e6475d13040ce0bd52e2f3e7b80cfa002a916f00afb479ebae065a83fc6a3c61
Instruction Fuzzy Hash: 0CC19F70D002599AEF24DFA4CC89FAEBBB9FF05700F10006DE945BB282DB755A45CB66

Function 009C39F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 009C3A58
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 009C3AA4
__Getctype.LIBCPMT ref: 009C3ABA
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 009C3AE6
std::_Lockit::~_Lockit.LIBCPMT ref: 009C3B7B

Strings

bad locale name, xrefs: 009C3B96

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: 90adbe9142e9df638bf3553c594e4e83ef3b801379eb8a4a9b2aa8b8cb42d711
Instruction ID: 61255acf1cc1f56f8c0a98b6269f020cb307c281b61a7b2ef8b784c5a42e4715
Opcode Fuzzy Hash: 90adbe9142e9df638bf3553c594e4e83ef3b801379eb8a4a9b2aa8b8cb42d711
Instruction Fuzzy Hash: 5D515FB1D002489FEF10DFA4D945F9EBBF8AF14314F148069E849AB781E774DA04CBA2

Function 009CB1A0 Relevance: 10.6, APIs: 7, Instructions: 133memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000001C), ref: 009CB1F0
LocalAlloc.KERNEL32(00000040,0000001C,?,00000000,00000000), ref: 009CB239
SetupDiGetDeviceInterfaceDetailA.SETUPAPI(?,00000000,00000000,00000000,?,00000000), ref: 009CB26D
SetupDiGetDeviceInterfaceDetailA.SETUPAPI(?,?,00000000,?,00000000,00000000), ref: 009CB28F
LocalFree.KERNEL32(?,?,?,?,?,00000000,?,00000000,00000000), ref: 009CB2C0
LocalFree.KERNEL32(?,?,?,00000000,?,00000000,00000000), ref: 009CB2C5
LocalFree.KERNEL32(?,?,?,00000000,?,00000000,00000000), ref: 009CB2C8

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocDetailDeviceInterfaceSetup
String ID:
API String ID: 4232148138-0
Opcode ID: cd5fbd4182010f0270cd0c67f3251f2eddb727287ca5bf084d31d5c58ac870d3
Instruction ID: 7aac87a8e44867703180e4244665fea071dab57cce8fdb08e4b8e789fecac15d
Opcode Fuzzy Hash: cd5fbd4182010f0270cd0c67f3251f2eddb727287ca5bf084d31d5c58ac870d3
Instruction Fuzzy Hash: 74413BB1A40309AFDB20DFA9DC41FAEBBF8EB48700F10452AE559E7690E770A9008B50

Function 00AA2E10 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00AA2E47
___except_validate_context_record.LIBVCRUNTIME ref: 00AA2E4F
_ValidateLocalCookies.LIBCMT ref: 00AA2ED8
__IsNonwritableInCurrentImage.LIBCMT ref: 00AA2F03
_ValidateLocalCookies.LIBCMT ref: 00AA2F58

Strings

csm, xrefs: 00AA2EED

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: ca29cbf8827e9503852bde6caaf484bc032b7932ed791e2701062f7f059fd8c0
Instruction ID: fd7b8abf0c968b9babfae096ae2468c4b8873482e75afdaa0786398559529ab8
Opcode Fuzzy Hash: ca29cbf8827e9503852bde6caaf484bc032b7932ed791e2701062f7f059fd8c0
Instruction Fuzzy Hash: 09417F31A00209ABCF20DF6CC885B9EBBB5AF46314F148056E9149B392D735DA65CB91

Function 00AAD513 Relevance: 9.3, APIs: 6, Instructions: 285COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00AAD69B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AAD6B7
__allrem.LIBCMT ref: 00AAD6CE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AAD6EC
__allrem.LIBCMT ref: 00AAD703
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AAD721

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 7222d4fbd83bf911f66e88245ad854337fd27cd591c1530f5d5dc897f2461532
Instruction ID: cae471c0baa3f19cc566ca1c98ae199ae2d9bed1089185d6cf78a316595a8a06
Opcode Fuzzy Hash: 7222d4fbd83bf911f66e88245ad854337fd27cd591c1530f5d5dc897f2461532
Instruction Fuzzy Hash: 588119B2A007029FD724AF69DD41BAA73F8AF46724F24462DF492D7AC1E770DD008790

Function 00A2DE70 Relevance: 9.1, APIs: 6, Instructions: 104COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00A2DE93
std::_Lockit::_Lockit.LIBCPMT ref: 00A2DEB6
std::_Lockit::~_Lockit.LIBCPMT ref: 00A2DED6
std::_Facet_Register.LIBCPMT ref: 00A2DF4B
std::_Lockit::~_Lockit.LIBCPMT ref: 00A2DF63
Concurrency::cancel_current_task.LIBCPMT ref: 00A2DF7B

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: a0f3e9ef86c002a9add5eaa1130c7e8f74dedf9a4c5a3d6d92524176236157a1
Instruction ID: 9b8b9adc8b1e9f7e6ad08a802556f9d7f4dbac9138580d8e33090e3533936f97
Opcode Fuzzy Hash: a0f3e9ef86c002a9add5eaa1130c7e8f74dedf9a4c5a3d6d92524176236157a1
Instruction Fuzzy Hash: 5C31C171900229DFCF14DF88EA84BAEBBB4FB14720F154669E8166B352D730AD41CBD1

Function 009CA750 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

\*.*, xrefs: 009CA7E7

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID:
String ID: \*.*
API String ID: 0-1173974218
Opcode ID: 813d821ce4e2ebc8db89ba2d049c62791bd1c7604c23707322e538a7847ee878
Instruction ID: 044ebf13ab62c38ae528651548f72d858b182bcea8f2b4a57a316965e3d184cb
Opcode Fuzzy Hash: 813d821ce4e2ebc8db89ba2d049c62791bd1c7604c23707322e538a7847ee878
Instruction Fuzzy Hash: FFA1AF70D0020D9FEB18CFA8C994BAEBBB6FF49314F14452DE415E7281E7709A85CB62

Function 009C4C50 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 345COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 009C4F72
___std_exception_destroy.LIBVCRUNTIME ref: 009C4FFF

Strings

", ", xrefs: 009C4DCB
: ", xrefs: 009C4DA1

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: ", "$: "
API String ID: 4194217158-747220369
Opcode ID: e62367fa68f1cad6f44248a712fadc50b97d5ec38decb085fc230fdb6b5e22d1
Instruction ID: f9e1b5431efddf78f8481623f2bccfdb4c233301307c9cd8d86c509abc9c8728
Opcode Fuzzy Hash: e62367fa68f1cad6f44248a712fadc50b97d5ec38decb085fc230fdb6b5e22d1
Instruction Fuzzy Hash: FCC10370A002058FDB28DF68D995BAEBBF9FF48300F144A2DE456D7781D774A944CBA2

Function 009C7820 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 009C799A
___std_exception_copy.LIBVCRUNTIME ref: 009C7B75

Strings

type_error, xrefs: 009C784A
out_of_range, xrefs: 009C7A27

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: out_of_range$type_error
API String ID: 2659868963-3702451861
Opcode ID: f29991a06176524f16f2f42f00eb5f2d7dfa9a0116bc8a97da41d1aea0d01e5a
Instruction ID: 7ac29c904edc8ee8218029b697d2029ea188a39c631ab31421e3884e1de5eae5
Opcode Fuzzy Hash: f29991a06176524f16f2f42f00eb5f2d7dfa9a0116bc8a97da41d1aea0d01e5a
Instruction Fuzzy Hash: 07C148B1D002499FDB18CFA8D984B9DFBF5BB49300F14866DE419EB781E774A9808F61

Function 009C73B0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 009C75BE
___std_exception_destroy.LIBVCRUNTIME ref: 009C75CD

Strings

, column , xrefs: 009C7434, 009C744A
at line , xrefs: 009C73F7

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column
API String ID: 4194217158-191570568
Opcode ID: 876e729e89ba6dadaf9b6b5ea81c2aadd50618eca61cae4c60219a63d4371c11
Instruction ID: 32f2780b72dbac9eedf283c677d1ce465f2b83d4e8cf726f43a00407b1619a73
Opcode Fuzzy Hash: 876e729e89ba6dadaf9b6b5ea81c2aadd50618eca61cae4c60219a63d4371c11
Instruction Fuzzy Hash: 3661B071A042499FDB08CFA8DD85BADFBB6BF49300F24862CF415A7781D774AA408F91

Function 009CAF30 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000001), ref: 009CAF8A
GetSystemMetrics.USER32(00000000), ref: 009CAF90

Strings

image/png, xrefs: 009CB063
d, xrefs: 009CAF4B

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID: d$image/png
API String ID: 4116985748-2616758285
Opcode ID: 4db8ae20dfab8ef9deec74ead6528d67749349af697ef3d1e7b72843017146e2
Instruction ID: c9fb92741acc827a03342cfaf4c2819221cccaec6e8b7cd8574e48eaa45f1036
Opcode Fuzzy Hash: 4db8ae20dfab8ef9deec74ead6528d67749349af697ef3d1e7b72843017146e2
Instruction Fuzzy Hash: C0517AB1508301AFD710DF20C895F6BBBE8EB89744F000D1EF994A7250E772E905CBA2

Function 009C3D10 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 009C3E7F

Strings

ios_base::eofbit set, xrefs: 009C3E41, 009C3E63
ios_base::failbit set, xrefs: 009C3D32
ios_base::badbit set, xrefs: 009C3E17

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: 546e9a63af0de62eab1cc79b9343db11f02d44352cfd7fb05ebbd2e98f4edec0
Instruction ID: f5765af90b11914270f6d3465d0f24e1598188700af7d5e215f6320b08312172
Opcode Fuzzy Hash: 546e9a63af0de62eab1cc79b9343db11f02d44352cfd7fb05ebbd2e98f4edec0
Instruction Fuzzy Hash: 854192B6900209AFCB14DF68C845FAEB7F9EB49310F14C52EF915D7681E774AA018BA1

Function 009C3DE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 009C3E7F

Strings

ios_base::eofbit set, xrefs: 009C3E28, 009C3E41, 009C3E63
ios_base::failbit set, xrefs: 009C3D32, 009C3E1E
ios_base::badbit set, xrefs: 009C3E17

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: 69e19507b5a5eaabf39232ddd45e8ff65c074aadf8f444aed648256a4a6374a7
Instruction ID: 23c59d04807394255b18ddae8d1deeb048bd1d8c7cfc3a4400bad8c4d54a8423
Opcode Fuzzy Hash: 69e19507b5a5eaabf39232ddd45e8ff65c074aadf8f444aed648256a4a6374a7
Instruction Fuzzy Hash: 8721E7B29043056FC714DF59D805F96B7ECAB45310F18C82EFA69CB682E774EA14CB92

Function 009D3AA0 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 383COMMON

Download Yara Rule

Strings

abcdefghijklmnopqrstuvwxyz0123456789_ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 009D3BBB
\, xrefs: 009D3BF8

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID:
String ID: \$abcdefghijklmnopqrstuvwxyz0123456789_ABCDEFGHIJKLMNOPQRSTUVWXYZ
API String ID: 0-680898115
Opcode ID: 37631ef4d8250325de53978807fb27133bf07d1ec4bde8e6db9d2182334c184e
Instruction ID: 64d5c15c0d9e4d7882ff17c605a4205523ae6d92d5692fa93030c1b09421fe0b
Opcode Fuzzy Hash: 37631ef4d8250325de53978807fb27133bf07d1ec4bde8e6db9d2182334c184e
Instruction Fuzzy Hash: D3E1A071E002499FDB08CFA8C985BADBBB5FF49300F14C269E415EB382D7759A45CBA1

Function 009CD8B9 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 377COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32(00000000,00000128), ref: 009CDAB0
Process32Next.KERNEL32(00000000,?), ref: 009CDAF8

Strings

?, xrefs: 009CDCB9

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: NextProcess32
String ID: ?
API String ID: 1850201408-1684325040
Opcode ID: d7a67a39b0a0fe75d966cedea33b1570e93b242abf7c3f65326e5e42d6d973de
Instruction ID: ef2a5fa2171515e7788a51c46048d3c934ab6e8c43012379ef09273275f83d14
Opcode Fuzzy Hash: d7a67a39b0a0fe75d966cedea33b1570e93b242abf7c3f65326e5e42d6d973de
Instruction Fuzzy Hash: 42F14BB1D0122D9AEB21EB94CC55FEEB7BCAF15300F4044E9E549A6241EB745B88CF62

Function 009C6F40 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 349COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 009C7340

Strings

parse error, xrefs: 009C6FFF, 009C7018
parse_error, xrefs: 009C6F8B

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: parse error$parse_error
API String ID: 2659868963-1820534363
Opcode ID: 442b214b4b6c3b93308ea671eac00079ef2ea1cd49e70796cb7cb7512d836b55
Instruction ID: 12b0a1bf1f2bcde42a1f61b3ed951e9846bb13fb2241a67217cd27a705f606a1
Opcode Fuzzy Hash: 442b214b4b6c3b93308ea671eac00079ef2ea1cd49e70796cb7cb7512d836b55
Instruction Fuzzy Hash: 92E16E70E042498FDB18CFA8D985B9DBBB1BF49300F24826DE419EB792D7749A81CF51

Function 009C6C60 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 009C6F11
___std_exception_destroy.LIBVCRUNTIME ref: 009C6F20

Strings

[json.exception., xrefs: 009C6CB8

Memory Dump Source

Source File: 00000000.00000002.2907236987.00000000009C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2907152157.00000000009C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907236987.0000000000AF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907593962.0000000000AF8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907655683.0000000000AFB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907713977.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2907782154.0000000000B08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908128735.0000000000C69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908181660.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908269198.0000000000C8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908408329.0000000000C93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908468824.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908578978.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908644702.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908704151.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908765437.0000000000CD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908833171.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000CF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908891317.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909137887.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909205888.0000000000D62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2909349437.0000000000D72000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LisectAVT_2403002A_151.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.
API String ID: 4194217158-791563284
Opcode ID: 9a11cf9fb6a63a5d0d2191fcca3b3c22088b25337c710fed1ed18abeead37389
Instruction ID: 07967f29ce5dd3890ef4cf4ad9b18f9bf79730aaa674a1c4a5191a3a7b9aadb3
Opcode Fuzzy Hash: 9a11cf9fb6a63a5d0d2191fcca3b3c22088b25337c710fed1ed18abeead37389
Instruction Fuzzy Hash: 2E91C070E002099FDB18CF68D984B9EBBF6EF45300F20862DE415EB792D771A941CB51

Analysis Process: MPGPH131.exePID: 5804, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	3.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	660
Total number of Limit Nodes:	82

Executed Functions

Function 005F7E3E Relevance: 26.8, APIs: 7, Strings: 7, Instructions: 2282COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,00000104,?,?,?), ref: 005F8006
GetFileAttributesA.KERNELBASE(?,00000001,?,?,?,?), ref: 005F815D
__Mtx_unlock.LIBCPMT ref: 005F8186
__Mtx_unlock.LIBCPMT ref: 005F8195
GetFileAttributesA.KERNELBASE(?,?,0000005C,00000000,00000001), ref: 005F8751
__Mtx_unlock.LIBCPMT ref: 005F877A

Strings

P?Y, xrefs: 005F85DC
131, xrefs: 005F7E3E, 005F7E44, 005F7EB2, 005F7EB9, 005F7EBF, 005F7F2A, 005F7F31, 005F7F37, 005F9A45, 005F9A4C, 005F9A52
+, xrefs: 005F9B19
Q>5, xrefs: 005F9C24
\, xrefs: 005F8684
*, xrefs: 005F980E
\, xrefs: 005F8896

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$AttributesFile$NameUser
String ID: *$+$131$P?Y$Q>5$\$\
API String ID: 1275484822-3500402200
Opcode ID: 7eef7824a74f022f95a319b507a7206870e11c5d68f7981bc799e4df7bc40fec
Instruction ID: 19c079cd4cafa86434ed53aada870ea4f3501303f115f5e90cdcc216bcea6313
Opcode Fuzzy Hash: 7eef7824a74f022f95a319b507a7206870e11c5d68f7981bc799e4df7bc40fec
Instruction Fuzzy Hash: 71237D709002598FDB28CF68CC94BEEBBB5BF05304F2481EDD509AB282E7759A85CF55

Function 005EB6A0 Relevance: 14.8, APIs: 4, Strings: 4, Instructions: 840
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,C0D5DDC2,00000000,00020019,00000000,FAF8FCC4,FAF8FCC5), ref: 005EB947

Strings

_, xrefs: 005EBB25
_, xrefs: 005EBAC6
_, xrefs: 005EBB32
:, xrefs: 005EB443

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Open
String ID: :$_$_$_
API String ID: 71445658-4119709311
Opcode ID: 392c2410b4c14f3e4bb990687df2e1fd5808172aafefab5fc9206d059a0459cc
Instruction ID: 931ccb8799fc0e960de74f5d4065b441196c4630b41b51edf3e21b3853550c0e
Opcode Fuzzy Hash: 392c2410b4c14f3e4bb990687df2e1fd5808172aafefab5fc9206d059a0459cc
Instruction Fuzzy Hash: 61729171D002599FEB18CF68CC94BEEBBB6BF45304F1481ADE449AB282D7749A85CF50

Function 005FE0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 005FE0CB
socket.WS2_32(?,?,?,?,?,?,00717320,?,?,?,?,?,?), ref: 005FE17F
connect.WS2_32(00000000,?,00000000,?,?,?,00717320,?,?,?,?,?,?), ref: 005FE193
closesocket.WS2_32(00000000), ref: 005FE19E

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: 9282defdcc649b618e162b627092d5b03f75c6e4733b7bfde1859186feb6374c
Instruction ID: b3ebcae118c746845e7b5c7a3a6e93bb26e3bf543a709c9c93aa8bebe3e50caf
Opcode Fuzzy Hash: 9282defdcc649b618e162b627092d5b03f75c6e4733b7bfde1859186feb6374c
Instruction Fuzzy Hash: 1C31B6716053045BE7209F258849B6BBBE4FBC5764F004F1DF9A4A62E0D33999048B92

Function 006BF290 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005E220E

Strings

`!^, xrefs: 005E21FC
`!^, xrefs: 005E2216

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!^$`!^
API String ID: 2659868963-985837307
Opcode ID: bc8ceb2c76924f206182f052f298989bd0a343bbd9bcc19d4f57e16a143a29f4
Instruction ID: e94f8ef04def47f14dcc88fbf19d73d15d711668984b3a8775314f87b7d1d840
Opcode Fuzzy Hash: bc8ceb2c76924f206182f052f298989bd0a343bbd9bcc19d4f57e16a143a29f4
Instruction Fuzzy Hash: 5B01207550030DA7CB18AF99DC059D57BDEDA00310F50843DFA18DB651E770E590C794

Function 005EA690 Relevance: 4.6, APIs: 3, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE ref: 005EA6BF
__Mtx_unlock.LIBCPMT ref: 005EA6EE
__Mtx_unlock.LIBCPMT ref: 005EA733

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$AttributesFile
String ID:
API String ID: 1886074773-0
Opcode ID: 87ea4ac7bf507aff71a37a562f04a3ff30bbd1200ca6f0c11287343e4a4a29f8
Instruction ID: c67b08ecc76a84ee1085e5898f284efbfb2b7d43caef2053dda2b944e1132c74
Opcode Fuzzy Hash: 87ea4ac7bf507aff71a37a562f04a3ff30bbd1200ca6f0c11287343e4a4a29f8
Instruction Fuzzy Hash: 6E0149E1E401A0229E7C21BA2C464FB6D49985376871D8D26FCD1DB257F44BEE8082E3

Function 00650560 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 006506AE

Strings

5_, xrefs: 00650560

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: 5_
API String ID: 118556049-1161999416
Opcode ID: 704878a6fb962aec51445f9c7907984ce5d7d965d91800b1a8fb89f3cbd27ced
Instruction ID: 621670e01086a16ed09b242363608e4a2a7c6520bd4230c6ee20ac2c4a5d64cb
Opcode Fuzzy Hash: 704878a6fb962aec51445f9c7907984ce5d7d965d91800b1a8fb89f3cbd27ced
Instruction Fuzzy Hash: C641F672A001149BDB15DF68DD80AAE7BA6EF85311F1401ADFC15DB302EB30DE658BE5

Function 005EA090 Relevance: 3.3, APIs: 2, Instructions: 342
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 005EA1B6
__fread_nolock.LIBCMT ref: 005EA343

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: c3b6ebdc6bdc5238eff1670e9f0308f10caecd4dd7de0264fed6f67307a1fac0
Instruction ID: fa3e0b59eb018f084bbdd9c798585d0462cabb8994c0ed21eeed4914b4550dfd
Opcode Fuzzy Hash: c3b6ebdc6bdc5238eff1670e9f0308f10caecd4dd7de0264fed6f67307a1fac0
Instruction Fuzzy Hash: 02B12470900284AFDB18DF69CC49BAEBFE9FF45300F10856DF4459B682D7B4AA41C7A6

Function 006D4623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c825a6aac7e6686e4bc2fd37150b3a452aa281e125bd09d457e0e87c7d4fbb5
Instruction ID: a13c429f1cafdf9861ded8d5526159d6acd1488c4acbd63ff361199e83d424c4
Opcode Fuzzy Hash: 1c825a6aac7e6686e4bc2fd37150b3a452aa281e125bd09d457e0e87c7d4fbb5
Instruction Fuzzy Hash: 74B1E170E04245ABDB119FA9D890BBEBBB7EF49300F14415EE544AB382DB74DD42CBA4

Function 006D549C Relevance: 1.7, APIs: 1, Instructions: 198
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000000,006C9087,?,00000000,00000000,00000000,?,00000000,?,006BE5B1,006C9087,00000000,006BE5B1,?,?), ref: 006D5622

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: e12083f92a3117e4f684bf0f27148b50a467f5280bfe74f551f15d1dcfdd8550
Instruction ID: 2386cef9b7b9d5ec5e3b5a51c18e803e71e11760ec1e493f33c1f1aa5c0c510b
Opcode Fuzzy Hash: e12083f92a3117e4f684bf0f27148b50a467f5280bfe74f551f15d1dcfdd8550
Instruction Fuzzy Hash: 9761CF71D04559AFDF11DFA8D884EEEBBBBAF49304F14014AE801A7755D735DA02CBA0

Function 006C4942 Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a2e1504c5850e8fe20b4dad3baba88650050e5f09559d2454b9620935fc08c7
Instruction ID: e3b3f6e926049fb13f97bb333c9eacba9229901be2eae458d2ca1c00716746a6
Opcode Fuzzy Hash: 0a2e1504c5850e8fe20b4dad3baba88650050e5f09559d2454b9620935fc08c7
Instruction Fuzzy Hash: 8351B570A00108AFDB14CF98C895FBABBB2EF49364F24815DF8499B356D7329E51CB94

Function 006D4B12 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,006D49F9,00000000,CF830579,00711140,0000000C,006D4AB5,006C8BBD,?), ref: 006D4B69

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 7c506a9bdf78cebb9e0fa72753cb897ec34ce4e911560c7ea630335fc439f6a7
Instruction ID: 7081d87a116f1d0c912f2b7fef8d253bf0b6591d68d577c003f73b3eae5f3813
Opcode Fuzzy Hash: 7c506a9bdf78cebb9e0fa72753cb897ec34ce4e911560c7ea630335fc439f6a7
Instruction Fuzzy Hash: 6E115532E0816457C66022746842BBE674B8BE23B0F39020FE8088B3C2EE74DC418198

Function 006CE05C Relevance: 1.6, APIs: 1, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00710DF8,006BE5B1,00000002,006BE5B1,00000000,?,?,?,006CE166,00000000,?,006BE5B1,00000002,00710DF8), ref: 006CE099

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d39fdac817ea6707f1c2d44ab327504007b298c03923ba6622c5d33ac1a1049e
Instruction ID: 4b2c4530dd6f5c6cd9de1249e5bd2e9a127e45e5db11dff9d37b4359315f9bff
Opcode Fuzzy Hash: d39fdac817ea6707f1c2d44ab327504007b298c03923ba6622c5d33ac1a1049e
Instruction Fuzzy Hash: 0F012632714155ABCF15CF18CC05EAE3B2ADB85330B24024DF8509B291FAB2EA618BD0

Function 006D63F3 Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,006BD6FA,00000004,?,006D5D79,00000001,00000364,00000004,00000007,000000FF,?,006C067B,00000002,00000000,?,?), ref: 006D6435

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: dd70c29814824660030c03807416df8c0f2fcd07cfc58b555f5ccd5f486424c2
Instruction ID: 16270d57eba96166127d7fa5164fd6c2d49d650dbf805420d65665565d533175
Opcode Fuzzy Hash: dd70c29814824660030c03807416df8c0f2fcd07cfc58b555f5ccd5f486424c2
Instruction Fuzzy Hash: E4F05431D05224669B616F66DC06B9B3BDB9B85764B15C067FC0496380CBA0E81146F5

Function 006D6E2D Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000004,00000000,?,006C067B,00000002,00000000,?,?,?,005E303D,006BD6FA,00000004,00000000,006BD6FA), ref: 006D6E60

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 21ed96c9941d739d9a3a6a6813b1c64fd9002d149d24ceefd233996655551bda
Instruction ID: d5ae9e3cd06139bca7e54e3b72637d2302153c6d613c7d602057d7f6a62a3cb3
Opcode Fuzzy Hash: 21ed96c9941d739d9a3a6a6813b1c64fd9002d149d24ceefd233996655551bda
Instruction Fuzzy Hash: A7E0ED39D48625A6DA3026A5CC00BEB778FCB823A1F050927FE04963D0CB60C80181E8

Non-executed Functions

Function 00663F80 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 263libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,DCFDFBC6), ref: 006640CC
GetProcAddress.KERNEL32(00000000,DCFDFBC6), ref: 00664116
GetProcAddress.KERNEL32(00000000,DCFDFBC6), ref: 0066414E
GetProcAddress.KERNEL32(00000000,DCFDFBC6), ref: 00664196
GetProcAddress.KERNEL32(00000000,DCFDFBC6), ref: 006641E9

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36, xrefs: 00664037

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
API String ID: 190572456-383447037
Opcode ID: c320df49a645d4c2508f90a401a709f66bb6b191b03c5bf2132a2f12d390c5a4
Instruction ID: 785bcbe4225f46ba508c4485db62e4dbad8d74276a9eb90a5671c12b8630e6d7
Opcode Fuzzy Hash: c320df49a645d4c2508f90a401a709f66bb6b191b03c5bf2132a2f12d390c5a4
Instruction Fuzzy Hash: 63C14DB08183999FDB04CFA8D495BEDBFF9EF19304F1040AEE845AB252E7744509CB69

Function 006C84A0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f97ce6278b5da815f6c389bae476adc5dc884afc24939f4c376b69ad4ad6edd
Instruction ID: 35e5b952324dbe5d5ab8348961ccb54105ad1c26cfab47d5d8da423fd14e921f
Opcode Fuzzy Hash: 3f97ce6278b5da815f6c389bae476adc5dc884afc24939f4c376b69ad4ad6edd
Instruction Fuzzy Hash: 50020B71E012199FDF24CFA9C880BEEBBB2FF48314F25826DD519A7341DB31A9418B94

Function 0064F810 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0064F833
std::_Lockit::_Lockit.LIBCPMT ref: 0064F855
std::_Lockit::~_Lockit.LIBCPMT ref: 0064F875
std::_Lockit::~_Lockit.LIBCPMT ref: 0064F89F
std::_Lockit::_Lockit.LIBCPMT ref: 0064F90D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0064F959
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0064F973
std::_Lockit::~_Lockit.LIBCPMT ref: 0064FA08
std::_Facet_Register.LIBCPMT ref: 0064FA15

Strings

"p, xrefs: 0064F96B, 0064F972
bad locale name, xrefs: 0064FA2F

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$"p
API String ID: 3375549084-3171176342
Opcode ID: 7aa2c72839345ba2a3351bdc47133f54cc2a929e7d355cde31e1148d17aec5b7
Instruction ID: ce597d6b4fae1cf081d736e30517dd115e594cb7dd165c2c0c0c4dc7372078b9
Opcode Fuzzy Hash: 7aa2c72839345ba2a3351bdc47133f54cc2a929e7d355cde31e1148d17aec5b7
Instruction Fuzzy Hash: 95617EB1D00248DFEF10DFA8D845BDEBBB6AF14310F148568E805AB381EB75E945CBA5

Function 005E8D70 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(F8F7E6FF,?,?,007156BC), ref: 005E8E0E
GetProcAddress.KERNEL32(00000000,E1D7E6DF), ref: 005E8E1B
GetModuleHandleA.KERNEL32(F8F7E6FF), ref: 005E8E85
GetProcAddress.KERNEL32(00000000,E1C2E6DF), ref: 005E8E8C
CloseHandle.KERNEL32(00000000), ref: 005E9092
CloseHandle.KERNEL32(00000000), ref: 005E90F4
CloseHandle.KERNEL32(00000000), ref: 005E9121

Strings

File, xrefs: 005E8F73
}Vn, xrefs: 005E90F6
}Vn, xrefs: 005E8EC5, 005E8EC8

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Handle$Close$AddressModuleProc
String ID: File$}Vn$}Vn
API String ID: 4110381430-1811535537
Opcode ID: d70638dc2a6a635cc957d16cf946a72a1fa66fd67d0beaf1d8f075270a7a3942
Instruction ID: 1cd2c346e452ac5b22c90c0b417bca579a0c1b15b7c4db45e036255feb5d2f49
Opcode Fuzzy Hash: d70638dc2a6a635cc957d16cf946a72a1fa66fd67d0beaf1d8f075270a7a3942
Instruction Fuzzy Hash: FBC18D70D002999BEF24DFA5CC85BAEBBB9FF04300F50406DE944BB282DB759A45CB65

Function 005E3D10 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005E3E7F

Strings

`!^, xrefs: 005E3E70
G>^, xrefs: 005E3DB8
@3^, xrefs: 005E3E84
ios_base::badbit set, xrefs: 005E3E17
ios_base::failbit set, xrefs: 005E3D32
ios_base::eofbit set, xrefs: 005E3E41, 005E3E63
@3^, xrefs: 005E3DBE, 005E3E9B
G>^, xrefs: 005E3D2B, 005E3D67, 005E3D6A

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: @3^$@3^$G>^$G>^$`!^$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-3207115525
Opcode ID: a1e167198c0edcf480cfa73e5b4090e4a6114dbe965f9ede2e11dfc9446e6166
Instruction ID: be67246fe3a6c0bad200ac019c19242625935175ca8ca25768e86609e8068661
Opcode Fuzzy Hash: a1e167198c0edcf480cfa73e5b4090e4a6114dbe965f9ede2e11dfc9446e6166
Instruction Fuzzy Hash: 9F41B4B2900248AFC708DF59CC49BAEBBF9FF49310F14856EF955D7641E770AA008BA4

Function 006C2E10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 006C2E47
___except_validate_context_record.LIBVCRUNTIME ref: 006C2E4F
_ValidateLocalCookies.LIBCMT ref: 006C2ED8
__IsNonwritableInCurrentImage.LIBCMT ref: 006C2F03
_ValidateLocalCookies.LIBCMT ref: 006C2F58

Strings

csm, xrefs: 006C2EED
iq, xrefs: 006C2F78

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: iq$csm
API String ID: 1170836740-2322788918
Opcode ID: a356d2be9958ce262c464a5f1c8514f14c16c0b6e0aaa860930b98369cf78690
Instruction ID: a706ce119ac4be38d775afb936fa536409232340db4a5c742e1839363dc8f508
Opcode Fuzzy Hash: a356d2be9958ce262c464a5f1c8514f14c16c0b6e0aaa860930b98369cf78690
Instruction Fuzzy Hash: EF419134A0020A9BCB10DF68C895FEEBBB6EF49314F14805DEC14AB392D731EA45CB90

Function 005E3DE0 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 79COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005E3E7F

Strings

`!^, xrefs: 005E3E70
@3^, xrefs: 005E3E84
ios_base::badbit set, xrefs: 005E3E17
ios_base::failbit set, xrefs: 005E3D32, 005E3E1E
ios_base::eofbit set, xrefs: 005E3E28, 005E3E41, 005E3E63
@3^, xrefs: 005E3DBE, 005E3E9B

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: @3^$@3^$`!^$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-535810501
Opcode ID: 406dc474efa465bcd219bbc36c74c4635f25b50a54c2cbe85e178bb6006d7667
Instruction ID: cb5d984c4f9a2cd1018b0fe4a11a8b2f30a5db11a23a93438b5fa7becf037b56
Opcode Fuzzy Hash: 406dc474efa465bcd219bbc36c74c4635f25b50a54c2cbe85e178bb6006d7667
Instruction Fuzzy Hash: 1A21EEB3500345ABC718DF59D809F96BBDCBB44310F14887EFA988B641E774E914CB95

Function 005E6F40 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 349COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005E7340

Strings

u^, xrefs: 005E7352
`!^, xrefs: 005E7328
`!^, xrefs: 005E734B
parse error, xrefs: 005E6FFF, 005E7018
parse_error, xrefs: 005E6F8B

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!^$`!^$parse error$parse_error$u^
API String ID: 2659868963-3588640227
Opcode ID: 96e4b53c47f70ecbcfdc5ee9a362f6256be67672fc5c53a38587b8eeb9d9bcb0
Instruction ID: 71c7deccd4a6390633cc7c7b46d384c605d062ab9284f6003387e50de9828908
Opcode Fuzzy Hash: 96e4b53c47f70ecbcfdc5ee9a362f6256be67672fc5c53a38587b8eeb9d9bcb0
Instruction Fuzzy Hash: F5E16D719042488FDB58CF68C884B9DBBB2FF48300F24866DE458EB792D7749A81CF55

Function 005E7820 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005E799A
___std_exception_copy.LIBVCRUNTIME ref: 005E7B75

Strings

`!^, xrefs: 005E7985, 005E7B60
`!^, xrefs: 005E79A5, 005E7B80
type_error, xrefs: 005E784A
out_of_range, xrefs: 005E7A27

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!^$`!^$out_of_range$type_error
API String ID: 2659868963-2822758601
Opcode ID: 4019c516f2f82b62e796e75ef782face80c5a8f67f2236dd931311d6cc02e3d0
Instruction ID: f090722619b0cb688438224bd3f5902fda0698fa266dfcc2e575e12fe33bf28d
Opcode Fuzzy Hash: 4019c516f2f82b62e796e75ef782face80c5a8f67f2236dd931311d6cc02e3d0
Instruction Fuzzy Hash: 5FC158B19002489FDB58CFA8D884B9DBBF6FF48300F14866DE459EB792E7749980CB54

Function 005E73B0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 184COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 005E75BE
___std_exception_destroy.LIBVCRUNTIME ref: 005E75CD

Strings

at line , xrefs: 005E73F7
`!^, xrefs: 005E75B6, 005E75C6
, column , xrefs: 005E7434, 005E744A
yo^, xrefs: 005E7455

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column $`!^$yo^
API String ID: 4194217158-262291558
Opcode ID: f389948c6c52c14b67ee78f4fe6b4bfda679fa01324f67328ba931072655488e
Instruction ID: 0a013b8861c3c4990ae5cc52710d9ea3714a46b88a47f8fc85044f53f2baf42a
Opcode Fuzzy Hash: f389948c6c52c14b67ee78f4fe6b4bfda679fa01324f67328ba931072655488e
Instruction Fuzzy Hash: 7E61F571A002499FDB0CCF68DC84BADBBB6FF48300F24462DF455A7782D774AA408B94

Function 005E39F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 005E3A58
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 005E3AA4
__Getctype.LIBCPMT ref: 005E3ABA
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 005E3AE6
std::_Lockit::~_Lockit.LIBCPMT ref: 005E3B7B

Strings

bad locale name, xrefs: 005E3B96

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: a50f3266298faa2dbf8d77462a04a12d52bd1765b6b7d6918e3402f3316bd8d4
Instruction ID: cc21b3653f9bdf4487c2a5149338688b3936f2470c9220968b8795935c4694f2
Opcode Fuzzy Hash: a50f3266298faa2dbf8d77462a04a12d52bd1765b6b7d6918e3402f3316bd8d4
Instruction Fuzzy Hash: DF518FB1D002489BEF14DFA5D885BDEBBB8BF14310F14406DE849AB381E775DA44CBA5

Function 005EB1A0 Relevance: 10.6, APIs: 7, Instructions: 133memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000001C), ref: 005EB1F0
LocalAlloc.KERNEL32(00000040,0000001C,?,00000000,00000000), ref: 005EB239
SetupDiGetDeviceInterfaceDetailA.SETUPAPI(?,00000000,00000000,00000000,?,00000000), ref: 005EB26D
SetupDiGetDeviceInterfaceDetailA.SETUPAPI(?,?,00000000,?,00000000,00000000), ref: 005EB28F
LocalFree.KERNEL32(?,?,?,?,?,00000000,?,00000000,00000000), ref: 005EB2C0
LocalFree.KERNEL32(?,?,?,00000000,?,00000000,00000000), ref: 005EB2C5
LocalFree.KERNEL32(?,?,?,00000000,?,00000000,00000000), ref: 005EB2C8

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocDetailDeviceInterfaceSetup
String ID:
API String ID: 4232148138-0
Opcode ID: d1c9b4f887084d51ca7e659bf52d208bc36596985cfe7887dfc9ce3f2acae87a
Instruction ID: d7ce2470db9ac936b1682fe3b3286ce58d298316d030d0f081534b09bf3bb9ff
Opcode Fuzzy Hash: d1c9b4f887084d51ca7e659bf52d208bc36596985cfe7887dfc9ce3f2acae87a
Instruction Fuzzy Hash: EE413AB5A40349AFDB60DFA9DC41BAEBBF9FF48700F10452AE559E7690E770A9008B50

Function 006CD513 Relevance: 9.3, APIs: 6, Instructions: 285COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 006CD69B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006CD6B7
__allrem.LIBCMT ref: 006CD6CE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006CD6EC
__allrem.LIBCMT ref: 006CD703
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006CD721

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 7222d4fbd83bf911f66e88245ad854337fd27cd591c1530f5d5dc897f2461532
Instruction ID: 48a856060aff5c9cfbb3f85407cc616c122fa544787b4e28f7136243ed06ba6f
Opcode Fuzzy Hash: 7222d4fbd83bf911f66e88245ad854337fd27cd591c1530f5d5dc897f2461532
Instruction Fuzzy Hash: 7E81B4B2A00705ABD720AA69DC41FBA73EBEF41724F24463EF415D7781EB74D9008BA4

Function 0064DE70 Relevance: 9.1, APIs: 6, Instructions: 104COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0064DE93
std::_Lockit::_Lockit.LIBCPMT ref: 0064DEB6
std::_Lockit::~_Lockit.LIBCPMT ref: 0064DED6
std::_Facet_Register.LIBCPMT ref: 0064DF4B
std::_Lockit::~_Lockit.LIBCPMT ref: 0064DF63
Concurrency::cancel_current_task.LIBCPMT ref: 0064DF7B

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 4ed6bffd0b78159ff407af31dbd954671e8a6a5e5303b1d9258154c91553364c
Instruction ID: ad128decd795e6f4fb8bb067ab2e4cd2f2b68e7507bb84957efef601b003deb0
Opcode Fuzzy Hash: 4ed6bffd0b78159ff407af31dbd954671e8a6a5e5303b1d9258154c91553364c
Instruction Fuzzy Hash: 1A31EFB1D00256DFCB64DF48D880AEEBBB6FB00720F148299E8166B392D731AD45CBD5

Function 005E4C50 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 345COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 005E4F72
___std_exception_destroy.LIBVCRUNTIME ref: 005E4FFF

Strings

", ", xrefs: 005E4DCB
`!^, xrefs: 005E4F6B, 005E4FF8
: ", xrefs: 005E4DA1

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: ", "$: "$`!^
API String ID: 4194217158-1246380630
Opcode ID: 469bfa3249d7d0d453234af32832c2024593ae1d1879c7a3f5db4ad7cb7ecb15
Instruction ID: 9d4ecd15a9fb4cb3803a870d02549764480b424ce4b5c487b1776da080fb8fa0
Opcode Fuzzy Hash: 469bfa3249d7d0d453234af32832c2024593ae1d1879c7a3f5db4ad7cb7ecb15
Instruction Fuzzy Hash: D1C1F2719002448FDB28DF69C885BAEBBFAFF44300F14492DE49697782E774A944CBA5

Function 005EA750 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

\*.*, xrefs: 005EA7E7

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID: \*.*
API String ID: 0-1173974218
Opcode ID: f9d33ad8415a2213b6c63c4fafee7cfd17aff15e67ec92f13b5557ef2d0240b6
Instruction ID: c970ecd9929ef75b8097d8b7739a4bd0ab55f1925b006fc35dbdcb5d1241d3bb
Opcode Fuzzy Hash: f9d33ad8415a2213b6c63c4fafee7cfd17aff15e67ec92f13b5557ef2d0240b6
Instruction Fuzzy Hash: BBA1C2709002899FDB18DFB9C9947EEBFB6FF48310F104529E491E7282D770A985CB66

Function 005E3190 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 170COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005E32C6
___std_exception_destroy.LIBVCRUNTIME ref: 005E3350

Strings

`!^, xrefs: 005E32D1
`!^, xrefs: 005E32AD, 005E3349
@3^, xrefs: 005E3316

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: @3^$`!^$`!^
API String ID: 2970364248-1577654005
Opcode ID: d109883bd55ba2f7dfcc1521371c8576c4f4afe41f0e331bad2ed7a73cb87214
Instruction ID: 422a81c6e04e715ea09989a2445efeb52ca69406a98966cbd1387b5847a8e03f
Opcode Fuzzy Hash: d109883bd55ba2f7dfcc1521371c8576c4f4afe41f0e331bad2ed7a73cb87214
Instruction Fuzzy Hash: 7C519C759002589FDB18CF98D889BEEBBB6FF48300F14812EE855A7392D7749A41CB94

Function 005E3370 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

APIs

Part of subcall function 005E3190: ___std_exception_copy.LIBVCRUNTIME ref: 005E32C6

___std_exception_copy.LIBVCRUNTIME ref: 005E345F

Strings

@3^, xrefs: 005E33F3, 005E347B
`!^, xrefs: 005E3450
@3^, xrefs: 005E3464
+4^, xrefs: 005E33B3, 005E3410

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: +4^$@3^$@3^$`!^
API String ID: 2659868963-1877915259
Opcode ID: 1112750ba11c832e4ee43f4b265f4be5aa83058f2b7514e55cd3bba508bf219e
Instruction ID: eefbd888b26400e8744f0fd53b75aee4a205a8e466fe3fc9906cff9e993418c0
Opcode Fuzzy Hash: 1112750ba11c832e4ee43f4b265f4be5aa83058f2b7514e55cd3bba508bf219e
Instruction Fuzzy Hash: 9031A2B29002499FCB18DFA9D845AAEFFF9FB48710F10852EE514D7641E770A650CB94

Function 005E3410 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 47COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005E345F

Strings

@3^, xrefs: 005E33F3, 005E347B
`!^, xrefs: 005E3450
@3^, xrefs: 005E3464
+4^, xrefs: 005E33B3, 005E3410

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: +4^$@3^$@3^$`!^
API String ID: 2659868963-1877915259
Opcode ID: fa909f59a189929e4be73e45fe020132d58692f46218755354ced847ba4093e8
Instruction ID: d410605c97ee4df992438e68a59f24d2a626607e28a96a9b5ffaa829754c472b
Opcode Fuzzy Hash: fa909f59a189929e4be73e45fe020132d58692f46218755354ced847ba4093e8
Instruction Fuzzy Hash: D901FFB650030AAF8708DFA9D445C96FBFDFF58710710846AE51987611EBB0E554CB94

Function 0064D050 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0064D06F
___std_exception_copy.LIBVCRUNTIME ref: 0064D096

Strings

u^, xrefs: 0064D0A5
`!^, xrefs: 0064D09B
`!^, xrefs: 0064D060, 0064D085

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!^$`!^$u^
API String ID: 2659868963-2492332708
Opcode ID: dd1def0ff16d497944d201b012077c8bc6c966005e92632583c57d8a32d5e22e
Instruction ID: 9cad35764ec978474cc63aabc3895d499ff1912013720ef161d5ab616e6513b9
Opcode Fuzzy Hash: dd1def0ff16d497944d201b012077c8bc6c966005e92632583c57d8a32d5e22e
Instruction Fuzzy Hash: C001A4B6501706AF8704DF59D405892FBF9FB58710701852FE529CBB11E7B0E528CFA4

Function 005E6C60 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 247COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 005E6F11
___std_exception_destroy.LIBVCRUNTIME ref: 005E6F20

Strings

`!^, xrefs: 005E6F09, 005E6F19
[json.exception., xrefs: 005E6CB8

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.$`!^
API String ID: 4194217158-1084409180
Opcode ID: a240104034051146a43101b4de89cd38ced386b663d615c1b35dc24524215f6e
Instruction ID: bbb90b0123d943d23f9c415c546ff84419f8fc23d1c2dace56f9b3acc5ea2c56
Opcode Fuzzy Hash: a240104034051146a43101b4de89cd38ced386b663d615c1b35dc24524215f6e
Instruction Fuzzy Hash: D091D271A002449FDB1CCF68C984B9EBBF6FF54340F20866CE459AB792D770AA81CB50

Function 005EAF30 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000001), ref: 005EAF8A
GetSystemMetrics.USER32(00000000), ref: 005EAF90

Strings

image/png, xrefs: 005EB063
d, xrefs: 005EAF4B

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID: d$image/png
API String ID: 4116985748-2616758285
Opcode ID: 81da90dbcc8a9ae671d21dc1fccd5ab38a7571a9179c13cf4e327eeac9cf514a
Instruction ID: 1f34a4185c481c2dc0292b08acb79854823dd51b98179627658b5493116c9792
Opcode Fuzzy Hash: 81da90dbcc8a9ae671d21dc1fccd5ab38a7571a9179c13cf4e327eeac9cf514a
Instruction Fuzzy Hash: E0518CB1504341AFE710DF21C898B6BBBE9FB85754F001D2DF89493240E772E904CB96

Function 005E7620 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 167COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005E77B4

Strings

`!^, xrefs: 005E779F
`!^, xrefs: 005E77BF
invalid_iterator, xrefs: 005E7656

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!^$`!^$invalid_iterator
API String ID: 2659868963-3096502865
Opcode ID: e2b525b3f60da3140a54e3b89b91dbedebeddaf82b38193110b0270113e0605c
Instruction ID: 12db1614c9155171e14a524e4480d4f71ea3cb89d4b7682171ffbde780990e6d
Opcode Fuzzy Hash: e2b525b3f60da3140a54e3b89b91dbedebeddaf82b38193110b0270113e0605c
Instruction Fuzzy Hash: 5A5137B19002489FDB18CFA8D89479DBBF2FB48300F14866DE459EB792E7749980CB94

Function 005E7BE0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 156COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005E7D67

Strings

`!^, xrefs: 005E7D52
`!^, xrefs: 005E7D72
other_error, xrefs: 005E7C0A

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!^$`!^$other_error
API String ID: 2659868963-1867354975
Opcode ID: 64f2e1ef643a0f219b63c7a361f7631c67473ab4040686a1bb382d24e542735e
Instruction ID: 24e2cddd822ee45c3d9c62cf711e43237ce016351bda87547be3f2fd56f288df
Opcode Fuzzy Hash: 64f2e1ef643a0f219b63c7a361f7631c67473ab4040686a1bb382d24e542735e
Instruction Fuzzy Hash: E15158B19002488FDB58CFA8D9847ADBFF2FF48300F248669E459EB792D7749980CB54

Function 005E5010 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005E50C8

Strings

`!^, xrefs: 005E50B9
@3^, xrefs: 005E50CD
recursive_directory_iterator::operator++, xrefs: 005E504C

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: @3^$`!^$recursive_directory_iterator::operator++
API String ID: 2659868963-2947506004
Opcode ID: 602214e5c16e4ae5fe36ca4731e25ca0b231a9e1f98745487a08a72beda30e0d
Instruction ID: db2d5d4aa9b76bfb5d077e86ffe0bcb1f1c93c93afae811a5074a7b9f8a75a8f
Opcode Fuzzy Hash: 602214e5c16e4ae5fe36ca4731e25ca0b231a9e1f98745487a08a72beda30e0d
Instruction Fuzzy Hash: CB319EB6800649EFC714DF55D845F8ABBF8FB08710F008669E95693A81EB74BA14CBA1

Function 0065B3C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0065B3DF
___std_exception_copy.LIBVCRUNTIME ref: 0065B406

Strings

`!^, xrefs: 0065B40E
`!^, xrefs: 0065B3D0, 0065B3F5

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!^$`!^
API String ID: 2659868963-985837307
Opcode ID: a02bca74e933e18426cce351e423eacf0e101129276786fca458bcced44c9a42
Instruction ID: 527a71d48f8d06e7ab8c1c285c1780f9dc0c61626dfd0144042a829860cabb11
Opcode Fuzzy Hash: a02bca74e933e18426cce351e423eacf0e101129276786fca458bcced44c9a42
Instruction Fuzzy Hash: EFF0C4B6501706AF8708DF59D405896FBE9FA54710301853FE52ACBB01E7B0E528CFA4

Function 005ED8B9 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 377COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32(00000000,00000128), ref: 005EDAB0
Process32Next.KERNEL32(00000000,?), ref: 005EDAF8

Strings

?, xrefs: 005EDCB9

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: NextProcess32
String ID: ?
API String ID: 1850201408-1684325040
Opcode ID: 1bc63751e1ca1fba439003deb85e9aff2efa1b94880a0d0fb59aefc719522ac9
Instruction ID: bebe3b675947c7d5d3a9a3a3cc50d05ae40ff39f707da84060058e0f118b2c69
Opcode Fuzzy Hash: 1bc63751e1ca1fba439003deb85e9aff2efa1b94880a0d0fb59aefc719522ac9
Instruction Fuzzy Hash: EDF15BB1D0526D9ADB64EB90CC45BEEBBBDFF14300F4004D9E549A6242EB705B88CF66

Function 0065A520 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 234COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0065A656

Strings

unexpected , xrefs: 0065A531
pected , xrefs: 0065A564

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: pected $unexpected
API String ID: 118556049-356062554
Opcode ID: a488096d346ddb20ad401a233e08d86b5c368dbbab1f4f7ebdf35b9828553d39
Instruction ID: 0cd099f2818222909a93f3ca8f3b833819512eae79f383cef40d639561c3fcd8
Opcode Fuzzy Hash: a488096d346ddb20ad401a233e08d86b5c368dbbab1f4f7ebdf35b9828553d39
Instruction Fuzzy Hash: 735114725001109FD728DF68DC84AAAB7A7EF84311F64476DFC168B346EB30ED898795

Function 005E3490 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005E34AF

Strings

`!^, xrefs: 005E34A0
@3^, xrefs: 005E34B7

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: @3^$`!^
API String ID: 2659868963-3143709943
Opcode ID: 1b8929309b989fd906d0b46a1a3df98cffa5b782f2ef3e10fe8a1e5ee489c443
Instruction ID: 810cbffb39fb53598f407c9d7f8b2259fe49039fe2a5ee4bfb632c087bf9d5ad
Opcode Fuzzy Hash: 1b8929309b989fd906d0b46a1a3df98cffa5b782f2ef3e10fe8a1e5ee489c443
Instruction Fuzzy Hash: D3F0A5B6604705AF8708CF5AD401896FBE9FB99710315853FE529C7B00E7B0E5248BA4

Function 005E3050 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005E3078

Strings

`!^, xrefs: 005E3080
`!^, xrefs: 005E3063

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!^$`!^
API String ID: 2659868963-985837307
Opcode ID: 380b2eabaced5ce806821a513ae90f975fd8139c557d6744c0c5c56a205fc9de
Instruction ID: b08afc3fbc825b5a607e2ca7b68de38c7852650a7e8d0dd1c9b3275b641124b0
Opcode Fuzzy Hash: 380b2eabaced5ce806821a513ae90f975fd8139c557d6744c0c5c56a205fc9de
Instruction Fuzzy Hash: 39E0EDB69113489BC710DFA9980598AFFE8AB29701F0086AAE948D7201F6B195548BD5

Function 005E75E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 005E75F1
___std_exception_destroy.LIBVCRUNTIME ref: 005E7600

Strings

`!^, xrefs: 005E75E9, 005E75F9

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: `!^
API String ID: 4194217158-3084548898
Opcode ID: 6af2f6ca4a4222366114cc7910663b7b92fdd21c539ed3f4db77e6fd6beeb2fc
Instruction ID: ead81c73ef6245ed0f0bd59481c2749a48a8668d09b306ac10864bfc8ba96a36
Opcode Fuzzy Hash: 6af2f6ca4a4222366114cc7910663b7b92fdd21c539ed3f4db77e6fd6beeb2fc
Instruction Fuzzy Hash: D2E086F250075853C720AF559C09F9ABADD9F35705F04483EF95492701E7B1E65883E9

Function 005E3090 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005E30AE

Strings

`!^, xrefs: 005E30B6
`!^, xrefs: 005E309C

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!^$`!^
API String ID: 2659868963-985837307
Opcode ID: e84b3075c86c2e0b4b97d197977f03163f51781e32eade403ad7d41828cd44f3
Instruction ID: 5300f0e1582f6b8bccb0c77cb1c750a4f5998eb97474cb451135d2615a8de544
Opcode Fuzzy Hash: e84b3075c86c2e0b4b97d197977f03163f51781e32eade403ad7d41828cd44f3
Instruction Fuzzy Hash: 65E017B26053189FC718DF89E805996BFEDEB25754705843EF649DB301E6B1E8208FA8

Function 005E2230 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005E224E

Strings

`!^, xrefs: 005E223C
`!^, xrefs: 005E2256

Memory Dump Source

Source File: 00000005.00000002.2907261510.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000005.00000002.2907156931.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907261510.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907710982.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907778108.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907848920.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2907904187.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908247019.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908316691.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908379723.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908499591.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908545698.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908615437.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908660368.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908722240.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908778913.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908836616.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2908888904.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909086231.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909131231.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2909259980.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!^$`!^
API String ID: 2659868963-985837307
Opcode ID: 7b245721c2e8ade2686f08d10b9f482dd5c0efb40d90aae61a3297ba18e0be5f
Instruction ID: b7ad5ddfe473e00876ad52e5754bed08428ee662793d67631ea87400271f381c
Opcode Fuzzy Hash: 7b245721c2e8ade2686f08d10b9f482dd5c0efb40d90aae61a3297ba18e0be5f
Instruction Fuzzy Hash: F9E017B2A053149BC718DF89E801996BFEDEB25754705C43EF649DB301E7B0E8208BA8

Analysis Process: MPGPH131.exePID: 2932, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	813
Total number of Limit Nodes:	92

Executed Functions

Function 005F7DC0 Relevance: 19.8, APIs: 7, Strings: 3, Instructions: 2344COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,00000104,?,?,?), ref: 005F8006
GetFileAttributesA.KERNELBASE(?,00000001,?,?,?,?), ref: 005F815D
__Mtx_unlock.LIBCPMT ref: 005F8186
__Mtx_unlock.LIBCPMT ref: 005F8195
GetFileAttributesA.KERNELBASE(?,00000001,?,?,?,?,?,?), ref: 005F8751
__Mtx_unlock.LIBCPMT ref: 005F877A

Part of subcall function 006506C0: Concurrency::cancel_current_task.LIBCPMT ref: 00650807

__Mtx_unlock.LIBCPMT ref: 005F87D7

Strings

+, xrefs: 005F9B19
131, xrefs: 005F7E37, 005F7E3E, 005F7E44, 005F7EB2, 005F7EB9, 005F7EBF, 005F7F2A, 005F7F31, 005F7F37, 005F9A45, 005F9A4C, 005F9A52
\, xrefs: 005F8896

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$AttributesFile$Concurrency::cancel_current_taskNameUser
String ID: +$131$\
API String ID: 2365767635-78135455
Opcode ID: 698970cc4c780884950580247b462d727b2abcae487bfa1b8f90566b89ee4e7b
Instruction ID: 826b65aac78df76d66d4936fbc6d61cbf7f3cfefe4063941b53d12f727e5f205
Opcode Fuzzy Hash: 698970cc4c780884950580247b462d727b2abcae487bfa1b8f90566b89ee4e7b
Instruction Fuzzy Hash: EB238D709002598FDB28CF68CC84BEEBBB5BF05304F2481EDD509AB282D7759A85CF95

Function 005F5B90 Relevance: 18.2, APIs: 5, Strings: 4, Instructions: 2429COMMON

Download Yara Rule

Strings

\, xrefs: 005F69E5
*, xrefs: 005F7A17
131, xrefs: 005F6037, 005F603E, 005F6044, 005F60BA, 005F60C1, 005F60C7, 005F613A, 005F6141, 005F6147
D, xrefs: 005F5BCD

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID: *$131$D$\
API String ID: 0-1470618592
Opcode ID: 8598f5cabd0a5c41ac84e869a89e2b117a14d8b704c1ba31bb3e614e282f99f3
Instruction ID: 4607807d4be3e4c79f82d17451d8add0cfae54ff682f38e034ff6c843e2f0fa2
Opcode Fuzzy Hash: 8598f5cabd0a5c41ac84e869a89e2b117a14d8b704c1ba31bb3e614e282f99f3
Instruction Fuzzy Hash: DE239D709002588FDB68CF68CC84BEEBBB5BF09304F1441EDD549AB282E7759A85CF95

Function 005EB6A0 Relevance: 16.6, APIs: 5, Strings: 4, Instructions: 840
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,C0D5DDC2,00000000,00020019,00000000,FAF8FCC4,FAF8FCC5), ref: 005EB947

Strings

_, xrefs: 005EBB32
_, xrefs: 005EBAC6
_, xrefs: 005EBB25
:, xrefs: 005EB443

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Open
String ID: :$_$_$_
API String ID: 71445658-4119709311
Opcode ID: 392c2410b4c14f3e4bb990687df2e1fd5808172aafefab5fc9206d059a0459cc
Instruction ID: 931ccb8799fc0e960de74f5d4065b441196c4630b41b51edf3e21b3853550c0e
Opcode Fuzzy Hash: 392c2410b4c14f3e4bb990687df2e1fd5808172aafefab5fc9206d059a0459cc
Instruction Fuzzy Hash: 61729171D002599FEB18CF68CC94BEEBBB6BF45304F1481ADE449AB282D7749A85CF50

Function 005FE0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 005FE0CB
socket.WS2_32(?,?,?,?,?,?,00717320,?,?,?,?,?,?), ref: 005FE17F
connect.WS2_32(00000000,?,00000000,?,?,?,00717320,?,?,?,?,?,?), ref: 005FE193
closesocket.WS2_32(00000000), ref: 005FE19E

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: 9282defdcc649b618e162b627092d5b03f75c6e4733b7bfde1859186feb6374c
Instruction ID: b3ebcae118c746845e7b5c7a3a6e93bb26e3bf543a709c9c93aa8bebe3e50caf
Opcode Fuzzy Hash: 9282defdcc649b618e162b627092d5b03f75c6e4733b7bfde1859186feb6374c
Instruction Fuzzy Hash: 1C31B6716053045BE7209F258849B6BBBE4FBC5764F004F1DF9A4A62E0D33999048B92

Function 006BF290 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005E220E

Strings

`!^, xrefs: 005E2216
`!^, xrefs: 005E21FC

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!^$`!^
API String ID: 2659868963-985837307
Opcode ID: bc8ceb2c76924f206182f052f298989bd0a343bbd9bcc19d4f57e16a143a29f4
Instruction ID: e94f8ef04def47f14dcc88fbf19d73d15d711668984b3a8775314f87b7d1d840
Opcode Fuzzy Hash: bc8ceb2c76924f206182f052f298989bd0a343bbd9bcc19d4f57e16a143a29f4
Instruction Fuzzy Hash: 5B01207550030DA7CB18AF99DC059D57BDEDA00310F50843DFA18DB651E770E590C794

Function 005EA690 Relevance: 4.6, APIs: 3, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE ref: 005EA6BF
__Mtx_unlock.LIBCPMT ref: 005EA6EE
__Mtx_unlock.LIBCPMT ref: 005EA733

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$AttributesFile
String ID:
API String ID: 1886074773-0
Opcode ID: 87ea4ac7bf507aff71a37a562f04a3ff30bbd1200ca6f0c11287343e4a4a29f8
Instruction ID: c67b08ecc76a84ee1085e5898f284efbfb2b7d43caef2053dda2b944e1132c74
Opcode Fuzzy Hash: 87ea4ac7bf507aff71a37a562f04a3ff30bbd1200ca6f0c11287343e4a4a29f8
Instruction Fuzzy Hash: 6E0149E1E401A0229E7C21BA2C464FB6D49985376871D8D26FCD1DB257F44BEE8082E3

Function 00650560 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 006506AE

Strings

5_, xrefs: 00650560

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: 5_
API String ID: 118556049-1161999416
Opcode ID: 704878a6fb962aec51445f9c7907984ce5d7d965d91800b1a8fb89f3cbd27ced
Instruction ID: 621670e01086a16ed09b242363608e4a2a7c6520bd4230c6ee20ac2c4a5d64cb
Opcode Fuzzy Hash: 704878a6fb962aec51445f9c7907984ce5d7d965d91800b1a8fb89f3cbd27ced
Instruction Fuzzy Hash: C641F672A001149BDB15DF68DD80AAE7BA6EF85311F1401ADFC15DB302EB30DE658BE5

Function 005EA090 Relevance: 3.3, APIs: 2, Instructions: 342
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 005EA1B6
__fread_nolock.LIBCMT ref: 005EA343

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: c3b6ebdc6bdc5238eff1670e9f0308f10caecd4dd7de0264fed6f67307a1fac0
Instruction ID: fa3e0b59eb018f084bbdd9c798585d0462cabb8994c0ed21eeed4914b4550dfd
Opcode Fuzzy Hash: c3b6ebdc6bdc5238eff1670e9f0308f10caecd4dd7de0264fed6f67307a1fac0
Instruction Fuzzy Hash: 02B12470900284AFDB18DF69CC49BAEBFE9FF45300F10856DF4459B682D7B4AA41C7A6

Function 006D4623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c825a6aac7e6686e4bc2fd37150b3a452aa281e125bd09d457e0e87c7d4fbb5
Instruction ID: a13c429f1cafdf9861ded8d5526159d6acd1488c4acbd63ff361199e83d424c4
Opcode Fuzzy Hash: 1c825a6aac7e6686e4bc2fd37150b3a452aa281e125bd09d457e0e87c7d4fbb5
Instruction Fuzzy Hash: 74B1E170E04245ABDB119FA9D890BBEBBB7EF49300F14415EE544AB382DB74DD42CBA4

Function 006D549C Relevance: 1.7, APIs: 1, Instructions: 198
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000000,006C9087,?,00000000,00000000,00000000,?,00000000,?,006BE5B1,006C9087,00000000,006BE5B1,?,?), ref: 006D5622

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: e12083f92a3117e4f684bf0f27148b50a467f5280bfe74f551f15d1dcfdd8550
Instruction ID: 2386cef9b7b9d5ec5e3b5a51c18e803e71e11760ec1e493f33c1f1aa5c0c510b
Opcode Fuzzy Hash: e12083f92a3117e4f684bf0f27148b50a467f5280bfe74f551f15d1dcfdd8550
Instruction Fuzzy Hash: 9761CF71D04559AFDF11DFA8D884EEEBBBBAF49304F14014AE801A7755D735DA02CBA0

Function 006C4942 Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a2e1504c5850e8fe20b4dad3baba88650050e5f09559d2454b9620935fc08c7
Instruction ID: e3b3f6e926049fb13f97bb333c9eacba9229901be2eae458d2ca1c00716746a6
Opcode Fuzzy Hash: 0a2e1504c5850e8fe20b4dad3baba88650050e5f09559d2454b9620935fc08c7
Instruction Fuzzy Hash: 8351B570A00108AFDB14CF98C895FBABBB2EF49364F24815DF8499B356D7329E51CB94

Function 006D4B12 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,006D49F9,00000000,CF830579,00711140,0000000C,006D4AB5,006C8BBD,?), ref: 006D4B69

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 7c506a9bdf78cebb9e0fa72753cb897ec34ce4e911560c7ea630335fc439f6a7
Instruction ID: 7081d87a116f1d0c912f2b7fef8d253bf0b6591d68d577c003f73b3eae5f3813
Opcode Fuzzy Hash: 7c506a9bdf78cebb9e0fa72753cb897ec34ce4e911560c7ea630335fc439f6a7
Instruction Fuzzy Hash: 6E115532E0816457C66022746842BBE674B8BE23B0F39020FE8088B3C2EE74DC418198

Function 006CE05C Relevance: 1.6, APIs: 1, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00710DF8,006BE5B1,00000002,006BE5B1,00000000,?,?,?,006CE166,00000000,?,006BE5B1,00000002,00710DF8), ref: 006CE099

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d39fdac817ea6707f1c2d44ab327504007b298c03923ba6622c5d33ac1a1049e
Instruction ID: 4b2c4530dd6f5c6cd9de1249e5bd2e9a127e45e5db11dff9d37b4359315f9bff
Opcode Fuzzy Hash: d39fdac817ea6707f1c2d44ab327504007b298c03923ba6622c5d33ac1a1049e
Instruction Fuzzy Hash: 0F012632714155ABCF15CF18CC05EAE3B2ADB85330B24024DF8509B291FAB2EA618BD0

Function 006D63F3 Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,006BD6FA,00000004,?,006D5D79,00000001,00000364,00000004,00000007,000000FF,?,006C067B,00000002,00000000,?,?), ref: 006D6435

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: dd70c29814824660030c03807416df8c0f2fcd07cfc58b555f5ccd5f486424c2
Instruction ID: 16270d57eba96166127d7fa5164fd6c2d49d650dbf805420d65665565d533175
Opcode Fuzzy Hash: dd70c29814824660030c03807416df8c0f2fcd07cfc58b555f5ccd5f486424c2
Instruction Fuzzy Hash: E4F05431D05224669B616F66DC06B9B3BDB9B85764B15C067FC0496380CBA0E81146F5

Function 006D6E2D Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000004,00000000,?,006C067B,00000002,00000000,?,?,?,005E303D,006BD6FA,00000004,00000000,006BD6FA), ref: 006D6E60

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 21ed96c9941d739d9a3a6a6813b1c64fd9002d149d24ceefd233996655551bda
Instruction ID: d5ae9e3cd06139bca7e54e3b72637d2302153c6d613c7d602057d7f6a62a3cb3
Opcode Fuzzy Hash: 21ed96c9941d739d9a3a6a6813b1c64fd9002d149d24ceefd233996655551bda
Instruction Fuzzy Hash: A7E0ED39D48625A6DA3026A5CC00BEB778FCB823A1F050927FE04963D0CB60C80181E8

Non-executed Functions

Function 00663F80 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 263libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,DCFDFBC6), ref: 006640CC
GetProcAddress.KERNEL32(00000000,DCFDFBC6), ref: 00664116
GetProcAddress.KERNEL32(00000000,DCFDFBC6), ref: 0066414E
GetProcAddress.KERNEL32(00000000,DCFDFBC6), ref: 00664196
GetProcAddress.KERNEL32(00000000,DCFDFBC6), ref: 006641E9

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36, xrefs: 00664037

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
API String ID: 190572456-383447037
Opcode ID: c320df49a645d4c2508f90a401a709f66bb6b191b03c5bf2132a2f12d390c5a4
Instruction ID: 785bcbe4225f46ba508c4485db62e4dbad8d74276a9eb90a5671c12b8630e6d7
Opcode Fuzzy Hash: c320df49a645d4c2508f90a401a709f66bb6b191b03c5bf2132a2f12d390c5a4
Instruction Fuzzy Hash: 63C14DB08183999FDB04CFA8D495BEDBFF9EF19304F1040AEE845AB252E7744509CB69

Function 006C84A0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f97ce6278b5da815f6c389bae476adc5dc884afc24939f4c376b69ad4ad6edd
Instruction ID: 35e5b952324dbe5d5ab8348961ccb54105ad1c26cfab47d5d8da423fd14e921f
Opcode Fuzzy Hash: 3f97ce6278b5da815f6c389bae476adc5dc884afc24939f4c376b69ad4ad6edd
Instruction Fuzzy Hash: 50020B71E012199FDF24CFA9C880BEEBBB2FF48314F25826DD519A7341DB31A9418B94

Function 0064F810 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0064F833
std::_Lockit::_Lockit.LIBCPMT ref: 0064F855
std::_Lockit::~_Lockit.LIBCPMT ref: 0064F875
std::_Lockit::~_Lockit.LIBCPMT ref: 0064F89F
std::_Lockit::_Lockit.LIBCPMT ref: 0064F90D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0064F959
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0064F973
std::_Lockit::~_Lockit.LIBCPMT ref: 0064FA08
std::_Facet_Register.LIBCPMT ref: 0064FA15

Strings

"p, xrefs: 0064F96B, 0064F972
bad locale name, xrefs: 0064FA2F

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$"p
API String ID: 3375549084-3171176342
Opcode ID: 7aa2c72839345ba2a3351bdc47133f54cc2a929e7d355cde31e1148d17aec5b7
Instruction ID: ce597d6b4fae1cf081d736e30517dd115e594cb7dd165c2c0c0c4dc7372078b9
Opcode Fuzzy Hash: 7aa2c72839345ba2a3351bdc47133f54cc2a929e7d355cde31e1148d17aec5b7
Instruction Fuzzy Hash: 95617EB1D00248DFEF10DFA8D845BDEBBB6AF14310F148568E805AB381EB75E945CBA5

Function 005E8D70 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(F8F7E6FF,?,?,007156BC), ref: 005E8E0E
GetProcAddress.KERNEL32(00000000,E1D7E6DF), ref: 005E8E1B
GetModuleHandleA.KERNEL32(F8F7E6FF), ref: 005E8E85
GetProcAddress.KERNEL32(00000000,E1C2E6DF), ref: 005E8E8C
CloseHandle.KERNEL32(00000000), ref: 005E9092
CloseHandle.KERNEL32(00000000), ref: 005E90F4
CloseHandle.KERNEL32(00000000), ref: 005E9121

Strings

File, xrefs: 005E8F73
}Vn, xrefs: 005E8EC8, 005E8EC5
}Vn, xrefs: 005E90F6

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Handle$Close$AddressModuleProc
String ID: File$}Vn$}Vn
API String ID: 4110381430-1811535537
Opcode ID: d70638dc2a6a635cc957d16cf946a72a1fa66fd67d0beaf1d8f075270a7a3942
Instruction ID: 1cd2c346e452ac5b22c90c0b417bca579a0c1b15b7c4db45e036255feb5d2f49
Opcode Fuzzy Hash: d70638dc2a6a635cc957d16cf946a72a1fa66fd67d0beaf1d8f075270a7a3942
Instruction Fuzzy Hash: FBC18D70D002999BEF24DFA5CC85BAEBBB9FF04300F50406DE944BB282DB759A45CB65

Function 005E3D10 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 152COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005E3E7F

Strings

ios_base::eofbit set, xrefs: 005E3E41, 005E3E63
ios_base::badbit set, xrefs: 005E3E17
ios_base::failbit set, xrefs: 005E3D32
G>^, xrefs: 005E3DB8
G>^, xrefs: 005E3D2B, 005E3D67, 005E3D6A
@3^, xrefs: 005E3DBE, 005E3E9B
`!^, xrefs: 005E3E70
@3^, xrefs: 005E3E84

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: @3^$@3^$G>^$G>^$`!^$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-3207115525
Opcode ID: a1e167198c0edcf480cfa73e5b4090e4a6114dbe965f9ede2e11dfc9446e6166
Instruction ID: be67246fe3a6c0bad200ac019c19242625935175ca8ca25768e86609e8068661
Opcode Fuzzy Hash: a1e167198c0edcf480cfa73e5b4090e4a6114dbe965f9ede2e11dfc9446e6166
Instruction Fuzzy Hash: 9F41B4B2900248AFC708DF59CC49BAEBBF9FF49310F14856EF955D7641E770AA008BA4

Function 006C2E10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 006C2E47
___except_validate_context_record.LIBVCRUNTIME ref: 006C2E4F
_ValidateLocalCookies.LIBCMT ref: 006C2ED8
__IsNonwritableInCurrentImage.LIBCMT ref: 006C2F03
_ValidateLocalCookies.LIBCMT ref: 006C2F58

Strings

iq, xrefs: 006C2F78
csm, xrefs: 006C2EED

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: iq$csm
API String ID: 1170836740-2322788918
Opcode ID: a356d2be9958ce262c464a5f1c8514f14c16c0b6e0aaa860930b98369cf78690
Instruction ID: a706ce119ac4be38d775afb936fa536409232340db4a5c742e1839363dc8f508
Opcode Fuzzy Hash: a356d2be9958ce262c464a5f1c8514f14c16c0b6e0aaa860930b98369cf78690
Instruction Fuzzy Hash: EF419134A0020A9BCB10DF68C895FEEBBB6EF49314F14805DEC14AB392D731EA45CB90

Function 005E3DE0 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 79COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005E3E7F

Strings

ios_base::eofbit set, xrefs: 005E3E28, 005E3E41, 005E3E63
ios_base::badbit set, xrefs: 005E3E17
ios_base::failbit set, xrefs: 005E3D32, 005E3E1E
@3^, xrefs: 005E3DBE, 005E3E9B
`!^, xrefs: 005E3E70
@3^, xrefs: 005E3E84

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: @3^$@3^$`!^$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-535810501
Opcode ID: 406dc474efa465bcd219bbc36c74c4635f25b50a54c2cbe85e178bb6006d7667
Instruction ID: cb5d984c4f9a2cd1018b0fe4a11a8b2f30a5db11a23a93438b5fa7becf037b56
Opcode Fuzzy Hash: 406dc474efa465bcd219bbc36c74c4635f25b50a54c2cbe85e178bb6006d7667
Instruction Fuzzy Hash: 1A21EEB3500345ABC718DF59D809F96BBDCBB44310F14887EFA988B641E774E914CB95

Function 005E6F40 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 349COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005E7340

Strings

parse error, xrefs: 005E6FFF, 005E7018
parse_error, xrefs: 005E6F8B
`!^, xrefs: 005E734B
`!^, xrefs: 005E7328
u^, xrefs: 005E7352

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!^$`!^$parse error$parse_error$u^
API String ID: 2659868963-3588640227
Opcode ID: 96e4b53c47f70ecbcfdc5ee9a362f6256be67672fc5c53a38587b8eeb9d9bcb0
Instruction ID: 71c7deccd4a6390633cc7c7b46d384c605d062ab9284f6003387e50de9828908
Opcode Fuzzy Hash: 96e4b53c47f70ecbcfdc5ee9a362f6256be67672fc5c53a38587b8eeb9d9bcb0
Instruction Fuzzy Hash: F5E16D719042488FDB58CF68C884B9DBBB2FF48300F24866DE458EB792D7749A81CF55

Function 005E7820 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005E799A
___std_exception_copy.LIBVCRUNTIME ref: 005E7B75

Strings

out_of_range, xrefs: 005E7A27
`!^, xrefs: 005E79A5, 005E7B80
`!^, xrefs: 005E7985, 005E7B60
type_error, xrefs: 005E784A

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!^$`!^$out_of_range$type_error
API String ID: 2659868963-2822758601
Opcode ID: 4019c516f2f82b62e796e75ef782face80c5a8f67f2236dd931311d6cc02e3d0
Instruction ID: f090722619b0cb688438224bd3f5902fda0698fa266dfcc2e575e12fe33bf28d
Opcode Fuzzy Hash: 4019c516f2f82b62e796e75ef782face80c5a8f67f2236dd931311d6cc02e3d0
Instruction Fuzzy Hash: 5FC158B19002489FDB58CFA8D884B9DBBF6FF48300F14866DE459EB792E7749980CB54

Function 005E73B0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 184COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 005E75BE
___std_exception_destroy.LIBVCRUNTIME ref: 005E75CD

Strings

yo^, xrefs: 005E7455
at line , xrefs: 005E73F7
, column , xrefs: 005E7434, 005E744A
`!^, xrefs: 005E75B6, 005E75C6

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column $`!^$yo^
API String ID: 4194217158-262291558
Opcode ID: f389948c6c52c14b67ee78f4fe6b4bfda679fa01324f67328ba931072655488e
Instruction ID: 0a013b8861c3c4990ae5cc52710d9ea3714a46b88a47f8fc85044f53f2baf42a
Opcode Fuzzy Hash: f389948c6c52c14b67ee78f4fe6b4bfda679fa01324f67328ba931072655488e
Instruction Fuzzy Hash: 7E61F571A002499FDB0CCF68DC84BADBBB6FF48300F24462DF455A7782D774AA408B94

Function 005E39F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 005E3A58
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 005E3AA4
__Getctype.LIBCPMT ref: 005E3ABA
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 005E3AE6
std::_Lockit::~_Lockit.LIBCPMT ref: 005E3B7B

Strings

bad locale name, xrefs: 005E3B96

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: a50f3266298faa2dbf8d77462a04a12d52bd1765b6b7d6918e3402f3316bd8d4
Instruction ID: cc21b3653f9bdf4487c2a5149338688b3936f2470c9220968b8795935c4694f2
Opcode Fuzzy Hash: a50f3266298faa2dbf8d77462a04a12d52bd1765b6b7d6918e3402f3316bd8d4
Instruction Fuzzy Hash: DF518FB1D002489BEF14DFA5D885BDEBBB8BF14310F14406DE849AB381E775DA44CBA5

Function 005EB1A0 Relevance: 10.6, APIs: 7, Instructions: 133memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000001C), ref: 005EB1F0
LocalAlloc.KERNEL32(00000040,0000001C,?,00000000,00000000), ref: 005EB239
SetupDiGetDeviceInterfaceDetailA.SETUPAPI(?,00000000,00000000,00000000,?,00000000), ref: 005EB26D
SetupDiGetDeviceInterfaceDetailA.SETUPAPI(?,?,00000000,?,00000000,00000000), ref: 005EB28F
LocalFree.KERNEL32(?,?,?,?,?,00000000,?,00000000,00000000), ref: 005EB2C0
LocalFree.KERNEL32(?,?,?,00000000,?,00000000,00000000), ref: 005EB2C5
LocalFree.KERNEL32(?,?,?,00000000,?,00000000,00000000), ref: 005EB2C8

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocDetailDeviceInterfaceSetup
String ID:
API String ID: 4232148138-0
Opcode ID: d1c9b4f887084d51ca7e659bf52d208bc36596985cfe7887dfc9ce3f2acae87a
Instruction ID: d7ce2470db9ac936b1682fe3b3286ce58d298316d030d0f081534b09bf3bb9ff
Opcode Fuzzy Hash: d1c9b4f887084d51ca7e659bf52d208bc36596985cfe7887dfc9ce3f2acae87a
Instruction Fuzzy Hash: EE413AB5A40349AFDB60DFA9DC41BAEBBF9FF48700F10452AE559E7690E770A9008B50

Function 006CD513 Relevance: 9.3, APIs: 6, Instructions: 285COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 006CD69B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006CD6B7
__allrem.LIBCMT ref: 006CD6CE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006CD6EC
__allrem.LIBCMT ref: 006CD703
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006CD721

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 7222d4fbd83bf911f66e88245ad854337fd27cd591c1530f5d5dc897f2461532
Instruction ID: 48a856060aff5c9cfbb3f85407cc616c122fa544787b4e28f7136243ed06ba6f
Opcode Fuzzy Hash: 7222d4fbd83bf911f66e88245ad854337fd27cd591c1530f5d5dc897f2461532
Instruction Fuzzy Hash: 7E81B4B2A00705ABD720AA69DC41FBA73EBEF41724F24463EF415D7781EB74D9008BA4

Function 0064DE70 Relevance: 9.1, APIs: 6, Instructions: 104COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0064DE93
std::_Lockit::_Lockit.LIBCPMT ref: 0064DEB6
std::_Lockit::~_Lockit.LIBCPMT ref: 0064DED6
std::_Facet_Register.LIBCPMT ref: 0064DF4B
std::_Lockit::~_Lockit.LIBCPMT ref: 0064DF63
Concurrency::cancel_current_task.LIBCPMT ref: 0064DF7B

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 4ed6bffd0b78159ff407af31dbd954671e8a6a5e5303b1d9258154c91553364c
Instruction ID: ad128decd795e6f4fb8bb067ab2e4cd2f2b68e7507bb84957efef601b003deb0
Opcode Fuzzy Hash: 4ed6bffd0b78159ff407af31dbd954671e8a6a5e5303b1d9258154c91553364c
Instruction Fuzzy Hash: 1A31EFB1D00256DFCB64DF48D880AEEBBB6FB00720F148299E8166B392D731AD45CBD5

Function 005E4C50 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 345COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 005E4F72
___std_exception_destroy.LIBVCRUNTIME ref: 005E4FFF

Strings

: ", xrefs: 005E4DA1
", ", xrefs: 005E4DCB
`!^, xrefs: 005E4F6B, 005E4FF8

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: ", "$: "$`!^
API String ID: 4194217158-1246380630
Opcode ID: 469bfa3249d7d0d453234af32832c2024593ae1d1879c7a3f5db4ad7cb7ecb15
Instruction ID: 9d4ecd15a9fb4cb3803a870d02549764480b424ce4b5c487b1776da080fb8fa0
Opcode Fuzzy Hash: 469bfa3249d7d0d453234af32832c2024593ae1d1879c7a3f5db4ad7cb7ecb15
Instruction Fuzzy Hash: D1C1F2719002448FDB28DF69C885BAEBBFAFF44300F14492DE49697782E774A944CBA5

Function 005EA750 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

\*.*, xrefs: 005EA7E7

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID: \*.*
API String ID: 0-1173974218
Opcode ID: f9d33ad8415a2213b6c63c4fafee7cfd17aff15e67ec92f13b5557ef2d0240b6
Instruction ID: c970ecd9929ef75b8097d8b7739a4bd0ab55f1925b006fc35dbdcb5d1241d3bb
Opcode Fuzzy Hash: f9d33ad8415a2213b6c63c4fafee7cfd17aff15e67ec92f13b5557ef2d0240b6
Instruction Fuzzy Hash: BBA1C2709002899FDB18DFB9C9947EEBFB6FF48310F104529E491E7282D770A985CB66

Function 005E3190 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 170COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005E32C6
___std_exception_destroy.LIBVCRUNTIME ref: 005E3350

Strings

`!^, xrefs: 005E32D1
`!^, xrefs: 005E32AD, 005E3349
@3^, xrefs: 005E3316

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: @3^$`!^$`!^
API String ID: 2970364248-1577654005
Opcode ID: d109883bd55ba2f7dfcc1521371c8576c4f4afe41f0e331bad2ed7a73cb87214
Instruction ID: 422a81c6e04e715ea09989a2445efeb52ca69406a98966cbd1387b5847a8e03f
Opcode Fuzzy Hash: d109883bd55ba2f7dfcc1521371c8576c4f4afe41f0e331bad2ed7a73cb87214
Instruction Fuzzy Hash: 7C519C759002589FDB18CF98D889BEEBBB6FF48300F14812EE855A7392D7749A41CB94

Function 005E3370 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

APIs

Part of subcall function 005E3190: ___std_exception_copy.LIBVCRUNTIME ref: 005E32C6

___std_exception_copy.LIBVCRUNTIME ref: 005E345F

Strings

+4^, xrefs: 005E33B3, 005E3410
@3^, xrefs: 005E33F3, 005E347B
`!^, xrefs: 005E3450
@3^, xrefs: 005E3464

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: +4^$@3^$@3^$`!^
API String ID: 2659868963-1877915259
Opcode ID: 1112750ba11c832e4ee43f4b265f4be5aa83058f2b7514e55cd3bba508bf219e
Instruction ID: eefbd888b26400e8744f0fd53b75aee4a205a8e466fe3fc9906cff9e993418c0
Opcode Fuzzy Hash: 1112750ba11c832e4ee43f4b265f4be5aa83058f2b7514e55cd3bba508bf219e
Instruction Fuzzy Hash: 9031A2B29002499FCB18DFA9D845AAEFFF9FB48710F10852EE514D7641E770A650CB94

Function 005E3410 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 47COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005E345F

Strings

+4^, xrefs: 005E33B3, 005E3410
@3^, xrefs: 005E33F3, 005E347B
`!^, xrefs: 005E3450
@3^, xrefs: 005E3464

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: +4^$@3^$@3^$`!^
API String ID: 2659868963-1877915259
Opcode ID: fa909f59a189929e4be73e45fe020132d58692f46218755354ced847ba4093e8
Instruction ID: d410605c97ee4df992438e68a59f24d2a626607e28a96a9b5ffaa829754c472b
Opcode Fuzzy Hash: fa909f59a189929e4be73e45fe020132d58692f46218755354ced847ba4093e8
Instruction Fuzzy Hash: D901FFB650030AAF8708DFA9D445C96FBFDFF58710710846AE51987611EBB0E554CB94

Function 0064D050 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0064D06F
___std_exception_copy.LIBVCRUNTIME ref: 0064D096

Strings

`!^, xrefs: 0064D09B
u^, xrefs: 0064D0A5
`!^, xrefs: 0064D060, 0064D085

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!^$`!^$u^
API String ID: 2659868963-2492332708
Opcode ID: dd1def0ff16d497944d201b012077c8bc6c966005e92632583c57d8a32d5e22e
Instruction ID: 9cad35764ec978474cc63aabc3895d499ff1912013720ef161d5ab616e6513b9
Opcode Fuzzy Hash: dd1def0ff16d497944d201b012077c8bc6c966005e92632583c57d8a32d5e22e
Instruction Fuzzy Hash: C001A4B6501706AF8704DF59D405892FBF9FB58710701852FE529CBB11E7B0E528CFA4

Function 005F3AA0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 383COMMON

Download Yara Rule

Strings

abcdefghijklmnopqrstuvwxyz0123456789_ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 005F3BBB
\, xrefs: 005F3BF8
hrq, xrefs: 005F3E26

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID:
String ID: \$abcdefghijklmnopqrstuvwxyz0123456789_ABCDEFGHIJKLMNOPQRSTUVWXYZ$hrq
API String ID: 0-287274543
Opcode ID: 68b3c1ad0263c76e692203be0ddc8fd00ed17c820e6a7b032293c7dbfbc7d1a7
Instruction ID: 6cd96ae5b6b8a3ae90dd9c6afe2321c2d6dcd10e25c22f7f51e6560d0b06de20
Opcode Fuzzy Hash: 68b3c1ad0263c76e692203be0ddc8fd00ed17c820e6a7b032293c7dbfbc7d1a7
Instruction Fuzzy Hash: 37E1A271D002499FEB08CFA8C8857EDBBB5FF44300F14826DE515AB382D7799A85CBA0

Function 005E6C60 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 247COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 005E6F11
___std_exception_destroy.LIBVCRUNTIME ref: 005E6F20

Strings

[json.exception., xrefs: 005E6CB8
`!^, xrefs: 005E6F09, 005E6F19

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.$`!^
API String ID: 4194217158-1084409180
Opcode ID: a240104034051146a43101b4de89cd38ced386b663d615c1b35dc24524215f6e
Instruction ID: bbb90b0123d943d23f9c415c546ff84419f8fc23d1c2dace56f9b3acc5ea2c56
Opcode Fuzzy Hash: a240104034051146a43101b4de89cd38ced386b663d615c1b35dc24524215f6e
Instruction Fuzzy Hash: D091D271A002449FDB1CCF68C984B9EBBF6FF54340F20866CE459AB792D770AA81CB50

Function 005EAF30 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000001), ref: 005EAF8A
GetSystemMetrics.USER32(00000000), ref: 005EAF90

Strings

d, xrefs: 005EAF4B
image/png, xrefs: 005EB063

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID: d$image/png
API String ID: 4116985748-2616758285
Opcode ID: 81da90dbcc8a9ae671d21dc1fccd5ab38a7571a9179c13cf4e327eeac9cf514a
Instruction ID: 1f34a4185c481c2dc0292b08acb79854823dd51b98179627658b5493116c9792
Opcode Fuzzy Hash: 81da90dbcc8a9ae671d21dc1fccd5ab38a7571a9179c13cf4e327eeac9cf514a
Instruction Fuzzy Hash: E0518CB1504341AFE710DF21C898B6BBBE9FB85754F001D2DF89493240E772E904CB96

Function 005E7620 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 167COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005E77B4

Strings

invalid_iterator, xrefs: 005E7656
`!^, xrefs: 005E77BF
`!^, xrefs: 005E779F

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!^$`!^$invalid_iterator
API String ID: 2659868963-3096502865
Opcode ID: e2b525b3f60da3140a54e3b89b91dbedebeddaf82b38193110b0270113e0605c
Instruction ID: 12db1614c9155171e14a524e4480d4f71ea3cb89d4b7682171ffbde780990e6d
Opcode Fuzzy Hash: e2b525b3f60da3140a54e3b89b91dbedebeddaf82b38193110b0270113e0605c
Instruction Fuzzy Hash: 5A5137B19002489FDB18CFA8D89479DBBF2FB48300F14866DE459EB792E7749980CB94

Function 005E7BE0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 156COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005E7D67

Strings

other_error, xrefs: 005E7C0A
`!^, xrefs: 005E7D72
`!^, xrefs: 005E7D52

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!^$`!^$other_error
API String ID: 2659868963-1867354975
Opcode ID: 64f2e1ef643a0f219b63c7a361f7631c67473ab4040686a1bb382d24e542735e
Instruction ID: 24e2cddd822ee45c3d9c62cf711e43237ce016351bda87547be3f2fd56f288df
Opcode Fuzzy Hash: 64f2e1ef643a0f219b63c7a361f7631c67473ab4040686a1bb382d24e542735e
Instruction Fuzzy Hash: E15158B19002488FDB58CFA8D9847ADBFF2FF48300F248669E459EB792D7749980CB54

Function 005E5010 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005E50C8

Strings

recursive_directory_iterator::operator++, xrefs: 005E504C
`!^, xrefs: 005E50B9
@3^, xrefs: 005E50CD

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: @3^$`!^$recursive_directory_iterator::operator++
API String ID: 2659868963-2947506004
Opcode ID: 602214e5c16e4ae5fe36ca4731e25ca0b231a9e1f98745487a08a72beda30e0d
Instruction ID: db2d5d4aa9b76bfb5d077e86ffe0bcb1f1c93c93afae811a5074a7b9f8a75a8f
Opcode Fuzzy Hash: 602214e5c16e4ae5fe36ca4731e25ca0b231a9e1f98745487a08a72beda30e0d
Instruction Fuzzy Hash: CB319EB6800649EFC714DF55D845F8ABBF8FB08710F008669E95693A81EB74BA14CBA1

Function 0065B3C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0065B3DF
___std_exception_copy.LIBVCRUNTIME ref: 0065B406

Strings

`!^, xrefs: 0065B40E
`!^, xrefs: 0065B3D0, 0065B3F5

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!^$`!^
API String ID: 2659868963-985837307
Opcode ID: a02bca74e933e18426cce351e423eacf0e101129276786fca458bcced44c9a42
Instruction ID: 527a71d48f8d06e7ab8c1c285c1780f9dc0c61626dfd0144042a829860cabb11
Opcode Fuzzy Hash: a02bca74e933e18426cce351e423eacf0e101129276786fca458bcced44c9a42
Instruction Fuzzy Hash: EFF0C4B6501706AF8708DF59D405896FBE9FA54710301853FE52ACBB01E7B0E528CFA4

Function 005ED8B9 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 377COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32(00000000,00000128), ref: 005EDAB0
Process32Next.KERNEL32(00000000,?), ref: 005EDAF8

Strings

?, xrefs: 005EDCB9

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: NextProcess32
String ID: ?
API String ID: 1850201408-1684325040
Opcode ID: 1bc63751e1ca1fba439003deb85e9aff2efa1b94880a0d0fb59aefc719522ac9
Instruction ID: bebe3b675947c7d5d3a9a3a3cc50d05ae40ff39f707da84060058e0f118b2c69
Opcode Fuzzy Hash: 1bc63751e1ca1fba439003deb85e9aff2efa1b94880a0d0fb59aefc719522ac9
Instruction Fuzzy Hash: EDF15BB1D0526D9ADB64EB90CC45BEEBBBDFF14300F4004D9E549A6242EB705B88CF66

Function 0065A520 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 234COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0065A656

Strings

pected , xrefs: 0065A564
unexpected , xrefs: 0065A531

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: pected $unexpected
API String ID: 118556049-356062554
Opcode ID: a488096d346ddb20ad401a233e08d86b5c368dbbab1f4f7ebdf35b9828553d39
Instruction ID: 0cd099f2818222909a93f3ca8f3b833819512eae79f383cef40d639561c3fcd8
Opcode Fuzzy Hash: a488096d346ddb20ad401a233e08d86b5c368dbbab1f4f7ebdf35b9828553d39
Instruction Fuzzy Hash: 735114725001109FD728DF68DC84AAAB7A7EF84311F64476DFC168B346EB30ED898795

Function 005E3490 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005E34AF

Strings

`!^, xrefs: 005E34A0
@3^, xrefs: 005E34B7

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: @3^$`!^
API String ID: 2659868963-3143709943
Opcode ID: 1b8929309b989fd906d0b46a1a3df98cffa5b782f2ef3e10fe8a1e5ee489c443
Instruction ID: 810cbffb39fb53598f407c9d7f8b2259fe49039fe2a5ee4bfb632c087bf9d5ad
Opcode Fuzzy Hash: 1b8929309b989fd906d0b46a1a3df98cffa5b782f2ef3e10fe8a1e5ee489c443
Instruction Fuzzy Hash: D3F0A5B6604705AF8708CF5AD401896FBE9FB99710315853FE529C7B00E7B0E5248BA4

Function 005E3050 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005E3078

Strings

`!^, xrefs: 005E3080
`!^, xrefs: 005E3063

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!^$`!^
API String ID: 2659868963-985837307
Opcode ID: 380b2eabaced5ce806821a513ae90f975fd8139c557d6744c0c5c56a205fc9de
Instruction ID: b08afc3fbc825b5a607e2ca7b68de38c7852650a7e8d0dd1c9b3275b641124b0
Opcode Fuzzy Hash: 380b2eabaced5ce806821a513ae90f975fd8139c557d6744c0c5c56a205fc9de
Instruction Fuzzy Hash: 39E0EDB69113489BC710DFA9980598AFFE8AB29701F0086AAE948D7201F6B195548BD5

Function 005E75E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 005E75F1
___std_exception_destroy.LIBVCRUNTIME ref: 005E7600

Strings

`!^, xrefs: 005E75E9, 005E75F9

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: `!^
API String ID: 4194217158-3084548898
Opcode ID: 6af2f6ca4a4222366114cc7910663b7b92fdd21c539ed3f4db77e6fd6beeb2fc
Instruction ID: ead81c73ef6245ed0f0bd59481c2749a48a8668d09b306ac10864bfc8ba96a36
Opcode Fuzzy Hash: 6af2f6ca4a4222366114cc7910663b7b92fdd21c539ed3f4db77e6fd6beeb2fc
Instruction Fuzzy Hash: D2E086F250075853C720AF559C09F9ABADD9F35705F04483EF95492701E7B1E65883E9

Function 005E3090 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005E30AE

Strings

`!^, xrefs: 005E30B6
`!^, xrefs: 005E309C

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!^$`!^
API String ID: 2659868963-985837307
Opcode ID: e84b3075c86c2e0b4b97d197977f03163f51781e32eade403ad7d41828cd44f3
Instruction ID: 5300f0e1582f6b8bccb0c77cb1c750a4f5998eb97474cb451135d2615a8de544
Opcode Fuzzy Hash: e84b3075c86c2e0b4b97d197977f03163f51781e32eade403ad7d41828cd44f3
Instruction Fuzzy Hash: 65E017B26053189FC718DF89E805996BFEDEB25754705843EF649DB301E6B1E8208FA8

Function 005E2230 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005E224E

Strings

`!^, xrefs: 005E2256
`!^, xrefs: 005E223C

Memory Dump Source

Source File: 00000006.00000002.2907712400.00000000005E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000006.00000002.2907651645.00000000005E0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2907712400.0000000000713000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908082573.0000000000718000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908151714.000000000071B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908212071.000000000071C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908274078.0000000000728000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908602477.0000000000889000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908650246.000000000088B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008A0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908724108.00000000008AE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908835451.00000000008B3000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908887511.00000000008B5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2908957824.00000000008DC000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909015175.00000000008DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909077040.00000000008E7000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909129320.00000000008F3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909204904.000000000090D000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000910000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.000000000094D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909265082.0000000000951000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909471331.000000000097B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.000000000097C000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909523685.0000000000982000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2909629551.0000000000992000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5e0000_MPGPH131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!^$`!^
API String ID: 2659868963-985837307
Opcode ID: 7b245721c2e8ade2686f08d10b9f482dd5c0efb40d90aae61a3297ba18e0be5f
Instruction ID: b7ad5ddfe473e00876ad52e5754bed08428ee662793d67631ea87400271f381c
Opcode Fuzzy Hash: 7b245721c2e8ade2686f08d10b9f482dd5c0efb40d90aae61a3297ba18e0be5f
Instruction Fuzzy Hash: F9E017B2A053149BC718DF89E801996BFEDEB25754705C43EF649DB301E7B0E8208BA8

Analysis Process: RageMP131.exePID: 7196, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	3.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	674
Total number of Limit Nodes:	82

Executed Functions

Function 00EA7E3E Relevance: 26.8, APIs: 7, Strings: 7, Instructions: 2282COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,00000104,?,?,?), ref: 00EA8006
GetFileAttributesA.KERNELBASE(?,00000001,?,?,?,?), ref: 00EA815D
__Mtx_unlock.LIBCPMT ref: 00EA8186
__Mtx_unlock.LIBCPMT ref: 00EA8195
GetFileAttributesA.KERNELBASE(?,?,0000005C,00000000,00000001), ref: 00EA8751
__Mtx_unlock.LIBCPMT ref: 00EA877A

Strings

131, xrefs: 00EA7E3E, 00EA7E44, 00EA7EB2, 00EA7EB9, 00EA7EBF, 00EA7F2A, 00EA7F31, 00EA7F37, 00EA9A45, 00EA9A4C, 00EA9A52
\, xrefs: 00EA8684
\, xrefs: 00EA8896
+, xrefs: 00EA9B19
P?Y, xrefs: 00EA85DC
Q>5, xrefs: 00EA9C24
*, xrefs: 00EA980E

Memory Dump Source

Source File: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2907743147.0000000000E90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2907795956.0000000000FC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908156570.0000000000FC8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908232459.0000000000FCB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908286537.0000000000FCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908346929.0000000000FD8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908661625.0000000001139000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908724803.000000000113B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.0000000001150000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908921946.0000000001163000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908954101.0000000001165000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909031254.000000000118C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909089565.000000000118D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909133057.0000000001197000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909191877.00000000011A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909296628.00000000011BD000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.0000000001201000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909634093.000000000122B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.000000000122C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.0000000001232000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909821477.0000000001242000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_RageMP131.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$AttributesFile$NameUser
String ID: *$+$131$P?Y$Q>5$\$\
API String ID: 1275484822-3500402200
Opcode ID: c1f378f2106f78e8289e93485c68759832ed14c59c2f979ad67da59b864a5484
Instruction ID: 8d77a7e0beb0e668f9600ba6fb525958ba027eab6b0e5a3e804ba379dbd065d7
Opcode Fuzzy Hash: c1f378f2106f78e8289e93485c68759832ed14c59c2f979ad67da59b864a5484
Instruction Fuzzy Hash: 51236C70D002598FDB28CF68CD94BEDBBB5EF0A304F1481E9D409AB282D775AA85CF51

Function 00E9B6A0 Relevance: 14.8, APIs: 4, Strings: 4, Instructions: 840
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,C0D5DDC2,00000000,00020019,00000000,FAF8FCC4,FAF8FCC5), ref: 00E9B947

Strings

_, xrefs: 00E9BB32
_, xrefs: 00E9BAC6
_, xrefs: 00E9BB25
:, xrefs: 00E9B443

Memory Dump Source

Source File: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2907743147.0000000000E90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2907795956.0000000000FC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908156570.0000000000FC8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908232459.0000000000FCB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908286537.0000000000FCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908346929.0000000000FD8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908661625.0000000001139000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908724803.000000000113B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.0000000001150000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908921946.0000000001163000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908954101.0000000001165000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909031254.000000000118C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909089565.000000000118D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909133057.0000000001197000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909191877.00000000011A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909296628.00000000011BD000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.0000000001201000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909634093.000000000122B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.000000000122C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.0000000001232000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909821477.0000000001242000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_RageMP131.jbxd

Yara matches

Similarity

API ID: Open
String ID: :$_$_$_
API String ID: 71445658-4119709311
Opcode ID: 70ffebfa1b60f9955c8cb520723815c5d093b4a693fbda1f050f815bfd0792a7
Instruction ID: b6e0d0fe0b94d8f4fb296563a0b2106b0af75ee1255cc69530e205780d85d31e
Opcode Fuzzy Hash: 70ffebfa1b60f9955c8cb520723815c5d093b4a693fbda1f050f815bfd0792a7
Instruction Fuzzy Hash: F6729EB0D002599FDF18CF68DD84BEEBBB5EF45304F1482A9E409AB282D7749A85CF51

Function 00EAE0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00EAE0CB
socket.WS2_32(?,?,?,?,?,?,00FC7320,?,?,?,?,?,?), ref: 00EAE17F
connect.WS2_32(00000000,?,00000000,?,?,?,00FC7320,?,?,?,?,?,?), ref: 00EAE193
closesocket.WS2_32(00000000), ref: 00EAE19E

Memory Dump Source

Source File: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2907743147.0000000000E90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2907795956.0000000000FC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908156570.0000000000FC8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908232459.0000000000FCB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908286537.0000000000FCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908346929.0000000000FD8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908661625.0000000001139000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908724803.000000000113B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.0000000001150000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908921946.0000000001163000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908954101.0000000001165000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909031254.000000000118C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909089565.000000000118D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909133057.0000000001197000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909191877.00000000011A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909296628.00000000011BD000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.0000000001201000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909634093.000000000122B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.000000000122C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.0000000001232000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909821477.0000000001242000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_RageMP131.jbxd

Yara matches

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: c08d960baeb82bdfb60cc3dc1f4e2558276660c23ee7632e9c8602661ce4f37d
Instruction ID: 29e9c83d04ab5fb2507d000b73cb6ffde612405f3c12740030bb700f3af9000f
Opcode Fuzzy Hash: c08d960baeb82bdfb60cc3dc1f4e2558276660c23ee7632e9c8602661ce4f37d
Instruction Fuzzy Hash: A231A6716053105BD7209F25C848B6BB7E4EBDA778F005F1DF9A8A73D0E375A9048BA2

Function 00F6F290 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E9220E

Strings

`!, xrefs: 00E921FC
`!, xrefs: 00E92216

Memory Dump Source

Source File: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2907743147.0000000000E90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2907795956.0000000000FC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908156570.0000000000FC8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908232459.0000000000FCB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908286537.0000000000FCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908346929.0000000000FD8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908661625.0000000001139000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908724803.000000000113B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.0000000001150000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908921946.0000000001163000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908954101.0000000001165000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909031254.000000000118C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909089565.000000000118D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909133057.0000000001197000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909191877.00000000011A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909296628.00000000011BD000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.0000000001201000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909634093.000000000122B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.000000000122C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.0000000001232000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909821477.0000000001242000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!$`!
API String ID: 2659868963-1501952390
Opcode ID: 2947e80119313c5cc6cfa7a6e4a312cd4c2607908f50143c00ac01ae7f9e235e
Instruction ID: 2d8a2bd02fedbb922ed61434f42bd9f6b1d975656323f17750e077b04987cb60
Opcode Fuzzy Hash: 2947e80119313c5cc6cfa7a6e4a312cd4c2607908f50143c00ac01ae7f9e235e
Instruction Fuzzy Hash: E9012B7650030DBBCF18AF99EC0299977EC9E00320B50843AFA1CDB551EB30E964E791

Function 00E9A690 Relevance: 4.6, APIs: 3, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE ref: 00E9A6BF
__Mtx_unlock.LIBCPMT ref: 00E9A6EE
__Mtx_unlock.LIBCPMT ref: 00E9A733

Memory Dump Source

Source File: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2907743147.0000000000E90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2907795956.0000000000FC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908156570.0000000000FC8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908232459.0000000000FCB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908286537.0000000000FCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908346929.0000000000FD8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908661625.0000000001139000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908724803.000000000113B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.0000000001150000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908921946.0000000001163000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908954101.0000000001165000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909031254.000000000118C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909089565.000000000118D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909133057.0000000001197000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909191877.00000000011A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909296628.00000000011BD000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.0000000001201000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909634093.000000000122B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.000000000122C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.0000000001232000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909821477.0000000001242000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_RageMP131.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$AttributesFile
String ID:
API String ID: 1886074773-0
Opcode ID: 5acc252c01e254c0f356256776501f55e642229fcd1451c64740f814c918b5da
Instruction ID: 6ce92deec9ecee20a71c52a317dbaa2780cc21892bdcb2b4c849710c4bdf5eeb
Opcode Fuzzy Hash: 5acc252c01e254c0f356256776501f55e642229fcd1451c64740f814c918b5da
Instruction Fuzzy Hash: FE012696A4422222DD3861346C8A9FB35088C5337C73D2936FC41E7247F84BCD10A1E3

Function 00F00560 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00F006AE

Strings

5, xrefs: 00F00560

Memory Dump Source

Source File: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2907743147.0000000000E90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2907795956.0000000000FC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908156570.0000000000FC8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908232459.0000000000FCB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908286537.0000000000FCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908346929.0000000000FD8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908661625.0000000001139000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908724803.000000000113B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.0000000001150000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908921946.0000000001163000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908954101.0000000001165000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909031254.000000000118C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909089565.000000000118D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909133057.0000000001197000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909191877.00000000011A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909296628.00000000011BD000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.0000000001201000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909634093.000000000122B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.000000000122C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.0000000001232000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909821477.0000000001242000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_RageMP131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: 5
API String ID: 118556049-2308513669
Opcode ID: a07ca5f35a0a00156a120fe7bc8c038a69de417eab0e42a5e54c1756a77a970a
Instruction ID: 65bf12aaeff75eb7880a0535d78b70e34b16454b01b5fb2f0f13efda15e576e8
Opcode Fuzzy Hash: a07ca5f35a0a00156a120fe7bc8c038a69de417eab0e42a5e54c1756a77a970a
Instruction Fuzzy Hash: BD41D872A001149BCB15DF68DC806AE77A6AF89350F14416AFC05DB382DB31DE60BBE1

Function 00E9A090 Relevance: 3.3, APIs: 2, Instructions: 342
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 00E9A1B6
__fread_nolock.LIBCMT ref: 00E9A343

Memory Dump Source

Source File: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2907743147.0000000000E90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2907795956.0000000000FC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908156570.0000000000FC8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908232459.0000000000FCB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908286537.0000000000FCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908346929.0000000000FD8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908661625.0000000001139000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908724803.000000000113B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.0000000001150000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908921946.0000000001163000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908954101.0000000001165000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909031254.000000000118C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909089565.000000000118D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909133057.0000000001197000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909191877.00000000011A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909296628.00000000011BD000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.0000000001201000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909634093.000000000122B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.000000000122C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.0000000001232000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909821477.0000000001242000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_RageMP131.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: c883d8104f7fea92100722174cb4c7c975409ea9e3a0d484f4364ea8b91af842
Instruction ID: 35cc63a75c90b994231203cf45e317d9ee0090e76e437ac7611749d81a485930
Opcode Fuzzy Hash: c883d8104f7fea92100722174cb4c7c975409ea9e3a0d484f4364ea8b91af842
Instruction Fuzzy Hash: 64B127B0900204AFDF18DF68CC45BAEBBE9EF41704F14856DF419AB682D7B9A941C7D2

Function 00F84623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2907743147.0000000000E90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2907795956.0000000000FC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908156570.0000000000FC8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908232459.0000000000FCB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908286537.0000000000FCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908346929.0000000000FD8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908661625.0000000001139000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908724803.000000000113B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.0000000001150000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908921946.0000000001163000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908954101.0000000001165000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909031254.000000000118C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909089565.000000000118D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909133057.0000000001197000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909191877.00000000011A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909296628.00000000011BD000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.0000000001201000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909634093.000000000122B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.000000000122C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.0000000001232000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909821477.0000000001242000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac5d241bada5adaf53f154f21f9e7645feab7e38bebdaa6352bea9aa08c86b50
Instruction ID: 71a0d9fe606a3c9e3654a612426c6d7ae905507c70ef8b1b8e95adeab20b3c3b
Opcode Fuzzy Hash: ac5d241bada5adaf53f154f21f9e7645feab7e38bebdaa6352bea9aa08c86b50
Instruction Fuzzy Hash: CAB11671E0424AAFDF11EFA8D841BFEBBB1AF49310F144159E444AB282C775BD42EB61

Function 00F8549C Relevance: 1.7, APIs: 1, Instructions: 198
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000000,00F79087,?,00000000,00000000,00000000,?,00000000,?,00F6E5B1,00F79087,00000000,00F6E5B1,?,?), ref: 00F85622

Memory Dump Source

Source File: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2907743147.0000000000E90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2907795956.0000000000FC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908156570.0000000000FC8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908232459.0000000000FCB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908286537.0000000000FCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908346929.0000000000FD8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908661625.0000000001139000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908724803.000000000113B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.0000000001150000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908921946.0000000001163000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908954101.0000000001165000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909031254.000000000118C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909089565.000000000118D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909133057.0000000001197000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909191877.00000000011A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909296628.00000000011BD000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.0000000001201000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909634093.000000000122B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.000000000122C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.0000000001232000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909821477.0000000001242000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_RageMP131.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 69e48a7b1b65ea67666eee5ce8a4985a4428ad12b48266b73d86a0b9d0aadb56
Instruction ID: 4edc72e45b72b788494eb50f7426596e4efeab2d3c79276a21c24daf82f0dcdc
Opcode Fuzzy Hash: 69e48a7b1b65ea67666eee5ce8a4985a4428ad12b48266b73d86a0b9d0aadb56
Instruction Fuzzy Hash: 9061C472D04519AFDF11EFA8CC44EEEBBBAAF49718F580145E804AB205D376D901EBA0

Function 00F74942 Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2907743147.0000000000E90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2907795956.0000000000FC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908156570.0000000000FC8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908232459.0000000000FCB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908286537.0000000000FCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908346929.0000000000FD8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908661625.0000000001139000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908724803.000000000113B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.0000000001150000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908921946.0000000001163000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908954101.0000000001165000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909031254.000000000118C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909089565.000000000118D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909133057.0000000001197000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909191877.00000000011A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909296628.00000000011BD000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.0000000001201000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909634093.000000000122B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.000000000122C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.0000000001232000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909821477.0000000001242000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d78ff1cf1a5fe9e37f37f694b754c0e9a79167784ae308d064960bdcc48c5d4a
Instruction ID: 2b5a453e1c5a6d49a6823a4b29fa72d2798730ed52ea56d0049daee44592ee43
Opcode Fuzzy Hash: d78ff1cf1a5fe9e37f37f694b754c0e9a79167784ae308d064960bdcc48c5d4a
Instruction Fuzzy Hash: 2C51E631A00108AFDF14CF58CC41EAABBB1EF49364F24C15AF84D9B252D335AE41EB91

Function 00EFA350 Relevance: 1.6, APIs: 1, Instructions: 121
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00EFA472

Memory Dump Source

Source File: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2907743147.0000000000E90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2907795956.0000000000FC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908156570.0000000000FC8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908232459.0000000000FCB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908286537.0000000000FCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908346929.0000000000FD8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908661625.0000000001139000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908724803.000000000113B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.0000000001150000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908921946.0000000001163000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908954101.0000000001165000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909031254.000000000118C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909089565.000000000118D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909133057.0000000001197000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909191877.00000000011A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909296628.00000000011BD000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.0000000001201000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909634093.000000000122B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.000000000122C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.0000000001232000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909821477.0000000001242000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_RageMP131.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 4ef009437b7ba5cefb7c7b7f7709c5d031e3a220ae5dbd6af41c3bc0398da16d
Instruction ID: 274acf1f1e1ebdfa3c8fa1762990dad8903925ab47dce715fd949eb1acb8991d
Opcode Fuzzy Hash: 4ef009437b7ba5cefb7c7b7f7709c5d031e3a220ae5dbd6af41c3bc0398da16d
Instruction Fuzzy Hash: 9E315CB16002089BDB289E68DC8497DB3D9DF44320B28523DFA6DDF392E6B0DD448752

Function 00F84B12 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,00F849F9,00000000,CF830579,00FC1140,0000000C,00F84AB5,00F78BBD,?), ref: 00F84B69

Memory Dump Source

Source File: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2907743147.0000000000E90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2907795956.0000000000FC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908156570.0000000000FC8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908232459.0000000000FCB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908286537.0000000000FCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908346929.0000000000FD8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908661625.0000000001139000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908724803.000000000113B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.0000000001150000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908921946.0000000001163000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908954101.0000000001165000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909031254.000000000118C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909089565.000000000118D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909133057.0000000001197000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909191877.00000000011A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909296628.00000000011BD000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.0000000001201000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909634093.000000000122B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.000000000122C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.0000000001232000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909821477.0000000001242000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_RageMP131.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 9e60372669785515f5b52b68ec83e4c0c314e7f7366508e18617bcd9e5399e86
Instruction ID: 484db216c05496aa61c8cca407272c751e2467b071cf525c608877aa11e3d65e
Opcode Fuzzy Hash: 9e60372669785515f5b52b68ec83e4c0c314e7f7366508e18617bcd9e5399e86
Instruction Fuzzy Hash: DA114833E0412516E72472346D42BFE7749CBC2770F29065AF8189B0C2FE26EC417355

Function 00F7E05C Relevance: 1.6, APIs: 1, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00FC0DF8,00F6E5B1,00000002,00F6E5B1,00000000,?,?,?,00F7E166,00000000,?,00F6E5B1,00000002,00FC0DF8), ref: 00F7E099

Memory Dump Source

Source File: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2907743147.0000000000E90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2907795956.0000000000FC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908156570.0000000000FC8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908232459.0000000000FCB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908286537.0000000000FCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908346929.0000000000FD8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908661625.0000000001139000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908724803.000000000113B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.0000000001150000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908921946.0000000001163000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908954101.0000000001165000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909031254.000000000118C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909089565.000000000118D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909133057.0000000001197000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909191877.00000000011A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909296628.00000000011BD000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.0000000001201000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909634093.000000000122B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.000000000122C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.0000000001232000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909821477.0000000001242000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_RageMP131.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 7faa45ebc320e72d568d3e4a967b9dbf5d7f2d0710828d39a036e69e94dcb277
Instruction ID: dde69264cbbfbcfd35c3dc8968aad7010e9e2b3be43f5aa8bc97308b4910dceb
Opcode Fuzzy Hash: 7faa45ebc320e72d568d3e4a967b9dbf5d7f2d0710828d39a036e69e94dcb277
Instruction Fuzzy Hash: C4014932614119AFCF05CF18CC05DAE3B29DF89330F24428AF8549B291FAB2ED51ABD1

Function 00F863F3 Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,00F6D6FA,00000004,?,00F85D79,00000001,00000364,00000004,00000007,000000FF,?,00F7067B,00000002,00000000,?,?), ref: 00F86435

Memory Dump Source

Source File: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2907743147.0000000000E90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2907795956.0000000000FC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908156570.0000000000FC8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908232459.0000000000FCB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908286537.0000000000FCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908346929.0000000000FD8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908661625.0000000001139000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908724803.000000000113B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.0000000001150000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908921946.0000000001163000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908954101.0000000001165000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909031254.000000000118C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909089565.000000000118D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909133057.0000000001197000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909191877.00000000011A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909296628.00000000011BD000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.0000000001201000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909634093.000000000122B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.000000000122C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.0000000001232000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909821477.0000000001242000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_RageMP131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9125968904c54331ac91650245811c5cdc7811c1c40e1a8527a4debf3b09d6bd
Instruction ID: 4763c0c5fba20ed8f3815bdc86e3041ef69a0f837058ede50588308312972583
Opcode Fuzzy Hash: 9125968904c54331ac91650245811c5cdc7811c1c40e1a8527a4debf3b09d6bd
Instruction Fuzzy Hash: 7AF0E932901224669F21FB629C06BDF3B49AF41774F258151AC08D7185CB30D80177F2

Function 00F86E2D Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000004,00000000,?,00F7067B,00000002,00000000,?,?,?,00E9303D,00F6D6FA,00000004,00000000,00F6D6FA), ref: 00F86E60

Memory Dump Source

Source File: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2907743147.0000000000E90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2907795956.0000000000FC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908156570.0000000000FC8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908232459.0000000000FCB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908286537.0000000000FCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908346929.0000000000FD8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908661625.0000000001139000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908724803.000000000113B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.0000000001150000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908921946.0000000001163000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908954101.0000000001165000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909031254.000000000118C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909089565.000000000118D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909133057.0000000001197000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909191877.00000000011A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909296628.00000000011BD000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.0000000001201000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909634093.000000000122B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.000000000122C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.0000000001232000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909821477.0000000001242000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_RageMP131.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 609883d1444dd4bf1f33c914a7df8010d6defd4d4764a5095fe7b68cbcee3710
Instruction ID: 79545ba3e91c5e588a36fff17c42f0a61cc8e4d3e34d95432550c252053ff836
Opcode Fuzzy Hash: 609883d1444dd4bf1f33c914a7df8010d6defd4d4764a5095fe7b68cbcee3710
Instruction Fuzzy Hash: 62E0ED3A94062666EA303665CD05BDB764D9F827B0F050221AC04D6090CB20C801B3ED

Non-executed Functions

Function 00F784A0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2907743147.0000000000E90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2907795956.0000000000FC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908156570.0000000000FC8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908232459.0000000000FCB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908286537.0000000000FCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908346929.0000000000FD8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908661625.0000000001139000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908724803.000000000113B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.0000000001150000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908921946.0000000001163000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908954101.0000000001165000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909031254.000000000118C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909089565.000000000118D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909133057.0000000001197000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909191877.00000000011A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909296628.00000000011BD000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.0000000001201000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909634093.000000000122B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.000000000122C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.0000000001232000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909821477.0000000001242000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_RageMP131.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f97ce6278b5da815f6c389bae476adc5dc884afc24939f4c376b69ad4ad6edd
Instruction ID: 479b5d94f9e241e8037babe72c6b2a225a56641f1ed01b957784788a47d98a90
Opcode Fuzzy Hash: 3f97ce6278b5da815f6c389bae476adc5dc884afc24939f4c376b69ad4ad6edd
Instruction Fuzzy Hash: CA025E71E402199BDF14CFA9D8846AEFBB1FF48364F24826AD519E7340DB31AD02DB91

Function 00EFF810 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00EFF833
std::_Lockit::_Lockit.LIBCPMT ref: 00EFF855
std::_Lockit::~_Lockit.LIBCPMT ref: 00EFF875
std::_Lockit::~_Lockit.LIBCPMT ref: 00EFF89F
std::_Lockit::_Lockit.LIBCPMT ref: 00EFF90D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00EFF959
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00EFF973
std::_Lockit::~_Lockit.LIBCPMT ref: 00EFFA08
std::_Facet_Register.LIBCPMT ref: 00EFFA15

Strings

bad locale name, xrefs: 00EFFA2F
Ps, xrefs: 00EFF96B, 00EFF972

Memory Dump Source

Source File: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2907743147.0000000000E90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2907795956.0000000000FC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908156570.0000000000FC8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908232459.0000000000FCB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908286537.0000000000FCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908346929.0000000000FD8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908661625.0000000001139000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908724803.000000000113B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.0000000001150000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908921946.0000000001163000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908954101.0000000001165000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909031254.000000000118C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909089565.000000000118D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909133057.0000000001197000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909191877.00000000011A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909296628.00000000011BD000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.0000000001201000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909634093.000000000122B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.000000000122C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.0000000001232000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909821477.0000000001242000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$Ps
API String ID: 3375549084-1174896957
Opcode ID: b67b59ae85dd1e2feda532dbf144358123e6bc0fa9d21db55713ca8c4ff47b01
Instruction ID: 2ec514bf868ec0b4c3bf140326797140dcf277c5d243a1f512ef28f7261d9962
Opcode Fuzzy Hash: b67b59ae85dd1e2feda532dbf144358123e6bc0fa9d21db55713ca8c4ff47b01
Instruction Fuzzy Hash: 3E61C071E0024C9BEF10DFA4CC45BAEBBB4AF54354F144169E908BB381E775E905DBA2

Function 00E97820 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E9799A
___std_exception_copy.LIBVCRUNTIME ref: 00E97B75

Strings

`!, xrefs: 00E979A5, 00E97B80
out_of_range, xrefs: 00E97A27
type_error, xrefs: 00E9784A
`!, xrefs: 00E97985, 00E97B60

Memory Dump Source

Source File: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2907743147.0000000000E90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2907795956.0000000000FC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908156570.0000000000FC8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908232459.0000000000FCB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908286537.0000000000FCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908346929.0000000000FD8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908661625.0000000001139000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908724803.000000000113B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.0000000001150000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908921946.0000000001163000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908954101.0000000001165000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909031254.000000000118C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909089565.000000000118D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909133057.0000000001197000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909191877.00000000011A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909296628.00000000011BD000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.0000000001201000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909634093.000000000122B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.000000000122C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.0000000001232000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909821477.0000000001242000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!$`!$out_of_range$type_error
API String ID: 2659868963-4040272994
Opcode ID: 3b254256ae39cd0b3cb03a6ae4e723e642b5c49f877c4daf59210a138a88badd
Instruction ID: 0d461cb69da7d0533fe50c207455a32b35a3770314ecaf7fd4a4dbad7aaac679
Opcode Fuzzy Hash: 3b254256ae39cd0b3cb03a6ae4e723e642b5c49f877c4daf59210a138a88badd
Instruction Fuzzy Hash: 88C148B1D002089FDB18CFA8D884B9DBBF1FF48300F14866AE459EB746E7749984CB51

Function 00E973B0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 184COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00E975BE
___std_exception_destroy.LIBVCRUNTIME ref: 00E975CD

Strings

yo, xrefs: 00E97455
at line , xrefs: 00E973F7
, column , xrefs: 00E97434, 00E9744A
`!, xrefs: 00E975B6, 00E975C6

Memory Dump Source

Source File: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2907743147.0000000000E90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2907795956.0000000000FC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908156570.0000000000FC8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908232459.0000000000FCB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908286537.0000000000FCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908346929.0000000000FD8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908661625.0000000001139000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908724803.000000000113B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.0000000001150000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908921946.0000000001163000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908954101.0000000001165000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909031254.000000000118C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909089565.000000000118D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909133057.0000000001197000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909191877.00000000011A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909296628.00000000011BD000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.0000000001201000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909634093.000000000122B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.000000000122C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.0000000001232000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909821477.0000000001242000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column $`!$yo
API String ID: 4194217158-1471347245
Opcode ID: cd12d789ca995067d95176a3b0be298907161a6833e50991e3a05c6e3de692be
Instruction ID: be2900e44c32f0ff114923509375c93e01bbaa629c8b4f6c62ff3d1734b216fd
Opcode Fuzzy Hash: cd12d789ca995067d95176a3b0be298907161a6833e50991e3a05c6e3de692be
Instruction Fuzzy Hash: C061E471A142049FDF08CF68DC85B9DBBB6FF44300F24862CE465A7B82D774AA48DB91

Function 00E939F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00E93A58
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00E93AA4
__Getctype.LIBCPMT ref: 00E93ABA
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00E93AE6
std::_Lockit::~_Lockit.LIBCPMT ref: 00E93B7B

Strings

bad locale name, xrefs: 00E93B96

Memory Dump Source

Source File: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2907743147.0000000000E90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2907795956.0000000000FC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908156570.0000000000FC8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908232459.0000000000FCB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908286537.0000000000FCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908346929.0000000000FD8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908661625.0000000001139000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908724803.000000000113B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.0000000001150000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908921946.0000000001163000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908954101.0000000001165000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909031254.000000000118C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909089565.000000000118D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909133057.0000000001197000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909191877.00000000011A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909296628.00000000011BD000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.0000000001201000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909634093.000000000122B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.000000000122C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.0000000001232000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909821477.0000000001242000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_RageMP131.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: d6d50fb859b606a26dadffe8741d34d7112cbf235989e032549a26929e0b5f3d
Instruction ID: 6de24d5303ec1a59b5e791288b45428570ad59614dbf588bd90ff9c18871ada0
Opcode Fuzzy Hash: d6d50fb859b606a26dadffe8741d34d7112cbf235989e032549a26929e0b5f3d
Instruction Fuzzy Hash: 815161B5D002089FEF10DFA4DC45B9EBBB8BF14314F148169E809AB341E779DA04DB62

Function 00E9B1A0 Relevance: 10.6, APIs: 7, Instructions: 133memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000001C), ref: 00E9B1F0
LocalAlloc.KERNEL32(00000040,0000001C,?,00000000,00000000), ref: 00E9B239
SetupDiGetDeviceInterfaceDetailA.SETUPAPI(?,00000000,00000000,00000000,?,00000000), ref: 00E9B26D
SetupDiGetDeviceInterfaceDetailA.SETUPAPI(?,?,00000000,?,00000000,00000000), ref: 00E9B28F
LocalFree.KERNEL32(?,?,?,?,?,00000000,?,00000000,00000000), ref: 00E9B2C0
LocalFree.KERNEL32(?,?,?,00000000,?,00000000,00000000), ref: 00E9B2C5
LocalFree.KERNEL32(?,?,?,00000000,?,00000000,00000000), ref: 00E9B2C8

Memory Dump Source

Source File: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2907743147.0000000000E90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2907795956.0000000000FC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908156570.0000000000FC8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908232459.0000000000FCB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908286537.0000000000FCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908346929.0000000000FD8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908661625.0000000001139000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908724803.000000000113B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.0000000001150000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908921946.0000000001163000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908954101.0000000001165000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909031254.000000000118C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909089565.000000000118D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909133057.0000000001197000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909191877.00000000011A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909296628.00000000011BD000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.0000000001201000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909634093.000000000122B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.000000000122C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.0000000001232000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909821477.0000000001242000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_RageMP131.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocDetailDeviceInterfaceSetup
String ID:
API String ID: 4232148138-0
Opcode ID: 0006b966c15d96ee19fce0d7d9d95e73b94419d4cb377804ff9db7e42d3850d6
Instruction ID: a25ddd7d01d4a72c5f882c5f621e82aacf4ae3aaa0449daa64cb36c1b50e3465
Opcode Fuzzy Hash: 0006b966c15d96ee19fce0d7d9d95e73b94419d4cb377804ff9db7e42d3850d6
Instruction Fuzzy Hash: 89413CB1A40309AFDB20DFA9DD41BAEBBF8EB48700F10452AE559E7690E775A900CB50

Function 00E93190 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 170COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E932C6
___std_exception_destroy.LIBVCRUNTIME ref: 00E93350

Strings

`!, xrefs: 00E932D1
@3, xrefs: 00E93316
`!, xrefs: 00E932AD, 00E93349

Memory Dump Source

Source File: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2907743147.0000000000E90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2907795956.0000000000FC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908156570.0000000000FC8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908232459.0000000000FCB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908286537.0000000000FCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908346929.0000000000FD8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908661625.0000000001139000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908724803.000000000113B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.0000000001150000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908921946.0000000001163000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908954101.0000000001165000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909031254.000000000118C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909089565.000000000118D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909133057.0000000001197000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909191877.00000000011A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909296628.00000000011BD000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.0000000001201000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909634093.000000000122B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.000000000122C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.0000000001232000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909821477.0000000001242000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: @3$`!$`!
API String ID: 2970364248-2742226070
Opcode ID: 2afc83424cb66ffba34a8f157252a7e042b8b3e747719f49a01486a63d250b45
Instruction ID: 7398352e1e4e7b2fb6be08913d18bc85a5a7c108aada1c3f0e439cfd49cae1e8
Opcode Fuzzy Hash: 2afc83424cb66ffba34a8f157252a7e042b8b3e747719f49a01486a63d250b45
Instruction Fuzzy Hash: 1F516B719002189FDF08CFA8DC85BAEBBB5FF48300F14812AE819A7391D774AA458B91

Function 00E93370 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

APIs

Part of subcall function 00E93190: ___std_exception_copy.LIBVCRUNTIME ref: 00E932C6

___std_exception_copy.LIBVCRUNTIME ref: 00E9345F

Strings

+4, xrefs: 00E933B3, 00E93410
@3, xrefs: 00E933F3, 00E9347B
@3, xrefs: 00E93464
`!, xrefs: 00E93450

Memory Dump Source

Source File: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2907743147.0000000000E90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2907795956.0000000000FC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908156570.0000000000FC8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908232459.0000000000FCB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908286537.0000000000FCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908346929.0000000000FD8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908661625.0000000001139000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908724803.000000000113B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.0000000001150000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908921946.0000000001163000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908954101.0000000001165000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909031254.000000000118C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909089565.000000000118D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909133057.0000000001197000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909191877.00000000011A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909296628.00000000011BD000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.0000000001201000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909634093.000000000122B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.000000000122C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.0000000001232000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909821477.0000000001242000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: +4$@3$@3$`!
API String ID: 2659868963-2319638956
Opcode ID: 36fcd618d650d030287714ede2a74853e55345c8abc89db1ed17d12918117c3a
Instruction ID: fb88e0a51ca5c3b1aa8efe9b0cc1d0b7eec60f1484ae6fb1fa0ddeaa3c92d68d
Opcode Fuzzy Hash: 36fcd618d650d030287714ede2a74853e55345c8abc89db1ed17d12918117c3a
Instruction Fuzzy Hash: 7131A3B19002099FCB18DFA8D841A9EFBF8FF08310F10852AE519E7A51E774AA54CB91

Function 00EFD050 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00EFD06F
___std_exception_copy.LIBVCRUNTIME ref: 00EFD096

Strings

u, xrefs: 00EFD0A5
`!, xrefs: 00EFD09B
`!, xrefs: 00EFD060, 00EFD085

Memory Dump Source

Source File: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2907743147.0000000000E90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2907795956.0000000000FC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908156570.0000000000FC8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908232459.0000000000FCB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908286537.0000000000FCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908346929.0000000000FD8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908661625.0000000001139000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908724803.000000000113B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.0000000001150000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908921946.0000000001163000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908954101.0000000001165000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909031254.000000000118C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909089565.000000000118D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909133057.0000000001197000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909191877.00000000011A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909296628.00000000011BD000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.0000000001201000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909634093.000000000122B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.000000000122C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.0000000001232000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909821477.0000000001242000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!$`!$u
API String ID: 2659868963-3642976717
Opcode ID: b7322ed04a608dfb1d9bd34c64db4116c90ec3861d6e2f8abaa7e7afa2b5e9fc
Instruction ID: 8b43ad70960fb3cd55a5099f45cc26284be62af92b7f343d2b5af75c4a65c205
Opcode Fuzzy Hash: b7322ed04a608dfb1d9bd34c64db4116c90ec3861d6e2f8abaa7e7afa2b5e9fc
Instruction Fuzzy Hash: D501A4B6600606AF9708DF59D805882FBF8FF48710715852BA529CBB11E7B0E528DFA0

Function 00E96C60 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 247COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00E96F11
___std_exception_destroy.LIBVCRUNTIME ref: 00E96F20

Strings

[json.exception., xrefs: 00E96CB8
`!, xrefs: 00E96F09, 00E96F19

Memory Dump Source

Source File: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2907743147.0000000000E90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2907795956.0000000000FC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908156570.0000000000FC8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908232459.0000000000FCB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908286537.0000000000FCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908346929.0000000000FD8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908661625.0000000001139000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908724803.000000000113B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.0000000001150000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908921946.0000000001163000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908954101.0000000001165000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909031254.000000000118C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909089565.000000000118D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909133057.0000000001197000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909191877.00000000011A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909296628.00000000011BD000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.0000000001201000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909634093.000000000122B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.000000000122C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.0000000001232000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909821477.0000000001242000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.$`!
API String ID: 4194217158-2932383579
Opcode ID: af86e7cd6517537971d08ad8f6364e331cb804e614df5520623f352f8659cf84
Instruction ID: ae1e4e7068ff0492084bbace1afd9ddefab11db93f67ffb067061d64c77d2660
Opcode Fuzzy Hash: af86e7cd6517537971d08ad8f6364e331cb804e614df5520623f352f8659cf84
Instruction Fuzzy Hash: 4691D370A002049FDF18CF68D884B9EBBF2FF44300F24866DE419AB792D775AA85CB51

Function 00E97BE0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 156COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E97D67

Strings

other_error, xrefs: 00E97C0A
`!, xrefs: 00E97D72
`!, xrefs: 00E97D52

Memory Dump Source

Source File: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2907743147.0000000000E90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2907795956.0000000000FC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908156570.0000000000FC8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908232459.0000000000FCB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908286537.0000000000FCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908346929.0000000000FD8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908661625.0000000001139000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908724803.000000000113B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.0000000001150000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908921946.0000000001163000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908954101.0000000001165000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909031254.000000000118C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909089565.000000000118D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909133057.0000000001197000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909191877.00000000011A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909296628.00000000011BD000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.0000000001201000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909634093.000000000122B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.000000000122C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.0000000001232000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909821477.0000000001242000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!$`!$other_error
API String ID: 2659868963-2644867674
Opcode ID: 5eadb912d71f05a3a005015045dd63041ffcdc76834c623737482bc6c31fc771
Instruction ID: 73eae4f64d0c66f9c5ed358fd589531209ac03f9df7d788c3b7a8f8000c8b81f
Opcode Fuzzy Hash: 5eadb912d71f05a3a005015045dd63041ffcdc76834c623737482bc6c31fc771
Instruction Fuzzy Hash: 885168B0D102488FDB18CFA8D88479DBBF1FF49300F14866AE459EB786E774A984CB51

Function 00E95010 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E950C8

Strings

recursive_directory_iterator::operator++, xrefs: 00E9504C
@3, xrefs: 00E950CD
`!, xrefs: 00E950B9

Memory Dump Source

Source File: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2907743147.0000000000E90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2907795956.0000000000FC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908156570.0000000000FC8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908232459.0000000000FCB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908286537.0000000000FCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908346929.0000000000FD8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908661625.0000000001139000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908724803.000000000113B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.0000000001150000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908921946.0000000001163000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908954101.0000000001165000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909031254.000000000118C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909089565.000000000118D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909133057.0000000001197000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909191877.00000000011A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909296628.00000000011BD000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.0000000001201000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909634093.000000000122B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.000000000122C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.0000000001232000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909821477.0000000001242000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: @3$`!$recursive_directory_iterator::operator++
API String ID: 2659868963-3572337925
Opcode ID: f66f769defbead6f5cbfb4dc7c46667c4563559a90595d549b8646d11c1156e9
Instruction ID: 8e9871e79b66368d486a5fa11198e446912d2d2f276a7ac44dab807614c9d4ed
Opcode Fuzzy Hash: f66f769defbead6f5cbfb4dc7c46667c4563559a90595d549b8646d11c1156e9
Instruction Fuzzy Hash: FD3190B5800608EBCB10DF54DD41F86BBF8FB04710F04866AE919A3781DB74BA14CBA1

Function 00F0B3C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00F0B3DF
___std_exception_copy.LIBVCRUNTIME ref: 00F0B406

Strings

`!, xrefs: 00F0B40E
`!, xrefs: 00F0B3D0, 00F0B3F5

Memory Dump Source

Source File: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2907743147.0000000000E90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2907795956.0000000000FC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908156570.0000000000FC8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908232459.0000000000FCB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908286537.0000000000FCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908346929.0000000000FD8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908661625.0000000001139000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908724803.000000000113B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.0000000001150000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908921946.0000000001163000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908954101.0000000001165000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909031254.000000000118C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909089565.000000000118D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909133057.0000000001197000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909191877.00000000011A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909296628.00000000011BD000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.0000000001201000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909634093.000000000122B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.000000000122C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.0000000001232000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909821477.0000000001242000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!$`!
API String ID: 2659868963-1501952390
Opcode ID: b4700d971925b1c1f57e41953e3803267872d8fea2028b7e64881b106f6af283
Instruction ID: fde89e0158bfb70fbe9d0046e6a13ef26184c548ee4bf69fa685bcbbb934d7af
Opcode Fuzzy Hash: b4700d971925b1c1f57e41953e3803267872d8fea2028b7e64881b106f6af283
Instruction Fuzzy Hash: 7DF0C4B6500606AF8708DF59D815886BBE8FF44710315852BE52ACBB02E7B0E528DFA0

Function 00E9D8B9 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 377COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32(00000000,00000128), ref: 00E9DAB0
Process32Next.KERNEL32(00000000,?), ref: 00E9DAF8

Strings

?, xrefs: 00E9DCB9

Memory Dump Source

Source File: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2907743147.0000000000E90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2907795956.0000000000FC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908156570.0000000000FC8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908232459.0000000000FCB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908286537.0000000000FCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908346929.0000000000FD8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908661625.0000000001139000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908724803.000000000113B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.0000000001150000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908921946.0000000001163000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908954101.0000000001165000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909031254.000000000118C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909089565.000000000118D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909133057.0000000001197000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909191877.00000000011A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909296628.00000000011BD000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.0000000001201000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909634093.000000000122B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.000000000122C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.0000000001232000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909821477.0000000001242000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_RageMP131.jbxd

Yara matches

Similarity

API ID: NextProcess32
String ID: ?
API String ID: 1850201408-1684325040
Opcode ID: 376537450a45c237c46892e10b128886a8bb30525fbfa40f26ee19dd7cc14681
Instruction ID: de0792755d57bd0f23a1d26e294e1eefc49e1af3ba408b2ed6a42f59d50fc57f
Opcode Fuzzy Hash: 376537450a45c237c46892e10b128886a8bb30525fbfa40f26ee19dd7cc14681
Instruction Fuzzy Hash: BEF17DB181522DAAEF25EB90CC45BEEB7B8EF15304F4010D9E549B6241EB705B88CF62

Function 00E93490 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E934AF

Strings

@3, xrefs: 00E934B7
`!, xrefs: 00E934A0

Memory Dump Source

Source File: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2907743147.0000000000E90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2907795956.0000000000FC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908156570.0000000000FC8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908232459.0000000000FCB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908286537.0000000000FCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908346929.0000000000FD8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908661625.0000000001139000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908724803.000000000113B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.0000000001150000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908921946.0000000001163000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908954101.0000000001165000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909031254.000000000118C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909089565.000000000118D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909133057.0000000001197000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909191877.00000000011A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909296628.00000000011BD000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.0000000001201000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909634093.000000000122B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.000000000122C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.0000000001232000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909821477.0000000001242000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: @3$`!
API String ID: 2659868963-4232193924
Opcode ID: 892beb1d871fdecc5f01c7a286c4b0ff863c10d43989186ad05f301e3fcf4823
Instruction ID: db0c8e4c7b6c47969d790434ac53f4cccebccacfd300055cc950c39e11a8071b
Opcode Fuzzy Hash: 892beb1d871fdecc5f01c7a286c4b0ff863c10d43989186ad05f301e3fcf4823
Instruction Fuzzy Hash: F4F0A5B6604705AF8708CF59D801886FBE8FF59310305C53BE529C7B01E7B0E9288BA4

Function 00E93050 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E93078

Strings

`!, xrefs: 00E93080
`!, xrefs: 00E93063

Memory Dump Source

Source File: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2907743147.0000000000E90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2907795956.0000000000FC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908156570.0000000000FC8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908232459.0000000000FCB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908286537.0000000000FCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908346929.0000000000FD8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908661625.0000000001139000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908724803.000000000113B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.0000000001150000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908921946.0000000001163000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908954101.0000000001165000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909031254.000000000118C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909089565.000000000118D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909133057.0000000001197000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909191877.00000000011A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909296628.00000000011BD000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.0000000001201000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909634093.000000000122B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.000000000122C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.0000000001232000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909821477.0000000001242000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!$`!
API String ID: 2659868963-1501952390
Opcode ID: c3080a1251a1637fa7bd918a41d966a803a42c8db70027c191beb7ac886568e5
Instruction ID: d06e843b5afafe70ed7a35c351a031990489bbf166bf2212e1790088169686e5
Opcode Fuzzy Hash: c3080a1251a1637fa7bd918a41d966a803a42c8db70027c191beb7ac886568e5
Instruction Fuzzy Hash: 39E0EDB29012089BC710DFA8D80598AFBE8AB19701F1586AAE948D7301FAB095589BD1

Function 00E93090 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E930AE

Strings

`!, xrefs: 00E930B6
`!, xrefs: 00E9309C

Memory Dump Source

Source File: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2907743147.0000000000E90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2907795956.0000000000FC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908156570.0000000000FC8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908232459.0000000000FCB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908286537.0000000000FCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908346929.0000000000FD8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908661625.0000000001139000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908724803.000000000113B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.0000000001150000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908921946.0000000001163000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908954101.0000000001165000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909031254.000000000118C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909089565.000000000118D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909133057.0000000001197000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909191877.00000000011A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909296628.00000000011BD000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.0000000001201000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909634093.000000000122B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.000000000122C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.0000000001232000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909821477.0000000001242000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!$`!
API String ID: 2659868963-1501952390
Opcode ID: 2e4e9eca6640e4bc6ac4a3bacd860371f81a87fbff56cf93204a9bfbd5f7b56b
Instruction ID: a8d1f59a9e0cdc3b585cb49d091c8378f070c738ee6cb8d6e9d3afc1c90a8eeb
Opcode Fuzzy Hash: 2e4e9eca6640e4bc6ac4a3bacd860371f81a87fbff56cf93204a9bfbd5f7b56b
Instruction Fuzzy Hash: A0E012B25042149FD714DF48DC05846BBDCDF05754705843FF54DDB301E670D8149BA8

Function 00E92230 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E9224E

Strings

`!, xrefs: 00E92256
`!, xrefs: 00E9223C

Memory Dump Source

Source File: 00000007.00000002.2907795956.0000000000E91000.00000040.00000001.01000000.00000005.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2907743147.0000000000E90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2907795956.0000000000FC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908156570.0000000000FC8000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908232459.0000000000FCB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908286537.0000000000FCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908346929.0000000000FD8000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908661625.0000000001139000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908724803.000000000113B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.0000000001150000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908810094.000000000115E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908921946.0000000001163000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2908954101.0000000001165000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909031254.000000000118C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909089565.000000000118D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909133057.0000000001197000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909191877.00000000011A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909296628.00000000011BD000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.00000000011FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909353984.0000000001201000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909634093.000000000122B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.000000000122C000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909695678.0000000001232000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.2909821477.0000000001242000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_RageMP131.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `!$`!
API String ID: 2659868963-1501952390
Opcode ID: 442d430827f584aa73dd38b20bde1aca3e4828d8d67617760ee36a563c85977c
Instruction ID: 04183974d1632aec0deff8f921eea4628542599e706a7a03ad93113ea1fd918b
Opcode Fuzzy Hash: 442d430827f584aa73dd38b20bde1aca3e4828d8d67617760ee36a563c85977c
Instruction Fuzzy Hash: A3E012B29042149BDB14DF48DC01846BBDCDF05754705843FF549DB301E770D8149BA4

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LisectAVT_2403002A_151.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\MPGPH131\MPGPH131.exe

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
LisectAVT_2403002A_151.exe

Function 009CB6A0 Relevance: 14.8, APIs: 4, Strings: 4, Instructions: 840
registryCOMMON

Function 009DE0A0 Relevance: 6.1, APIs: 4, Instructions: 100
networkCOMMON

Function 00A3A520 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 234
COMMON

Function 009CA690 Relevance: 4.6, APIs: 3, Instructions: 93
COMMON

Function 009CA090 Relevance: 3.3, APIs: 2, Instructions: 342
COMMON

Function 00AB4623 Relevance: 3.3, APIs: 2, Instructions: 297
COMMONLIBRARYCODE

Function 00AB549C Relevance: 1.7, APIs: 1, Instructions: 198
fileCOMMON

Function 00AA4942 Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Function 00A30560 Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Function 00AB4B12 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 00AAE05C Relevance: 1.6, APIs: 1, Instructions: 54
COMMONLIBRARYCODE

Function 00A9F290 Relevance: 1.6, APIs: 1, Instructions: 51
COMMONLIBRARYCODE

Function 00AB63F3 Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE