Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
LisectAVT_2403002A_228.exe

Overview

General Information

Sample name:LisectAVT_2403002A_228.exe
Analysis ID:1482398
MD5:ce5a350b93125774aa74515271c6d8ad
SHA1:4e7f67212bd95ece241d4914be2cdbf9d5dc9573
SHA256:5dbdcfb4702811e2f7cdac39ba83dccdc4a16dfa6b29a02b3879a1a70b3019dd
Tags:exe
Infos:

Detection

RisePro Stealer
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Yara detected RisePro Stealer
AI detected suspicious sample
Connects to many ports of the same IP (likely port scanning)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
PE file contains section with special chars
Potentially malicious time measurement code found
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Uses schtasks.exe or at.exe to add and modify task schedules
Abnormal high CPU Usage
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to read the PEB
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

  • System is w10x64
  • LisectAVT_2403002A_228.exe (PID: 6740 cmdline: "C:\Users\user\Desktop\LisectAVT_2403002A_228.exe" MD5: CE5A350B93125774AA74515271C6D8AD)
    • schtasks.exe (PID: 2736 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)
      • conhost.exe (PID: 5888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • schtasks.exe (PID: 2472 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)
      • conhost.exe (PID: 2720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • MPGPH131.exe (PID: 4948 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: CE5A350B93125774AA74515271C6D8AD)
  • MPGPH131.exe (PID: 344 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: CE5A350B93125774AA74515271C6D8AD)
  • RageMP131.exe (PID: 7252 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: CE5A350B93125774AA74515271C6D8AD)
  • RageMP131.exe (PID: 7556 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: CE5A350B93125774AA74515271C6D8AD)
  • cleanup
No configs have been found
SourceRuleDescriptionAuthorStrings
00000009.00000003.1923737159.0000000004AD0000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_RiseProStealerYara detected RisePro StealerJoe Security
    00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmpJoeSecurity_RiseProStealerYara detected RisePro StealerJoe Security
      00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmpJoeSecurity_RiseProStealerYara detected RisePro StealerJoe Security
        00000000.00000003.1692149200.0000000004E90000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_RiseProStealerYara detected RisePro StealerJoe Security
          00000007.00000003.1846088953.0000000004BA0000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_RiseProStealerYara detected RisePro StealerJoe Security
            Click to see the 10 entries

            System Summary

            barindex
            Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\LisectAVT_2403002A_228.exe, ProcessId: 6740, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131
            No Snort rule has matched
            Timestamp:2024-07-25T22:24:05.139725+0200
            SID:2049060
            Source Port:49731
            Destination Port:58709
            Protocol:TCP
            Classtype:A Network Trojan was detected
            Timestamp:2024-07-25T22:24:24.342287+0200
            SID:2046269
            Source Port:49740
            Destination Port:58709
            Protocol:TCP
            Classtype:A Network Trojan was detected
            Timestamp:2024-07-25T22:24:12.593647+0200
            SID:2049060
            Source Port:49735
            Destination Port:58709
            Protocol:TCP
            Classtype:A Network Trojan was detected
            Timestamp:2024-07-25T22:24:15.575871+0200
            SID:2046269
            Source Port:49735
            Destination Port:58709
            Protocol:TCP
            Classtype:A Network Trojan was detected
            Timestamp:2024-07-25T22:24:08.131869+0200
            SID:2046269
            Source Port:49731
            Destination Port:58709
            Protocol:TCP
            Classtype:A Network Trojan was detected
            Timestamp:2024-07-25T22:24:00.403951+0200
            SID:2046269
            Source Port:49730
            Destination Port:58709
            Protocol:TCP
            Classtype:A Network Trojan was detected
            Timestamp:2024-07-25T22:24:08.131731+0200
            SID:2046269
            Source Port:49732
            Destination Port:58709
            Protocol:TCP
            Classtype:A Network Trojan was detected
            Timestamp:2024-07-25T22:24:51.619679+0200
            SID:2022930
            Source Port:443
            Destination Port:49741
            Protocol:TCP
            Classtype:A Network Trojan was detected
            Timestamp:2024-07-25T22:23:57.416907+0200
            SID:2049060
            Source Port:49730
            Destination Port:58709
            Protocol:TCP
            Classtype:A Network Trojan was detected
            Timestamp:2024-07-25T22:24:13.208194+0200
            SID:2022930
            Source Port:443
            Destination Port:49733
            Protocol:TCP
            Classtype:A Network Trojan was detected

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Source: LisectAVT_2403002A_228.exeAvira: detected
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeAvira: detection malicious, Label: TR/Redcap.hkdqs
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeAvira: detection malicious, Label: TR/Redcap.hkdqs
            Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeJoe Sandbox ML: detected
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeJoe Sandbox ML: detected
            Source: LisectAVT_2403002A_228.exeJoe Sandbox ML: detected
            Source: LisectAVT_2403002A_228.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

            Networking

            barindex
            Source: global trafficTCP traffic: 193.233.132.74 ports 0,5,7,8,58709,9
            Source: global trafficTCP traffic: 192.168.2.4:49730 -> 193.233.132.74:58709
            Source: Joe Sandbox ViewIP Address: 193.233.132.74 193.233.132.74
            Source: Joe Sandbox ViewASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU
            Source: unknownTCP traffic detected without corresponding DNS query: 193.233.132.74
            Source: unknownTCP traffic detected without corresponding DNS query: 193.233.132.74
            Source: unknownTCP traffic detected without corresponding DNS query: 193.233.132.74
            Source: unknownTCP traffic detected without corresponding DNS query: 193.233.132.74
            Source: unknownTCP traffic detected without corresponding DNS query: 193.233.132.74
            Source: unknownTCP traffic detected without corresponding DNS query: 193.233.132.74
            Source: unknownTCP traffic detected without corresponding DNS query: 193.233.132.74
            Source: unknownTCP traffic detected without corresponding DNS query: 193.233.132.74
            Source: unknownTCP traffic detected without corresponding DNS query: 193.233.132.74
            Source: unknownTCP traffic detected without corresponding DNS query: 193.233.132.74
            Source: unknownTCP traffic detected without corresponding DNS query: 193.233.132.74
            Source: unknownTCP traffic detected without corresponding DNS query: 193.233.132.74
            Source: unknownTCP traffic detected without corresponding DNS query: 193.233.132.74
            Source: unknownTCP traffic detected without corresponding DNS query: 193.233.132.74
            Source: unknownTCP traffic detected without corresponding DNS query: 193.233.132.74
            Source: unknownTCP traffic detected without corresponding DNS query: 193.233.132.74
            Source: unknownTCP traffic detected without corresponding DNS query: 193.233.132.74
            Source: unknownTCP traffic detected without corresponding DNS query: 193.233.132.74
            Source: unknownTCP traffic detected without corresponding DNS query: 193.233.132.74
            Source: unknownTCP traffic detected without corresponding DNS query: 193.233.132.74
            Source: unknownTCP traffic detected without corresponding DNS query: 193.233.132.74
            Source: unknownTCP traffic detected without corresponding DNS query: 193.233.132.74
            Source: unknownTCP traffic detected without corresponding DNS query: 193.233.132.74
            Source: unknownTCP traffic detected without corresponding DNS query: 193.233.132.74
            Source: unknownTCP traffic detected without corresponding DNS query: 193.233.132.74
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_0067E0A0 recv,setsockopt,WSAStartup,closesocket,socket,connect,closesocket,0_2_0067E0A0
            Source: LisectAVT_2403002A_228.exe, 00000000.00000003.1692149200.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002A_228.exe, 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000005.00000003.1767150400.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000006.00000003.1766573230.0000000004950000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000007.00000003.1846088953.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000003.1923737159.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmpString found in binary or memory: http://www.winimage.com/zLibDll
            Source: LisectAVT_2403002A_228.exe, 00000000.00000003.1692149200.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002A_228.exe, 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000005.00000003.1767150400.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000006.00000003.1766573230.0000000004950000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000007.00000003.1846088953.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000003.1923737159.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmpString found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
            Source: MPGPH131.exe, 00000006.00000002.4130999077.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.4130773514.0000000000D0E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000002.4130699493.0000000000E1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/RiseProSUPPORT
            Source: MPGPH131.exe, 00000005.00000002.4131028142.000000000144D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/RiseProSUPPORTHr
            Source: RageMP131.exe, 00000009.00000002.4130699493.0000000000E1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/RiseProSUPPORTmJ

            System Summary

            barindex
            Source: LisectAVT_2403002A_228.exeStatic PE information: section name:
            Source: LisectAVT_2403002A_228.exeStatic PE information: section name: .idata
            Source: LisectAVT_2403002A_228.exeStatic PE information: section name:
            Source: RageMP131.exe.0.drStatic PE information: section name:
            Source: RageMP131.exe.0.drStatic PE information: section name: .idata
            Source: RageMP131.exe.0.drStatic PE information: section name:
            Source: MPGPH131.exe.0.drStatic PE information: section name:
            Source: MPGPH131.exe.0.drStatic PE information: section name: .idata
            Source: MPGPH131.exe.0.drStatic PE information: section name:
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeProcess Stats: CPU usage > 49%
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_007598240_2_00759824
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_006D50B00_2_006D50B0
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_006E98800_2_006E9880
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_006691A00_2_006691A0
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_006D73F00_2_006D73F0
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_0074646A0_2_0074646A
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_00742CE00_2_00742CE0
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_006624F00_2_006624F0
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_007484A00_2_007484A0
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_00668D700_2_00668D70
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_006E65500_2_006E6550
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_006E55B00_2_006E55B0
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_0074BEAF0_2_0074BEAF
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_0075F7710_2_0075F771
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_00679F500_2_00679F50
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 5_2_001898245_2_00189824
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 5_2_001198805_2_00119880
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 5_2_001050B05_2_001050B0
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 5_2_000991A05_2_000991A0
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 5_2_001073F05_2_001073F0
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 5_2_0017646A5_2_0017646A
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 5_2_001784A05_2_001784A0
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 5_2_00172CE05_2_00172CE0
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 5_2_000924F05_2_000924F0
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 5_2_001165505_2_00116550
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 5_2_00098D705_2_00098D70
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 5_2_001155B05_2_001155B0
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 5_2_0017BEAF5_2_0017BEAF
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 5_2_000A9F505_2_000A9F50
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_001898246_2_00189824
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_001198806_2_00119880
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_001050B06_2_001050B0
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_000991A06_2_000991A0
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_001073F06_2_001073F0
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_0017646A6_2_0017646A
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_001784A06_2_001784A0
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_00172CE06_2_00172CE0
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_000924F06_2_000924F0
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_001165506_2_00116550
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_00098D706_2_00098D70
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_001155B06_2_001155B0
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_0017BEAF6_2_0017BEAF
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_000A9F506_2_000A9F50
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 7_2_002998247_2_00299824
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 7_2_002150B07_2_002150B0
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 7_2_002298807_2_00229880
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 7_2_001A91A07_2_001A91A0
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 7_2_002173F07_2_002173F0
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 7_2_0028646A7_2_0028646A
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 7_2_002884A07_2_002884A0
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 7_2_00282CE07_2_00282CE0
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 7_2_001A24F07_2_001A24F0
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 7_2_001A8D707_2_001A8D70
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 7_2_002265507_2_00226550
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 7_2_002255B07_2_002255B0
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 7_2_0028BEAF7_2_0028BEAF
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 7_2_001B9F507_2_001B9F50
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 7_2_0029F7717_2_0029F771
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 9_2_002998249_2_00299824
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 9_2_002150B09_2_002150B0
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 9_2_002298809_2_00229880
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 9_2_001A91A09_2_001A91A0
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 9_2_002173F09_2_002173F0
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 9_2_0028646A9_2_0028646A
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 9_2_002884A09_2_002884A0
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 9_2_00282CE09_2_00282CE0
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 9_2_001A24F09_2_001A24F0
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 9_2_001A8D709_2_001A8D70
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 9_2_002265509_2_00226550
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 9_2_002255B09_2_002255B0
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 9_2_0028BEAF9_2_0028BEAF
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 9_2_001B9F509_2_001B9F50
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 9_2_0029F7719_2_0029F771
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: String function: 0027FED0 appears 52 times
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: String function: 0016FED0 appears 52 times
            Source: LisectAVT_2403002A_228.exe, 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamefilezilla.exe4 vs LisectAVT_2403002A_228.exe
            Source: LisectAVT_2403002A_228.exe, 00000000.00000002.4134077909.0000000004E90000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamefilezilla.exe4 vs LisectAVT_2403002A_228.exe
            Source: LisectAVT_2403002A_228.exeBinary or memory string: OriginalFilenamefilezilla.exe4 vs LisectAVT_2403002A_228.exe
            Source: LisectAVT_2403002A_228.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
            Source: LisectAVT_2403002A_228.exeStatic PE information: Section: ZLIB complexity 0.9992069128787879
            Source: LisectAVT_2403002A_228.exeStatic PE information: Section: ycahdotv ZLIB complexity 0.9896050219265919
            Source: RageMP131.exe.0.drStatic PE information: Section: ZLIB complexity 0.9992069128787879
            Source: RageMP131.exe.0.drStatic PE information: Section: ycahdotv ZLIB complexity 0.9896050219265919
            Source: MPGPH131.exe.0.drStatic PE information: Section: ZLIB complexity 0.9992069128787879
            Source: MPGPH131.exe.0.drStatic PE information: Section: ycahdotv ZLIB complexity 0.9896050219265919
            Source: RageMP131.exe, 00000009.00000002.4130699493.0000000000E1B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: AT;.CMD;.VBS;.VBpg
            Source: classification engineClassification label: mal100.troj.evad.winEXE@11/5@0/1
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeFile created: C:\Users\user\AppData\Local\RageMP131Jump to behavior
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5888:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2720:120:WilError_03
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeFile created: C:\Users\user\AppData\Local\Temp\rage131MP.tmpJump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCommand line argument: nIv0_2_007648C0
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCommand line argument: nI*7_2_002A48C0
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCommand line argument: nI*9_2_002A48C0
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: LisectAVT_2403002A_228.exe, 00000000.00000003.1692149200.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002A_228.exe, 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000005.00000003.1767150400.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000006.00000003.1766573230.0000000004950000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000007.00000003.1846088953.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000003.1923737159.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
            Source: LisectAVT_2403002A_228.exe, 00000000.00000003.1692149200.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002A_228.exe, 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000005.00000003.1767150400.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000006.00000003.1766573230.0000000004950000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000007.00000003.1846088953.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000003.1923737159.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmpBinary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
            Source: LisectAVT_2403002A_228.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
            Source: MPGPH131.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
            Source: MPGPH131.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
            Source: RageMP131.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
            Source: RageMP131.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeFile read: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\LisectAVT_2403002A_228.exe "C:\Users\user\Desktop\LisectAVT_2403002A_228.exe"
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
            Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
            Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: unknownProcess created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
            Source: unknownProcess created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
            Source: unknownProcess created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
            Source: unknownProcess created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHESTJump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHESTJump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeSection loaded: winmm.dllJump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeSection loaded: rstrtmgr.dllJump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeSection loaded: ncrypt.dllJump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeSection loaded: ntasn1.dllJump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeSection loaded: devobj.dllJump to behavior
            Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
            Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: xmllite.dllJump to behavior
            Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
            Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: xmllite.dllJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: winmm.dllJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: rstrtmgr.dllJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ncrypt.dllJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ntasn1.dllJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: wininet.dllJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: devobj.dllJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: winmm.dllJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: rstrtmgr.dllJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ncrypt.dllJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ntasn1.dllJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: wininet.dllJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: devobj.dllJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: winmm.dllJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: rstrtmgr.dllJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: ncrypt.dllJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: ntasn1.dllJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: devobj.dllJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: winmm.dllJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: rstrtmgr.dllJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: ncrypt.dllJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: ntasn1.dllJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: devobj.dllJump to behavior
            Source: LisectAVT_2403002A_228.exeStatic file information: File size 2337286 > 1048576
            Source: LisectAVT_2403002A_228.exeStatic PE information: Raw size of ycahdotv is bigger than: 0x100000 < 0x1a8000

            Data Obfuscation

            barindex
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeUnpacked PE file: 0.2.LisectAVT_2403002A_228.exe.660000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ycahdotv:EW;urypsrur:EW; vs :ER;.rsrc:W;.idata :W; :EW;ycahdotv:EW;urypsrur:EW;
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeUnpacked PE file: 5.2.MPGPH131.exe.90000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ycahdotv:EW;urypsrur:EW; vs :ER;.rsrc:W;.idata :W; :EW;ycahdotv:EW;urypsrur:EW;
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeUnpacked PE file: 6.2.MPGPH131.exe.90000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ycahdotv:EW;urypsrur:EW; vs :ER;.rsrc:W;.idata :W; :EW;ycahdotv:EW;urypsrur:EW;
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeUnpacked PE file: 7.2.RageMP131.exe.1a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ycahdotv:EW;urypsrur:EW; vs :ER;.rsrc:W;.idata :W; :EW;ycahdotv:EW;urypsrur:EW;
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeUnpacked PE file: 9.2.RageMP131.exe.1a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ycahdotv:EW;urypsrur:EW; vs :ER;.rsrc:W;.idata :W; :EW;ycahdotv:EW;urypsrur:EW;
            Source: initial sampleStatic PE information: section where entry point is pointing to: urypsrur
            Source: RageMP131.exe.0.drStatic PE information: real checksum: 0x24412a should be: 0x244130
            Source: MPGPH131.exe.0.drStatic PE information: real checksum: 0x24412a should be: 0x244130
            Source: LisectAVT_2403002A_228.exeStatic PE information: real checksum: 0x24412a should be: 0x244130
            Source: LisectAVT_2403002A_228.exeStatic PE information: section name:
            Source: LisectAVT_2403002A_228.exeStatic PE information: section name: .idata
            Source: LisectAVT_2403002A_228.exeStatic PE information: section name:
            Source: LisectAVT_2403002A_228.exeStatic PE information: section name: ycahdotv
            Source: LisectAVT_2403002A_228.exeStatic PE information: section name: urypsrur
            Source: RageMP131.exe.0.drStatic PE information: section name:
            Source: RageMP131.exe.0.drStatic PE information: section name: .idata
            Source: RageMP131.exe.0.drStatic PE information: section name:
            Source: RageMP131.exe.0.drStatic PE information: section name: ycahdotv
            Source: RageMP131.exe.0.drStatic PE information: section name: urypsrur
            Source: MPGPH131.exe.0.drStatic PE information: section name:
            Source: MPGPH131.exe.0.drStatic PE information: section name: .idata
            Source: MPGPH131.exe.0.drStatic PE information: section name:
            Source: MPGPH131.exe.0.drStatic PE information: section name: ycahdotv
            Source: MPGPH131.exe.0.drStatic PE information: section name: urypsrur
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_00BFC032 push 5BB0774Eh; mov dword ptr [esp], esi0_2_00BFC0D4
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_00BFC032 push 1E266FA6h; mov dword ptr [esp], ebx0_2_00BFC0E7
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_00BFC000 push edi; mov dword ptr [esp], 572ECACCh0_2_00BFC001
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_00BFC000 push edi; mov dword ptr [esp], eax0_2_00BFC00C
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_00BFC000 push 5BB0774Eh; mov dword ptr [esp], esi0_2_00BFC0D4
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_00BFC000 push 1E266FA6h; mov dword ptr [esp], ebx0_2_00BFC0E7
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_00BFC181 push 61718D2Ch; mov dword ptr [esp], edx0_2_00BFC186
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_00BFC181 push edx; mov dword ptr [esp], edi0_2_00BFC19F
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_00BFC181 push ebp; mov dword ptr [esp], 778D7D56h0_2_00BFC1A9
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_00BFC181 push 38B89D2Ch; mov dword ptr [esp], edx0_2_00BFC1F8
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_00BFC181 push eax; mov dword ptr [esp], 0A15BB94h0_2_00BFC26B
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_0073FA97 push ecx; ret 0_2_0073FAAA
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 5_2_0062C032 push 5BB0774Eh; mov dword ptr [esp], esi5_2_0062C0D4
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 5_2_0062C032 push 1E266FA6h; mov dword ptr [esp], ebx5_2_0062C0E7
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 5_2_0062C000 push edi; mov dword ptr [esp], 572ECACCh5_2_0062C001
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 5_2_0062C000 push edi; mov dword ptr [esp], eax5_2_0062C00C
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 5_2_0062C000 push 5BB0774Eh; mov dword ptr [esp], esi5_2_0062C0D4
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 5_2_0062C000 push 1E266FA6h; mov dword ptr [esp], ebx5_2_0062C0E7
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 5_2_0062C181 push 61718D2Ch; mov dword ptr [esp], edx5_2_0062C186
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 5_2_0062C181 push edx; mov dword ptr [esp], edi5_2_0062C19F
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 5_2_0062C181 push ebp; mov dword ptr [esp], 778D7D56h5_2_0062C1A9
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 5_2_0062C181 push 38B89D2Ch; mov dword ptr [esp], edx5_2_0062C1F8
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 5_2_0062C181 push eax; mov dword ptr [esp], 0A15BB94h5_2_0062C26B
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 5_2_0016FA97 push ecx; ret 5_2_0016FAAA
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_0062C032 push 5BB0774Eh; mov dword ptr [esp], esi6_2_0062C0D4
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_0062C032 push 1E266FA6h; mov dword ptr [esp], ebx6_2_0062C0E7
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_0062C000 push edi; mov dword ptr [esp], 572ECACCh6_2_0062C001
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_0062C000 push edi; mov dword ptr [esp], eax6_2_0062C00C
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_0062C000 push 5BB0774Eh; mov dword ptr [esp], esi6_2_0062C0D4
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_0062C000 push 1E266FA6h; mov dword ptr [esp], ebx6_2_0062C0E7
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_0062C181 push 61718D2Ch; mov dword ptr [esp], edx6_2_0062C186
            Source: LisectAVT_2403002A_228.exeStatic PE information: section name: entropy: 7.988928375890931
            Source: LisectAVT_2403002A_228.exeStatic PE information: section name: ycahdotv entropy: 7.949088772265462
            Source: RageMP131.exe.0.drStatic PE information: section name: entropy: 7.988928375890931
            Source: RageMP131.exe.0.drStatic PE information: section name: ycahdotv entropy: 7.949088772265462
            Source: MPGPH131.exe.0.drStatic PE information: section name: entropy: 7.988928375890931
            Source: MPGPH131.exe.0.drStatic PE information: section name: ycahdotv entropy: 7.949088772265462
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeFile created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeJump to dropped file
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeFile created: C:\ProgramData\MPGPH131\MPGPH131.exeJump to dropped file
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeFile created: C:\ProgramData\MPGPH131\MPGPH131.exeJump to dropped file

            Boot Survival

            barindex
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeWindow searched: window name: FilemonClassJump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeWindow searched: window name: RegmonClassJump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeWindow searched: window name: FilemonClassJump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeWindow searched: window name: RegmonclassJump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeWindow searched: window name: FilemonclassJump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: FilemonClassJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: RegmonClassJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: FilemonClassJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: RegmonclassJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: FilemonclassJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: FilemonClassJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: RegmonClassJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: FilemonClassJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: RegmonclassJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: FilemonclassJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: FilemonClassJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: RegmonClassJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: FilemonClassJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: RegmonclassJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: FilemonclassJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: FilemonClassJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: RegmonClassJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: FilemonClassJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: RegmonclassJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: FilemonclassJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131Jump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131Jump to behavior

            Malware Analysis System Evasion

            barindex
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeEvasive API call chain: GetPEB, DecisionNodes, Sleepgraph_5-19795
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeEvasive API call chain: GetPEB, DecisionNodes, Sleepgraph_0-19646
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeEvasive API call chain: GetPEB, DecisionNodes, Sleepgraph_7-18875
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 7A02DD second address: 7A02E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 7A02E1 second address: 7A02E7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 79FBA3 second address: 79FBA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 8FFD72 second address: 8FFD7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 90F517 second address: 90F53C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edx 0x0000000b pop edx 0x0000000c jp 00007F33ECB900D6h 0x00000012 jl 00007F33ECB900D6h 0x00000018 popad 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 90F53C second address: 90F549 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 91276E second address: 912772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 912772 second address: 912776 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 912776 second address: 9127D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov esi, dword ptr [ebp+122D2ADDh] 0x0000000f push 00000000h 0x00000011 mov dword ptr [ebp+122D1AEDh], ebx 0x00000017 call 00007F33ECB900D9h 0x0000001c jmp 00007F33ECB900E5h 0x00000021 push eax 0x00000022 jng 00007F33ECB900DEh 0x00000028 mov eax, dword ptr [esp+04h] 0x0000002c ja 00007F33ECB900DEh 0x00000032 mov eax, dword ptr [eax] 0x00000034 push ebx 0x00000035 pushad 0x00000036 pushad 0x00000037 popad 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 912881 second address: 91289B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33ECEDC496h 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 91289B second address: 91289F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 91289F second address: 9128AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9128AE second address: 91292D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F33ECB900E1h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007F33ECB900D8h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 0000001Ah 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 push 00000000h 0x00000028 mov edi, dword ptr [ebp+122D2AB5h] 0x0000002e call 00007F33ECB900D9h 0x00000033 jne 00007F33ECB900E8h 0x00000039 push eax 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F33ECB900E8h 0x00000042 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 91292D second address: 91293C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F33ECEDC486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 91293C second address: 912954 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jbe 00007F33ECB900E2h 0x00000010 js 00007F33ECB900DCh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 912954 second address: 912963 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, dword ptr [eax] 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F33ECEDC486h 0x0000000f rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 912963 second address: 912988 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jc 00007F33ECB900DCh 0x00000016 jnc 00007F33ECB900D6h 0x0000001c rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 924240 second address: 924244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 924244 second address: 924248 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9331C2 second address: 9331C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9331C7 second address: 9331D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 ja 00007F33ECB900D6h 0x0000000c rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 906A00 second address: 906A04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 906A04 second address: 906A14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 je 00007F33ECB900D6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 931034 second address: 9310A1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F33ECEDC498h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c jmp 00007F33ECEDC496h 0x00000011 push edi 0x00000012 pop edi 0x00000013 pop esi 0x00000014 push eax 0x00000015 jne 00007F33ECEDC486h 0x0000001b jmp 00007F33ECEDC499h 0x00000020 pop eax 0x00000021 js 00007F33ECEDC48Eh 0x00000027 push eax 0x00000028 pop eax 0x00000029 jnl 00007F33ECEDC486h 0x0000002f popad 0x00000030 push eax 0x00000031 push edx 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9310A1 second address: 9310A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9310A7 second address: 9310AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 931260 second address: 931273 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 931273 second address: 931287 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F33ECEDC48Eh 0x00000008 pushad 0x00000009 popad 0x0000000a js 00007F33ECEDC486h 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 93140E second address: 931412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 931412 second address: 931428 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007F33ECEDC486h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007F33ECEDC486h 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 931428 second address: 931438 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900DCh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 931438 second address: 93144E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jnp 00007F33ECEDC486h 0x0000000f pop eax 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 93144E second address: 931454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 931454 second address: 931465 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jc 00007F33ECEDC48Ch 0x0000000b jne 00007F33ECEDC486h 0x00000011 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9315B9 second address: 9315BE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9316E9 second address: 9316EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9316EF second address: 931700 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F33ECB900DCh 0x0000000a rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 931700 second address: 93171A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F33ECEDC495h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 93187A second address: 931883 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push edx 0x00000007 pop edx 0x00000008 pop ebx 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 931883 second address: 931897 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33ECEDC48Eh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 931897 second address: 9318BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900E5h 0x00000007 jc 00007F33ECB900D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push edx 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9318BB second address: 9318CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edi 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c pop eax 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 931A1D second address: 931AA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F33ECB900DBh 0x0000000f jmp 00007F33ECB900E0h 0x00000014 jl 00007F33ECB900D6h 0x0000001a popad 0x0000001b jns 00007F33ECB900DCh 0x00000021 popad 0x00000022 pushad 0x00000023 jnp 00007F33ECB900DAh 0x00000029 pushad 0x0000002a jmp 00007F33ECB900E7h 0x0000002f jmp 00007F33ECB900E3h 0x00000034 pushad 0x00000035 popad 0x00000036 popad 0x00000037 jbe 00007F33ECB900E8h 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 931C66 second address: 931C6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 931C6A second address: 931C7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F33ECB900DBh 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 931DF9 second address: 931E01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 931E01 second address: 931E0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 932086 second address: 9320B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F33ECEDC486h 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 jmp 00007F33ECEDC499h 0x00000018 pop edx 0x00000019 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9275BC second address: 9275C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9275C0 second address: 9275C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9275C4 second address: 9275CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9275CC second address: 9275F7 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F33ECEDC488h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F33ECEDC490h 0x00000010 jng 00007F33ECEDC48Ah 0x00000016 push edx 0x00000017 pop edx 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push ebx 0x0000001d pop ebx 0x0000001e rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 932327 second address: 93233D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F33ECB900DEh 0x0000000d rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 93233D second address: 932347 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 932347 second address: 93234B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 93234B second address: 932384 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F33ECEDC486h 0x00000008 jmp 00007F33ECEDC498h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 jbe 00007F33ECEDC48Ah 0x00000018 push eax 0x00000019 push edx 0x0000001a jnc 00007F33ECEDC486h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 932384 second address: 932388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 932865 second address: 93286A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 93286A second address: 93288B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F33ECB900DBh 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F33ECB900DCh 0x00000014 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9329FD second address: 932A18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 jmp 00007F33ECEDC491h 0x0000000e pop edi 0x0000000f rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 932A18 second address: 932A1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 932D59 second address: 932D63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F33ECEDC486h 0x0000000a rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 933049 second address: 93304F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 93304F second address: 933053 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 937A37 second address: 937A54 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 937EA3 second address: 937EAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F33ECEDC486h 0x0000000a rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 937EAD second address: 937EC2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jc 00007F33ECB900D6h 0x00000014 popad 0x00000015 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 937EC2 second address: 937ECD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F33ECEDC486h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 936FE8 second address: 936FEE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 8FFD6B second address: 8FFD72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 93CDD8 second address: 93CDDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 93D201 second address: 93D21C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33ECEDC494h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9409E7 second address: 9409F1 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F33ECB900D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9409F1 second address: 9409F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 940E51 second address: 940E56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 940E56 second address: 940E5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 940E5C second address: 940E7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F33ECB900E2h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 940E7B second address: 940E80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 940E80 second address: 940E85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 940E85 second address: 940E8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 940F98 second address: 940F9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 941592 second address: 9415C0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F33ECEDC48Ch 0x00000008 jg 00007F33ECEDC486h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, ebx 0x00000011 jmp 00007F33ECEDC493h 0x00000016 nop 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a jp 00007F33ECEDC486h 0x00000020 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9415C0 second address: 9415EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jg 00007F33ECB900D6h 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a jnc 00007F33ECB900D6h 0x00000020 popad 0x00000021 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 94183F second address: 941843 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 941AFB second address: 941B05 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F33ECB900DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 941B05 second address: 941B13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 941B13 second address: 941B18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 941FEA second address: 942003 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECEDC48Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 942003 second address: 942007 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 942007 second address: 942023 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECEDC498h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 942023 second address: 942029 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 942029 second address: 9420BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F33ECEDC488h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000019h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 call 00007F33ECEDC48Eh 0x00000028 or dword ptr [ebp+122D1A84h], ecx 0x0000002e pop esi 0x0000002f mov di, cx 0x00000032 push 00000000h 0x00000034 mov dword ptr [ebp+122D39A9h], ecx 0x0000003a push eax 0x0000003b jmp 00007F33ECEDC495h 0x00000040 pop esi 0x00000041 push 00000000h 0x00000043 push 00000000h 0x00000045 push eax 0x00000046 call 00007F33ECEDC488h 0x0000004b pop eax 0x0000004c mov dword ptr [esp+04h], eax 0x00000050 add dword ptr [esp+04h], 00000019h 0x00000058 inc eax 0x00000059 push eax 0x0000005a ret 0x0000005b pop eax 0x0000005c ret 0x0000005d mov edi, dword ptr [ebp+122D29A9h] 0x00000063 push eax 0x00000064 pushad 0x00000065 push eax 0x00000066 push edx 0x00000067 ja 00007F33ECEDC486h 0x0000006d rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 942A13 second address: 942A3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33ECB900DFh 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F33ECB900E1h 0x00000013 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 942A3C second address: 942A40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 944B8B second address: 944B91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 944B91 second address: 944BA3 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F33ECEDC486h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 944BA3 second address: 944BA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 944BA7 second address: 944BC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F33ECEDC494h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 944BC8 second address: 944BCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 947C9C second address: 947CA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 947CA0 second address: 947CAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 94B81B second address: 94B821 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 94D47A second address: 94D47E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 94F43A second address: 94F455 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECEDC48Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 pop eax 0x00000012 popad 0x00000013 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 94F455 second address: 94F45B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 94E660 second address: 94E664 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 94E664 second address: 94E671 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 94E671 second address: 94E675 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 950538 second address: 95053C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 95053C second address: 950550 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECEDC490h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 950550 second address: 9505C5 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F33ECB900DCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F33ECB900D8h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 0000001Dh 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 jns 00007F33ECB900DCh 0x0000002b push 00000000h 0x0000002d sbb ebx, 61CEC8DBh 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push eax 0x00000038 call 00007F33ECB900D8h 0x0000003d pop eax 0x0000003e mov dword ptr [esp+04h], eax 0x00000042 add dword ptr [esp+04h], 00000016h 0x0000004a inc eax 0x0000004b push eax 0x0000004c ret 0x0000004d pop eax 0x0000004e ret 0x0000004f add di, 2000h 0x00000054 push eax 0x00000055 push ebx 0x00000056 push eax 0x00000057 push edx 0x00000058 push esi 0x00000059 pop esi 0x0000005a rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 95159E second address: 95161E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F33ECEDC490h 0x0000000a popad 0x0000000b push eax 0x0000000c jmp 00007F33ECEDC493h 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007F33ECEDC488h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 00000018h 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c push 00000000h 0x0000002e mov edi, dword ptr [ebp+122D2AD1h] 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push ebx 0x00000039 call 00007F33ECEDC488h 0x0000003e pop ebx 0x0000003f mov dword ptr [esp+04h], ebx 0x00000043 add dword ptr [esp+04h], 0000001Ch 0x0000004b inc ebx 0x0000004c push ebx 0x0000004d ret 0x0000004e pop ebx 0x0000004f ret 0x00000050 push eax 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 popad 0x00000057 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 95161E second address: 951622 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 951622 second address: 951628 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 952803 second address: 952807 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9545DB second address: 954616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 sbb ebx, 2BF970A5h 0x0000000c push 00000000h 0x0000000e call 00007F33ECEDC494h 0x00000013 pop edi 0x00000014 sbb ebx, 7342D511h 0x0000001a push 00000000h 0x0000001c mov edi, dword ptr [ebp+122D2B45h] 0x00000022 xchg eax, esi 0x00000023 pushad 0x00000024 je 00007F33ECEDC48Ch 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 954616 second address: 954638 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33ECB900E6h 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 954638 second address: 95464F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECEDC493h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9555D2 second address: 9555F5 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F33ECB900D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F33ECB900E6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9555F5 second address: 955669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 push edi 0x00000008 call 00007F33ECEDC493h 0x0000000d stc 0x0000000e pop edi 0x0000000f pop edi 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007F33ECEDC488h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 0000001Ah 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c xor dword ptr [ebp+12478329h], edi 0x00000032 add edi, dword ptr [ebp+122D194Bh] 0x00000038 or dword ptr [ebp+124546ECh], edx 0x0000003e push 00000000h 0x00000040 mov edi, dword ptr [ebp+122D2B15h] 0x00000046 xchg eax, esi 0x00000047 jmp 00007F33ECEDC492h 0x0000004c push eax 0x0000004d push edi 0x0000004e pushad 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9557AE second address: 9557CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F33ECB900D6h 0x0000000a popad 0x0000000b pushad 0x0000000c js 00007F33ECB900D6h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push esi 0x0000001a ja 00007F33ECB900D6h 0x00000020 pop esi 0x00000021 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9557CF second address: 9557E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33ECEDC493h 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 957661 second address: 957665 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 957665 second address: 957669 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 957669 second address: 9576FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ecx 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d jmp 00007F33ECB900DEh 0x00000012 pop eax 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push edx 0x00000017 call 00007F33ECB900D8h 0x0000001c pop edx 0x0000001d mov dword ptr [esp+04h], edx 0x00000021 add dword ptr [esp+04h], 0000001Dh 0x00000029 inc edx 0x0000002a push edx 0x0000002b ret 0x0000002c pop edx 0x0000002d ret 0x0000002e mov ebx, dword ptr [ebp+122D1A70h] 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push ebx 0x00000039 call 00007F33ECB900D8h 0x0000003e pop ebx 0x0000003f mov dword ptr [esp+04h], ebx 0x00000043 add dword ptr [esp+04h], 0000001Ch 0x0000004b inc ebx 0x0000004c push ebx 0x0000004d ret 0x0000004e pop ebx 0x0000004f ret 0x00000050 push 00000000h 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 js 00007F33ECB900EEh 0x0000005b jmp 00007F33ECB900E8h 0x00000060 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 95AB18 second address: 95AB25 instructions: 0x00000000 rdtsc 0x00000002 je 00007F33ECEDC486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 8FC859 second address: 8FC85D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 965D46 second address: 965D4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 965D4A second address: 965D61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33ECB900DBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 965D61 second address: 965D86 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECEDC491h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F33ECEDC48Ah 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 965D86 second address: 965D8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 903341 second address: 903347 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 965462 second address: 965471 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F33ECB900D8h 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9655E3 second address: 9655F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F33ECEDC486h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9655F2 second address: 9655F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9655F8 second address: 9655FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9655FE second address: 96560E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jnp 00007F33ECB900D6h 0x00000010 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 96560E second address: 965612 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 965758 second address: 96575C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 96575C second address: 96576E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F33ECEDC48Ch 0x0000000c rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 96821E second address: 968228 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 968228 second address: 968233 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 968233 second address: 96823D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 96823D second address: 96825F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33ECEDC490h 0x00000009 push esi 0x0000000a pop esi 0x0000000b jo 00007F33ECEDC486h 0x00000011 popad 0x00000012 push ecx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 96825F second address: 96826C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jl 00007F33ECB900ECh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 8F9632 second address: 8F9638 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 8F9638 second address: 8F9641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 8F9641 second address: 8F964C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F33ECEDC486h 0x0000000a pop ecx 0x0000000b rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 8F964C second address: 8F9652 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 8F9652 second address: 8F966C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECEDC496h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 96ED38 second address: 96ED3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 973BDB second address: 973C21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F33ECEDC486h 0x0000000a popad 0x0000000b pushad 0x0000000c js 00007F33ECEDC486h 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007F33ECEDC496h 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e jnc 00007F33ECEDC486h 0x00000024 jmp 00007F33ECEDC491h 0x00000029 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 973C21 second address: 973C27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9428D0 second address: 9428DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 972960 second address: 972966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 972966 second address: 972983 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F33ECEDC486h 0x0000000a jmp 00007F33ECEDC492h 0x0000000f popad 0x00000010 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 972983 second address: 9729A8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F33ECB900E9h 0x00000008 pop ecx 0x00000009 ja 00007F33ECB900DCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9729A8 second address: 9729B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9729B3 second address: 9729B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9738E5 second address: 9738EB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9738EB second address: 973911 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F33ECB900F0h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 973911 second address: 973917 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 973917 second address: 97391B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 97391B second address: 973921 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 978000 second address: 97800B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 93F323 second address: 9275BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov edi, dword ptr [ebp+122D2B4Dh] 0x00000011 call dword ptr [ebp+122D1C0Ah] 0x00000017 push eax 0x00000018 push edx 0x00000019 push edi 0x0000001a jmp 00007F33ECEDC499h 0x0000001f pop edi 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 93FA3B second address: 93FA4A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 93FA4A second address: 93FA54 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F33ECEDC486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 93FBA1 second address: 93FBA7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 93FD55 second address: 93FD5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 93FD5C second address: 93FD61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 93FD61 second address: 93FD67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 93FD67 second address: 93FD97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push ecx 0x0000000b movzx edi, si 0x0000000e pop ecx 0x0000000f push 00000004h 0x00000011 xor dword ptr [ebp+122D1C05h], eax 0x00000017 nop 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F33ECB900E6h 0x0000001f rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 93FD97 second address: 93FDA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F33ECEDC486h 0x0000000a rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9401AF second address: 9401C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007F33ECB900D6h 0x00000011 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 94065C second address: 940677 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F33ECEDC491h 0x00000008 jmp 00007F33ECEDC48Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 940677 second address: 94067B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 97786F second address: 97787D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F33ECEDC486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 97787D second address: 977883 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9779B0 second address: 9779BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007F33ECEDC486h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 977C4E second address: 977C5A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jnp 00007F33ECB900D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 977C5A second address: 977C63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 97A5C7 second address: 97A5CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 97F812 second address: 97F838 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECEDC48Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F33ECEDC48Fh 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 97F838 second address: 97F842 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F33ECB900E8h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 97F842 second address: 97F85C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33ECEDC48Ch 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007F33ECEDC486h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 97FDE1 second address: 97FDEB instructions: 0x00000000 rdtsc 0x00000002 jp 00007F33ECB900D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 97FDEB second address: 97FE01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECEDC490h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 97FE01 second address: 97FE05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 97F35D second address: 97F361 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 97F361 second address: 97F393 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F33ECB900D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jnc 00007F33ECB900D6h 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 jp 00007F33ECB900D6h 0x0000001c jmp 00007F33ECB900E6h 0x00000021 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 980389 second address: 98039D instructions: 0x00000000 rdtsc 0x00000002 js 00007F33ECEDC496h 0x00000008 jmp 00007F33ECEDC48Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 98039D second address: 9803B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F33ECB900DAh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 98689F second address: 9868C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 pushad 0x00000007 jg 00007F33ECEDC49Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9868C8 second address: 9868EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F33ECB900E7h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 98AEE6 second address: 98AEEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 98AEEA second address: 98AEEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 98B460 second address: 98B46A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 98B599 second address: 98B5A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jbe 00007F33ECB900DCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 98B5A6 second address: 98B5CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F33ECEDC488h 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F33ECEDC48Fh 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jp 00007F33ECEDC486h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 98B5CD second address: 98B5D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 98B5D1 second address: 98B5D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 98B780 second address: 98B79B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 98B940 second address: 98B94E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECEDC48Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 98BD4D second address: 98BD67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007F33ECB900DEh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 98BD67 second address: 98BD6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 98AA31 second address: 98AA62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900E4h 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007F33ECB900D6h 0x0000000f jmp 00007F33ECB900E3h 0x00000014 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 98AA62 second address: 98AA66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 98F6B5 second address: 98F6E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900DDh 0x00000007 jmp 00007F33ECB900E7h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 98F6E3 second address: 98F6E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 98F6E9 second address: 98F70B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900DDh 0x00000007 jmp 00007F33ECB900E1h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 991C79 second address: 991C7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 998423 second address: 998429 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 93FF7F second address: 93FF98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F33ECEDC490h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 93FF98 second address: 93FFA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 997451 second address: 99746C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECEDC491h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 99746C second address: 997476 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F33ECB900D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 997476 second address: 9974C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007F33ECEDC493h 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop edi 0x0000000f popad 0x00000010 push edx 0x00000011 jmp 00007F33ECEDC496h 0x00000016 push eax 0x00000017 push edx 0x00000018 jc 00007F33ECEDC486h 0x0000001e jmp 00007F33ECEDC48Eh 0x00000023 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9974C1 second address: 9974C7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9975E1 second address: 997631 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F33ECEDC4A1h 0x0000000c je 00007F33ECEDC486h 0x00000012 jmp 00007F33ECEDC495h 0x00000017 popad 0x00000018 pushad 0x00000019 jmp 00007F33ECEDC497h 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F33ECEDC48Eh 0x00000025 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 99AD71 second address: 99AD99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F33ECB900E3h 0x0000000e rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 99AF65 second address: 99AF69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9A032E second address: 9A034F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 ja 00007F33ECB900D6h 0x0000000c jmp 00007F33ECB900DBh 0x00000011 popad 0x00000012 pushad 0x00000013 js 00007F33ECB900D6h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9A034F second address: 9A0358 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9A0358 second address: 9A035C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 99F62A second address: 99F64B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F33ECEDC498h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 99F64B second address: 99F66F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jns 00007F33ECB900D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F33ECB900E4h 0x00000015 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 99F7BB second address: 99F7BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 99F90C second address: 99F91B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007F33ECB900D6h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 99FA96 second address: 99FAAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F33ECEDC48Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 99FAAB second address: 99FAAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 99FAAF second address: 99FABA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 99FABA second address: 99FAC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 99FC2A second address: 99FC3B instructions: 0x00000000 rdtsc 0x00000002 jo 00007F33ECEDC48Ah 0x00000008 push edx 0x00000009 pop edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9A41F3 second address: 9A41F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9A41F9 second address: 9A41FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9A41FD second address: 9A4207 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9A4207 second address: 9A4211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F33ECEDC486h 0x0000000a rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9A3B69 second address: 9A3B6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9A3CB2 second address: 9A3CD0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECEDC495h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9A3CD0 second address: 9A3CDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F33ECB900D6h 0x0000000a popad 0x0000000b rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9A3CDB second address: 9A3CEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F33ECEDC48Ah 0x0000000b rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9A3CEB second address: 9A3D0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007F33ECB900D8h 0x00000013 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9A3E59 second address: 9A3E5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9A3E5D second address: 9A3E77 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900DAh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007F33ECB900D6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9A3E77 second address: 9A3E7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9A3E7B second address: 9A3EB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 jmp 00007F33ECB900E1h 0x0000000e jmp 00007F33ECB900E9h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9A3EB0 second address: 9A3EBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9A3EBA second address: 9A3ECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007F33ECB900D6h 0x0000000d jp 00007F33ECB900D6h 0x00000013 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9A3ECD second address: 9A3EEF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECEDC48Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F33ECEDC48Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9A9A8E second address: 9A9AAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F33ECB900DFh 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9A9AAC second address: 9A9AB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9A9D88 second address: 9A9D93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F33ECB900D6h 0x0000000a pop esi 0x0000000b rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9A9D93 second address: 9A9D9D instructions: 0x00000000 rdtsc 0x00000002 jl 00007F33ECEDC48Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9AAF13 second address: 9AAF3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900E4h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F33ECB900DFh 0x00000010 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9AAF3C second address: 9AAF42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9AF66E second address: 9AF674 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9AE8EB second address: 9AE8EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9AE8EF second address: 9AE92B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007F33ECB900D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jno 00007F33ECB900D6h 0x00000013 jmp 00007F33ECB900E5h 0x00000018 pop edi 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F33ECB900DFh 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9AED2C second address: 9AED30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9AED30 second address: 9AED38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9AF070 second address: 9AF074 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9AF074 second address: 9AF08B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F33ECB900DEh 0x0000000c push esi 0x0000000d pop esi 0x0000000e jl 00007F33ECB900D6h 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9AF332 second address: 9AF336 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9BC0D8 second address: 9BC0DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9BC240 second address: 9BC249 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9BC249 second address: 9BC251 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9BC67B second address: 9BC67F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9BCC45 second address: 9BCC4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F33ECB900D6h 0x0000000a rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9BCC4F second address: 9BCC55 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9BCDF0 second address: 9BCE05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33ECB900E1h 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9BCE05 second address: 9BCE3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b je 00007F33ECEDC486h 0x00000011 pop ecx 0x00000012 pushad 0x00000013 jmp 00007F33ECEDC491h 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007F33ECEDC492h 0x0000001f popad 0x00000020 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9BCE3E second address: 9BCE44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9BCE44 second address: 9BCE48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9BCFE6 second address: 9BCFFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33ECB900E1h 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9BBCD8 second address: 9BBCF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F33ECEDC494h 0x0000000d rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9BBCF4 second address: 9BBCFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9BBCFC second address: 9BBD2B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F33ECEDC495h 0x00000008 pop edx 0x00000009 pushad 0x0000000a jmp 00007F33ECEDC493h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9C4269 second address: 9C426F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9D2FA6 second address: 9D2FB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007F33ECEDC486h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9D5A9C second address: 9D5AA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F33ECB900D6h 0x0000000a popad 0x0000000b rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9D5AA7 second address: 9D5ABE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F33ECEDC490h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9D7705 second address: 9D7709 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9EC3BC second address: 9EC3C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9EC3C2 second address: 9EC3C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9F028B second address: 9F02A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33ECEDC493h 0x00000009 popad 0x0000000a rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9F26E4 second address: 9F26EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F33ECB900D6h 0x0000000a rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9F26EE second address: 9F270B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007F33ECEDC499h 0x0000000e jmp 00007F33ECEDC48Dh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9FC250 second address: 9FC265 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900E0h 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9FC265 second address: 9FC273 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop eax 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9FC273 second address: 9FC279 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9FC279 second address: 9FC27D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9FC27D second address: 9FC29F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F33ECB900E6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9FC29F second address: 9FC2A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9FBDCB second address: 9FBDD1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9FBDD1 second address: 9FBDD6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 9FBDD6 second address: 9FBDEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F33ECB900D6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: A0AEE5 second address: A0AEF3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 pop edi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: A0AD1A second address: A0AD4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900DEh 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jg 00007F33ECB900D6h 0x00000012 jmp 00007F33ECB900E2h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: A0AD4A second address: A0AD87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECEDC492h 0x00000007 jmp 00007F33ECEDC48Ah 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 push edi 0x00000011 pop edi 0x00000012 jmp 00007F33ECEDC493h 0x00000017 push edi 0x00000018 pop edi 0x00000019 popad 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: A0AD87 second address: A0AD8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: A0AD8F second address: A0ADB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33ECEDC48Bh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F33ECEDC494h 0x00000011 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: A08BC9 second address: A08BCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: A1BE15 second address: A1BE29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jbe 00007F33ECEDC486h 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: A1BC70 second address: A1BC74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: A1E6F7 second address: A1E6FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: A1E6FD second address: A1E73B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900E8h 0x00000007 push edi 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F33ECB900E9h 0x00000017 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: A1E73B second address: A1E754 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F33ECEDC48Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: A1E754 second address: A1E758 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: A41848 second address: A41851 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: A4097D second address: A409A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F33ECB900D6h 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 je 00007F33ECB900D6h 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 popad 0x00000019 js 00007F33ECB900E8h 0x0000001f push ecx 0x00000020 jnl 00007F33ECB900D6h 0x00000026 pop ecx 0x00000027 push ebx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: A40AC8 second address: A40ACC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: A40C31 second address: A40C38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: A40C38 second address: A40C40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: A40D8F second address: A40D98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: A4740A second address: A47427 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33ECEDC499h 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: A4A8CA second address: A4A8D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: A4A8D0 second address: A4A8D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: A4A8D4 second address: A4A8F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007F33ECB900DEh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: A4A8F1 second address: A4A90B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F33ECEDC48Ah 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f jnc 00007F33ECEDC486h 0x00000015 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50A06FC second address: 50A0700 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50A0700 second address: 50A0706 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50A0706 second address: 50A070C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50A070C second address: 50A072D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECEDC491h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov dh, 58h 0x00000011 movzx esi, dx 0x00000014 popad 0x00000015 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50A072D second address: 50A074D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov ax, bx 0x00000011 mov edx, 624A1B5Ch 0x00000016 popad 0x00000017 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50A074D second address: 50A079D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECEDC492h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov cx, bx 0x00000010 pushfd 0x00000011 jmp 00007F33ECEDC499h 0x00000016 add eax, 319B4516h 0x0000001c jmp 00007F33ECEDC491h 0x00000021 popfd 0x00000022 popad 0x00000023 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 5060DDF second address: 5060DE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 5060DE5 second address: 5060E60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECEDC48Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov esi, 4262EA9Dh 0x00000010 call 00007F33ECEDC48Ah 0x00000015 pushfd 0x00000016 jmp 00007F33ECEDC492h 0x0000001b sbb si, 3728h 0x00000020 jmp 00007F33ECEDC48Bh 0x00000025 popfd 0x00000026 pop esi 0x00000027 popad 0x00000028 push eax 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007F33ECEDC494h 0x00000030 and cx, 6988h 0x00000035 jmp 00007F33ECEDC48Bh 0x0000003a popfd 0x0000003b mov ebx, eax 0x0000003d popad 0x0000003e xchg eax, ebp 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 5060E60 second address: 5060E64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 5060E64 second address: 5060E7B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECEDC493h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50E07A7 second address: 50E07AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50E07AD second address: 50E07CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F33ECEDC497h 0x00000010 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 5060ACE second address: 5060AEF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ah, 8Ah 0x0000000f mov edi, 604786EAh 0x00000014 popad 0x00000015 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 5060AEF second address: 5060B2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F33ECEDC48Eh 0x00000009 add ch, FFFFFFA8h 0x0000000c jmp 00007F33ECEDC48Bh 0x00000011 popfd 0x00000012 movzx eax, bx 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 xchg eax, ebp 0x00000019 jmp 00007F33ECEDC48Bh 0x0000001e mov ebp, esp 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 mov bx, 93C6h 0x00000027 mov ax, dx 0x0000002a popad 0x0000002b rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 5060B2F second address: 5060B36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, B8h 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 5060B36 second address: 5060B60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push dword ptr [ebp+04h] 0x0000000a jmp 00007F33ECEDC497h 0x0000000f push dword ptr [ebp+0Ch] 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 5060B60 second address: 5060B64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 5060B64 second address: 5060B68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 5060B68 second address: 5060B6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 5060B6E second address: 5060BE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F33ECEDC498h 0x00000009 xor esi, 786FB9F8h 0x0000000f jmp 00007F33ECEDC48Bh 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F33ECEDC498h 0x0000001b xor ch, 00000058h 0x0000001e jmp 00007F33ECEDC48Bh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 push dword ptr [ebp+08h] 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F33ECEDC495h 0x00000031 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 5060C18 second address: 5060C1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 5060C1C second address: 5060C22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 5060C22 second address: 5060C28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 5060C28 second address: 5060C2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 5060C2C second address: 5060C42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F33ECB900DBh 0x00000010 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B0C03 second address: 50B0C09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B0C09 second address: 50B0C21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, B693h 0x00000007 mov ax, 28EFh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 push edi 0x00000011 push esi 0x00000012 pop edx 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B0C21 second address: 50B0C25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B0C25 second address: 50B0C35 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ebx 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B0C35 second address: 50B0CCB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECEDC495h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov esi, 3EC0AE53h 0x00000011 pushfd 0x00000012 jmp 00007F33ECEDC498h 0x00000017 and cx, 47D8h 0x0000001c jmp 00007F33ECEDC48Bh 0x00000021 popfd 0x00000022 popad 0x00000023 pop ebp 0x00000024 pushad 0x00000025 push eax 0x00000026 pushfd 0x00000027 jmp 00007F33ECEDC48Bh 0x0000002c adc eax, 01C8FA9Eh 0x00000032 jmp 00007F33ECEDC499h 0x00000037 popfd 0x00000038 pop eax 0x00000039 push eax 0x0000003a push edx 0x0000003b call 00007F33ECEDC497h 0x00000040 pop eax 0x00000041 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 510041A second address: 5100420 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 5100420 second address: 510043E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F33ECEDC493h 0x00000010 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 510043E second address: 5100444 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 5100444 second address: 5100448 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 5100448 second address: 510045F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F33ECB900DAh 0x00000012 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50E0E6B second address: 50E0E6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50E0E6F second address: 50E0E8C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50E0E8C second address: 50E0EFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F33ECEDC497h 0x00000009 or al, 0000001Eh 0x0000000c jmp 00007F33ECEDC499h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007F33ECEDC490h 0x00000018 adc cl, 00000018h 0x0000001b jmp 00007F33ECEDC48Bh 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 pop ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F33ECEDC495h 0x0000002c rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 5070484 second address: 5070488 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 5070488 second address: 507048E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 507048E second address: 50704D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F33ECB900E3h 0x00000012 call 00007F33ECB900E8h 0x00000017 pop eax 0x00000018 popad 0x00000019 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50704D4 second address: 50704E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, ax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50704E5 second address: 50704E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50704E9 second address: 50704ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50704ED second address: 50704F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50E05D8 second address: 50E0620 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F33ECEDC498h 0x00000008 or ax, 24F8h 0x0000000d jmp 00007F33ECEDC48Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a call 00007F33ECEDC491h 0x0000001f pop eax 0x00000020 mov eax, ebx 0x00000022 popad 0x00000023 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50E0620 second address: 50E0635 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50E0635 second address: 50E0639 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50E0639 second address: 50E063F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50E063F second address: 50E0653 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov eax, 184EA6F7h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50E0653 second address: 50E0658 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50E0C5A second address: 50E0C69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECEDC48Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50E0C69 second address: 50E0C6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50E0C6E second address: 50E0C8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F33ECEDC493h 0x00000011 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50E0C8D second address: 50E0CD5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c pushad 0x0000000d mov bx, 653Eh 0x00000011 popad 0x00000012 mov ebp, esp 0x00000014 jmp 00007F33ECB900E5h 0x00000019 mov eax, dword ptr [ebp+08h] 0x0000001c pushad 0x0000001d mov bl, ch 0x0000001f push eax 0x00000020 push edx 0x00000021 movsx edi, si 0x00000024 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50E0CD5 second address: 50E0CD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50E0CD9 second address: 50E0CFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 and dword ptr [eax], 00000000h 0x0000000a jmp 00007F33ECB900DCh 0x0000000f and dword ptr [eax+04h], 00000000h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov ecx, edi 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50E0CFB second address: 50E0D64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ebx 0x00000005 pushfd 0x00000006 jmp 00007F33ECEDC48Eh 0x0000000b sub cx, ABC8h 0x00000010 jmp 00007F33ECEDC48Bh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pop ebp 0x0000001a pushad 0x0000001b pushad 0x0000001c mov si, 07D1h 0x00000020 pushfd 0x00000021 jmp 00007F33ECEDC48Eh 0x00000026 add ecx, 5CC2AE28h 0x0000002c jmp 00007F33ECEDC48Bh 0x00000031 popfd 0x00000032 popad 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F33ECEDC496h 0x0000003a rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50E0D64 second address: 50E0D68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F0130 second address: 50F015E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F33ECEDC490h 0x0000000a sbb cx, 4678h 0x0000000f jmp 00007F33ECEDC48Bh 0x00000014 popfd 0x00000015 popad 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F015E second address: 50F0167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dx, 8C54h 0x00000008 popad 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F0167 second address: 50F01AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, 5C9Fh 0x00000007 pushfd 0x00000008 jmp 00007F33ECEDC494h 0x0000000d jmp 00007F33ECEDC495h 0x00000012 popfd 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F33ECEDC48Ch 0x0000001e rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F01AB second address: 50F01D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, bx 0x00000006 jmp 00007F33ECB900DDh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F33ECB900DDh 0x00000016 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F01D1 second address: 50F01E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33ECEDC48Ch 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F01E1 second address: 50F0209 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F33ECB900E7h 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F0209 second address: 50F020D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F020D second address: 50F0228 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50908A2 second address: 50908C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F33ECEDC48Ah 0x0000000a xor ax, 1098h 0x0000000f jmp 00007F33ECEDC48Bh 0x00000014 popfd 0x00000015 popad 0x00000016 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F0E44 second address: 50F0E4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F0E4A second address: 50F0E72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECEDC48Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F33ECEDC494h 0x00000013 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F0E72 second address: 50F0F13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F33ECB900E1h 0x00000009 sub al, FFFFFFC6h 0x0000000c jmp 00007F33ECB900E1h 0x00000011 popfd 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 jmp 00007F33ECB900DCh 0x0000001d mov ebp, esp 0x0000001f jmp 00007F33ECB900E0h 0x00000024 xchg eax, ecx 0x00000025 jmp 00007F33ECB900E0h 0x0000002a push eax 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007F33ECB900E1h 0x00000032 jmp 00007F33ECB900DBh 0x00000037 popfd 0x00000038 push ecx 0x00000039 mov edx, 03527B1Ah 0x0000003e pop edi 0x0000003f popad 0x00000040 xchg eax, ecx 0x00000041 jmp 00007F33ECB900DEh 0x00000046 mov eax, dword ptr [76FB65FCh] 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F0F13 second address: 50F0F17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F0F17 second address: 50F0F1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F02D4 second address: 50F02E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECEDC48Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F02E3 second address: 50F0303 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov esi, edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F33ECB900E3h 0x00000012 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F0303 second address: 50F0390 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F33ECEDC48Fh 0x00000009 xor eax, 77E1FE0Eh 0x0000000f jmp 00007F33ECEDC499h 0x00000014 popfd 0x00000015 mov ecx, 69DC2717h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov dword ptr [esp], ebp 0x00000020 pushad 0x00000021 mov ah, E2h 0x00000023 pushfd 0x00000024 jmp 00007F33ECEDC495h 0x00000029 adc cx, 30F6h 0x0000002e jmp 00007F33ECEDC491h 0x00000033 popfd 0x00000034 popad 0x00000035 mov ebp, esp 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a movsx ebx, si 0x0000003d call 00007F33ECEDC494h 0x00000042 pop esi 0x00000043 popad 0x00000044 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F0390 second address: 50F03AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33ECB900E7h 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B000B second address: 50B0023 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33ECEDC494h 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B0023 second address: 50B0039 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B0039 second address: 50B003F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B003F second address: 50B004A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 mov cx, F853h 0x0000000b rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B004A second address: 50B0094 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F33ECEDC498h 0x00000008 sub eax, 134E89D8h 0x0000000e jmp 00007F33ECEDC48Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b call 00007F33ECEDC492h 0x00000020 pop eax 0x00000021 push ebx 0x00000022 pop ecx 0x00000023 popad 0x00000024 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B0094 second address: 50B0099 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B0099 second address: 50B00AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dh, al 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f mov si, 49B9h 0x00000013 popad 0x00000014 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B00AD second address: 50B00D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F33ECB900E5h 0x00000012 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B00D9 second address: 50B00DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B00DF second address: 50B00FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and esp, FFFFFFF8h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F33ECB900E2h 0x00000012 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B00FE second address: 50B0110 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33ECEDC48Eh 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B0110 second address: 50B012E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 jmp 00007F33ECB900DCh 0x0000000e mov dword ptr [esp], ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B012E second address: 50B0132 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B0132 second address: 50B014F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B014F second address: 50B01AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F33ECEDC497h 0x00000009 and ch, FFFFFFDEh 0x0000000c jmp 00007F33ECEDC499h 0x00000011 popfd 0x00000012 mov esi, 6A3E0BA7h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F33ECEDC499h 0x00000022 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B01AB second address: 50B01D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 call 00007F33ECB900DDh 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 mov ax, 0F13h 0x00000014 movzx ecx, di 0x00000017 popad 0x00000018 xchg eax, ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B01D2 second address: 50B01D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B01D8 second address: 50B01E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 6198h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B01E1 second address: 50B021E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebx, dword ptr [ebp+10h] 0x0000000a pushad 0x0000000b push edx 0x0000000c pushfd 0x0000000d jmp 00007F33ECEDC496h 0x00000012 adc si, 8BF8h 0x00000017 jmp 00007F33ECEDC48Bh 0x0000001c popfd 0x0000001d pop esi 0x0000001e popad 0x0000001f push esp 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 mov eax, edi 0x00000025 popad 0x00000026 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B021E second address: 50B02AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F33ECB900DBh 0x00000009 xor eax, 42A08C6Eh 0x0000000f jmp 00007F33ECB900E9h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F33ECB900E0h 0x0000001b jmp 00007F33ECB900E5h 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 mov dword ptr [esp], esi 0x00000027 pushad 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007F33ECB900E6h 0x0000002f xor eax, 12621578h 0x00000035 jmp 00007F33ECB900DBh 0x0000003a popfd 0x0000003b popad 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B02AA second address: 50B02AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B02AE second address: 50B031C instructions: 0x00000000 rdtsc 0x00000002 mov al, 9Ch 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov esi, dword ptr [ebp+08h] 0x0000000a jmp 00007F33ECB900E7h 0x0000000f xchg eax, edi 0x00000010 pushad 0x00000011 call 00007F33ECB900E4h 0x00000016 movzx eax, bx 0x00000019 pop edi 0x0000001a pushfd 0x0000001b jmp 00007F33ECB900DCh 0x00000020 jmp 00007F33ECB900E5h 0x00000025 popfd 0x00000026 popad 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F33ECB900DCh 0x0000002f rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B031C second address: 50B0322 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B0322 second address: 50B0326 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B0326 second address: 50B037E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 pushad 0x0000000a pushad 0x0000000b call 00007F33ECEDC495h 0x00000010 pop esi 0x00000011 pushfd 0x00000012 jmp 00007F33ECEDC491h 0x00000017 or eax, 3AF34B96h 0x0000001d jmp 00007F33ECEDC491h 0x00000022 popfd 0x00000023 popad 0x00000024 mov eax, 5398F007h 0x00000029 popad 0x0000002a test esi, esi 0x0000002c pushad 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B037E second address: 50B03E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bh, 4Ch 0x00000006 popad 0x00000007 popad 0x00000008 je 00007F345EA0E365h 0x0000000e jmp 00007F33ECB900DAh 0x00000013 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000001a jmp 00007F33ECB900E0h 0x0000001f je 00007F345EA0E354h 0x00000025 jmp 00007F33ECB900E0h 0x0000002a mov edx, dword ptr [esi+44h] 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 call 00007F33ECB900E8h 0x00000035 pop esi 0x00000036 popad 0x00000037 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B03E3 second address: 50B0401 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, cx 0x00000006 mov esi, 70C9A0F9h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e or edx, dword ptr [ebp+0Ch] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F33ECEDC48Bh 0x00000018 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B0401 second address: 50B0407 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B0407 second address: 50B040B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B040B second address: 50B044E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test edx, 61000000h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 movzx ecx, di 0x00000014 pushfd 0x00000015 jmp 00007F33ECB900E5h 0x0000001a sub esi, 47162526h 0x00000020 jmp 00007F33ECB900E1h 0x00000025 popfd 0x00000026 popad 0x00000027 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50B044E second address: 50B04A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECEDC491h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F345ED5A6ABh 0x0000000f pushad 0x00000010 mov bh, 88h 0x00000012 popad 0x00000013 test byte ptr [esi+48h], 00000001h 0x00000017 jmp 00007F33ECEDC492h 0x0000001c jne 00007F345ED5A6A4h 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F33ECEDC497h 0x00000029 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C0008 second address: 50C000C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C000C second address: 50C0012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C0012 second address: 50C0027 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33ECB900E1h 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C0027 second address: 50C002B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C002B second address: 50C003B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C003B second address: 50C0040 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C0040 second address: 50C0046 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C0046 second address: 50C004A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C004A second address: 50C00B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e jmp 00007F33ECB900E0h 0x00000013 mov ebp, esp 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007F33ECB900DEh 0x0000001c add eax, 3D7CCC68h 0x00000022 jmp 00007F33ECB900DBh 0x00000027 popfd 0x00000028 mov ebx, esi 0x0000002a popad 0x0000002b and esp, FFFFFFF8h 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F33ECB900E1h 0x00000035 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C00B8 second address: 50C00BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C00BE second address: 50C00C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C00C2 second address: 50C0199 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F33ECEDC494h 0x0000000e mov dword ptr [esp], ebx 0x00000011 pushad 0x00000012 call 00007F33ECEDC48Eh 0x00000017 movzx ecx, dx 0x0000001a pop ebx 0x0000001b mov si, A0B3h 0x0000001f popad 0x00000020 xchg eax, esi 0x00000021 pushad 0x00000022 pushad 0x00000023 call 00007F33ECEDC492h 0x00000028 pop esi 0x00000029 mov dx, 6FF6h 0x0000002d popad 0x0000002e pushfd 0x0000002f jmp 00007F33ECEDC497h 0x00000034 add si, 807Eh 0x00000039 jmp 00007F33ECEDC499h 0x0000003e popfd 0x0000003f popad 0x00000040 push eax 0x00000041 jmp 00007F33ECEDC491h 0x00000046 xchg eax, esi 0x00000047 pushad 0x00000048 mov bx, si 0x0000004b call 00007F33ECEDC498h 0x00000050 mov eax, 044BC531h 0x00000055 pop esi 0x00000056 popad 0x00000057 mov esi, dword ptr [ebp+08h] 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e jmp 00007F33ECEDC48Fh 0x00000063 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C0199 second address: 50C01B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C01B6 second address: 50C01C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33ECEDC48Ch 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C01C6 second address: 50C022D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub ebx, ebx 0x0000000d pushad 0x0000000e mov edi, 41DDF1C8h 0x00000013 pushad 0x00000014 mov cx, bx 0x00000017 mov bh, 4Bh 0x00000019 popad 0x0000001a popad 0x0000001b test esi, esi 0x0000001d jmp 00007F33ECB900E2h 0x00000022 je 00007F345E9F6269h 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b pushfd 0x0000002c jmp 00007F33ECB900DDh 0x00000031 sbb ax, 3996h 0x00000036 jmp 00007F33ECB900E1h 0x0000003b popfd 0x0000003c mov bx, cx 0x0000003f popad 0x00000040 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C022D second address: 50C0258 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 movsx edi, cx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b cmp dword ptr [esi+08h], DDEEDDEEh 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F33ECEDC497h 0x00000019 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C0258 second address: 50C025E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C025E second address: 50C0262 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C0262 second address: 50C0266 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C0266 second address: 50C0278 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ah, 37h 0x0000000f mov esi, edx 0x00000011 popad 0x00000012 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C0278 second address: 50C02A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F345E9F61EFh 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F33ECB900E7h 0x00000016 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C02A9 second address: 50C02E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECEDC499h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test byte ptr [76FB6968h], 00000002h 0x00000010 pushad 0x00000011 mov eax, 04118B23h 0x00000016 mov edi, ecx 0x00000018 popad 0x00000019 jne 00007F345ED42566h 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C02E2 second address: 50C02E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C02E6 second address: 50C02FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECEDC493h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C03F5 second address: 50C03FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C03FB second address: 50C0401 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C0401 second address: 50C0405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 5121972 second address: 5121979 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 5121979 second address: 51219DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F33ECB900DDh 0x00000013 sub ecx, 002C1926h 0x00000019 jmp 00007F33ECB900E1h 0x0000001e popfd 0x0000001f pushfd 0x00000020 jmp 00007F33ECB900E0h 0x00000025 or al, FFFFFFC8h 0x00000028 jmp 00007F33ECB900DBh 0x0000002d popfd 0x0000002e popad 0x0000002f rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 51219DE second address: 5121A18 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECEDC499h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov dx, 01BEh 0x0000000f popad 0x00000010 xchg eax, ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 call 00007F33ECEDC48Eh 0x00000019 pop ecx 0x0000001a push edx 0x0000001b pop eax 0x0000001c popad 0x0000001d rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 5121A18 second address: 5121A5A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov si, 44CDh 0x00000010 pushfd 0x00000011 jmp 00007F33ECB900DAh 0x00000016 sub ecx, 205171E8h 0x0000001c jmp 00007F33ECB900DBh 0x00000021 popfd 0x00000022 popad 0x00000023 push 0000007Fh 0x00000025 pushad 0x00000026 push eax 0x00000027 mov edi, 634CBD56h 0x0000002c pop edx 0x0000002d push eax 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 5121AD0 second address: 5121972 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F33ECEDC490h 0x00000008 xor eax, 6004EE98h 0x0000000e jmp 00007F33ECEDC48Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 retn 0004h 0x0000001a lea eax, dword ptr [ebp-10h] 0x0000001d push eax 0x0000001e call ebx 0x00000020 mov edi, edi 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50E09C8 second address: 50E09CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50E09CE second address: 50E09F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, E7h 0x00000005 movsx ebx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F33ECEDC48Eh 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 pushad 0x00000015 mov cx, 0C83h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C0639 second address: 50C063D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C063D second address: 50C064E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECEDC48Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C064E second address: 50C065E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33ECB900DCh 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C065E second address: 50C069E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 pushad 0x0000000a mov bx, si 0x0000000d pushfd 0x0000000e jmp 00007F33ECEDC496h 0x00000013 adc eax, 42C7B9D8h 0x00000019 jmp 00007F33ECEDC48Bh 0x0000001e popfd 0x0000001f popad 0x00000020 mov dword ptr [esp], ebp 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C069E second address: 50C06A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C06A2 second address: 50C06A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50C06A8 second address: 50C06AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 51401EC second address: 51401F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 51401F0 second address: 51401F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 51401F6 second address: 514022A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F33ECEDC492h 0x00000009 sub eax, 3A6B92D8h 0x0000000f jmp 00007F33ECEDC48Bh 0x00000014 popfd 0x00000015 movzx ecx, bx 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 514022A second address: 514029A instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F33ECB900DAh 0x00000008 adc ecx, 66A95D38h 0x0000000e jmp 00007F33ECB900DBh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 movzx esi, dx 0x00000019 popad 0x0000001a mov dword ptr [esp], ebp 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F33ECB900E1h 0x00000024 xor ax, F3D6h 0x00000029 jmp 00007F33ECB900E1h 0x0000002e popfd 0x0000002f movzx esi, bx 0x00000032 popad 0x00000033 mov ebp, esp 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F33ECB900E6h 0x0000003c rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 514029A second address: 51402CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECEDC48Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+0Ch] 0x0000000c pushad 0x0000000d pushad 0x0000000e call 00007F33ECEDC492h 0x00000013 pop eax 0x00000014 mov dx, A146h 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b mov dl, C3h 0x0000001d rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 51402CA second address: 51402CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 51402CE second address: 514032B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push dword ptr [ebp+08h] 0x0000000a jmp 00007F33ECEDC492h 0x0000000f push 03AB7B09h 0x00000014 pushad 0x00000015 movsx edx, ax 0x00000018 pushfd 0x00000019 jmp 00007F33ECEDC498h 0x0000001e and cx, 8048h 0x00000023 jmp 00007F33ECEDC48Bh 0x00000028 popfd 0x00000029 popad 0x0000002a xor dword ptr [esp], 03AA7B0Bh 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 514032B second address: 514032F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 514032F second address: 514034A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECEDC497h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 514034A second address: 5140350 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 5140350 second address: 5140354 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 5140382 second address: 5140386 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 5140386 second address: 514038C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F075F second address: 50F0765 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F0765 second address: 50F0769 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F0769 second address: 50F076D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F076D second address: 50F079C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jmp 00007F33ECEDC48Ch 0x0000000e mov dword ptr [esp], ebp 0x00000011 jmp 00007F33ECEDC490h 0x00000016 mov ebp, esp 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b mov edi, eax 0x0000001d rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F079C second address: 50F07E7 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F33ECB900E8h 0x00000008 and cl, FFFFFFC8h 0x0000000b jmp 00007F33ECB900DBh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 and esp, FFFFFFF0h 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F33ECB900E7h 0x00000020 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F07E7 second address: 50F07ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F07ED second address: 50F0812 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov ebx, esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a sub esp, 44h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F33ECB900E4h 0x00000016 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F0812 second address: 50F0821 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECEDC48Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F0821 second address: 50F0845 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F0845 second address: 50F0849 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F0849 second address: 50F085C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F085C second address: 50F0874 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33ECEDC494h 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F0874 second address: 50F0891 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECB900DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d mov al, dl 0x0000000f popad 0x00000010 xchg eax, ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F0891 second address: 50F0895 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F0895 second address: 50F089B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F089B second address: 50F08F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECEDC48Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F33ECEDC48Dh 0x00000013 sub si, 3526h 0x00000018 jmp 00007F33ECEDC491h 0x0000001d popfd 0x0000001e pushfd 0x0000001f jmp 00007F33ECEDC490h 0x00000024 or ah, FFFFFFC8h 0x00000027 jmp 00007F33ECEDC48Bh 0x0000002c popfd 0x0000002d popad 0x0000002e rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F08F7 second address: 50F090F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33ECB900E4h 0x00000009 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeRDTSC instruction interceptor: First address: 50F090F second address: 50F0937 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33ECEDC48Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F33ECEDC494h 0x00000013 rdtsc
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeSpecial instruction interceptor: First address: 79FBE1 instructions caused by: Self-modifying code
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeSpecial instruction interceptor: First address: 93F41F instructions caused by: Self-modifying code
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeSpecial instruction interceptor: First address: 79FAB9 instructions caused by: Self-modifying code
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeSpecial instruction interceptor: First address: 9C5DAD instructions caused by: Self-modifying code
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeSpecial instruction interceptor: First address: 1CFBE1 instructions caused by: Self-modifying code
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeSpecial instruction interceptor: First address: 36F41F instructions caused by: Self-modifying code
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeSpecial instruction interceptor: First address: 1CFAB9 instructions caused by: Self-modifying code
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeSpecial instruction interceptor: First address: 3F5DAD instructions caused by: Self-modifying code
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSpecial instruction interceptor: First address: 2DFBE1 instructions caused by: Self-modifying code
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSpecial instruction interceptor: First address: 47F41F instructions caused by: Self-modifying code
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSpecial instruction interceptor: First address: 2DFAB9 instructions caused by: Self-modifying code
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSpecial instruction interceptor: First address: 505DAD instructions caused by: Self-modifying code
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDescJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersionJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersionJump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_05130A73 rdtsc 0_2_05130A73
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeWindow / User API: threadDelayed 848Jump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeWindow / User API: threadDelayed 1273Jump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeWindow / User API: threadDelayed 920Jump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeWindow / User API: threadDelayed 352Jump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 1304Jump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 1173Jump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 764Jump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 1220Jump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 1121Jump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 766Jump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow / User API: threadDelayed 1171Jump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow / User API: threadDelayed 2589Jump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow / User API: threadDelayed 2603Jump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow / User API: threadDelayed 2609Jump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exe TID: 6860Thread sleep time: -30015s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exe TID: 6788Thread sleep count: 848 > 30Jump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exe TID: 6788Thread sleep time: -1696848s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exe TID: 6736Thread sleep count: 234 > 30Jump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exe TID: 5004Thread sleep count: 238 > 30Jump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exe TID: 6816Thread sleep count: 1273 > 30Jump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exe TID: 6816Thread sleep time: -2547273s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exe TID: 6840Thread sleep count: 920 > 30Jump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exe TID: 6840Thread sleep time: -1840920s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exe TID: 6792Thread sleep count: 352 > 30Jump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exe TID: 6792Thread sleep time: -704352s >= -30000sJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6404Thread sleep count: 87 > 30Jump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6404Thread sleep time: -174087s >= -30000sJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6720Thread sleep count: 132 > 30Jump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6720Thread sleep time: -264132s >= -30000sJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7104Thread sleep count: 110 > 30Jump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7104Thread sleep time: -220110s >= -30000sJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1744Thread sleep count: 65 > 30Jump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1744Thread sleep count: 1304 > 30Jump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1744Thread sleep time: -131704s >= -30000sJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7232Thread sleep count: 1173 > 30Jump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7232Thread sleep count: 764 > 30Jump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7232Thread sleep time: -76400s >= -30000sJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 2504Thread sleep count: 111 > 30Jump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 2504Thread sleep time: -222111s >= -30000sJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5480Thread sleep count: 119 > 30Jump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5480Thread sleep time: -238119s >= -30000sJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6568Thread sleep count: 118 > 30Jump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6568Thread sleep time: -236118s >= -30000sJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 792Thread sleep count: 123 > 30Jump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 792Thread sleep time: -246123s >= -30000sJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6500Thread sleep count: 78 > 30Jump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6500Thread sleep time: -156078s >= -30000sJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7220Thread sleep time: -32000s >= -30000sJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 732Thread sleep count: 67 > 30Jump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5600Thread sleep count: 111 > 30Jump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5600Thread sleep time: -222111s >= -30000sJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 732Thread sleep count: 1220 > 30Jump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 732Thread sleep time: -123220s >= -30000sJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7228Thread sleep count: 1121 > 30Jump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7228Thread sleep count: 766 > 30Jump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7228Thread sleep time: -76600s >= -30000sJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4928Thread sleep count: 101 > 30Jump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4928Thread sleep time: -202101s >= -30000sJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7136Thread sleep count: 138 > 30Jump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7136Thread sleep time: -276138s >= -30000sJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7300Thread sleep time: -54027s >= -30000sJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7288Thread sleep count: 1171 > 30Jump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7288Thread sleep time: -2343171s >= -30000sJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7256Thread sleep count: 249 > 30Jump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7468Thread sleep count: 240 > 30Jump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7636Thread sleep count: 72 > 30Jump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7636Thread sleep time: -144072s >= -30000sJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7644Thread sleep count: 73 > 30Jump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7644Thread sleep time: -146073s >= -30000sJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7640Thread sleep count: 71 > 30Jump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7640Thread sleep time: -142071s >= -30000sJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7560Thread sleep count: 104 > 30Jump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7560Thread sleep count: 237 > 30Jump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7620Thread sleep count: 2589 > 30Jump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7620Thread sleep time: -5180589s >= -30000sJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7752Thread sleep count: 233 > 30Jump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7628Thread sleep count: 2603 > 30Jump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7628Thread sleep time: -5208603s >= -30000sJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7624Thread sleep count: 2609 > 30Jump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7624Thread sleep time: -5220609s >= -30000sJump to behavior
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeLast function: Thread delayed
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeLast function: Thread delayed
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeLast function: Thread delayed
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeLast function: Thread delayed
            Source: RageMP131.exe, RageMP131.exe, 00000009.00000002.4129486258.0000000000458000.00000040.00000001.01000000.00000006.sdmpBinary or memory string: HARDWARE\ACPI\DSDT\VBOX__
            Source: RageMP131.exe, 00000009.00000002.4130699493.0000000000E1B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
            Source: LisectAVT_2403002A_228.exe, 00000000.00000002.4130383700.0000000000F3C000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&00
            Source: MPGPH131.exe, 00000006.00000002.4130999077.0000000000D2A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}f
            Source: MPGPH131.exe, 00000005.00000002.4130834437.000000000133D000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}D
            Source: RageMP131.exe, 00000009.00000003.1952162624.0000000000E53000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
            Source: MPGPH131.exe, 00000006.00000002.4130999077.0000000000D2A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}@
            Source: MPGPH131.exe, 00000005.00000002.4131028142.000000000144D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}`}9
            Source: RageMP131.exe, 00000007.00000002.4130773514.0000000000D0E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\
            Source: RageMP131.exe, 00000007.00000002.4130773514.0000000000D43000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}EX
            Source: RageMP131.exe, 00000009.00000003.1952162624.0000000000E51000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
            Source: LisectAVT_2403002A_228.exe, 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000002.4129609409.0000000000458000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000009.00000002.4129486258.0000000000458000.00000040.00000001.01000000.00000006.sdmpBinary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
            Source: MPGPH131.exe, 00000005.00000002.4131028142.0000000001494000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_78B2A93F
            Source: RageMP131.exe, 00000009.00000002.4130699493.0000000000E1B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}bl
            Source: LisectAVT_2403002A_228.exe, 00000000.00000002.4130424315.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.4131028142.0000000001482000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.4130999077.0000000000D4D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.4130773514.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000002.4130699493.0000000000E1B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeSystem information queried: ModuleInformationJump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeProcess information queried: ProcessInformationJump to behavior

            Anti Debugging

            barindex
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeThread information set: HideFromDebuggerJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeThread information set: HideFromDebuggerJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeThread information set: HideFromDebuggerJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeThread information set: HideFromDebuggerJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeThread information set: HideFromDebuggerJump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_05130BA4 Start: 05130DBD End: 05130C040_2_05130BA4
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 5_2_0557024B Start: 05570281 End: 0557025F5_2_0557024B
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeOpen window title or class name: regmonclass
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeOpen window title or class name: gbdyllo
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeOpen window title or class name: process monitor - sysinternals: www.sysinternals.com
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeOpen window title or class name: procmon_window_class
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeOpen window title or class name: registry monitor - sysinternals: www.sysinternals.com
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeOpen window title or class name: ollydbg
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeOpen window title or class name: filemonclass
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeOpen window title or class name: file monitor - sysinternals: www.sysinternals.com
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: NTICE
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: SICE
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: SIWVID
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeProcess queried: DebugPortJump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeProcess queried: DebugPortJump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeProcess queried: DebugPortJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess queried: DebugPortJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess queried: DebugPortJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess queried: DebugPortJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess queried: DebugPortJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess queried: DebugPortJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess queried: DebugPortJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess queried: DebugPortJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess queried: DebugPortJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess queried: DebugPortJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess queried: DebugPortJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess queried: DebugPortJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess queried: DebugPortJump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_05130A73 rdtsc 0_2_05130A73
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_006C3A40 mov eax, dword ptr fs:[00000030h]0_2_006C3A40
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_006C3A40 mov eax, dword ptr fs:[00000030h]0_2_006C3A40
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_00674100 mov eax, dword ptr fs:[00000030h]0_2_00674100
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 5_2_000F3A40 mov eax, dword ptr fs:[00000030h]5_2_000F3A40
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 5_2_000F3A40 mov eax, dword ptr fs:[00000030h]5_2_000F3A40
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 5_2_000A4100 mov eax, dword ptr fs:[00000030h]5_2_000A4100
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_000F3A40 mov eax, dword ptr fs:[00000030h]6_2_000F3A40
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_000F3A40 mov eax, dword ptr fs:[00000030h]6_2_000F3A40
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_000A4100 mov eax, dword ptr fs:[00000030h]6_2_000A4100
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 7_2_00203A40 mov eax, dword ptr fs:[00000030h]7_2_00203A40
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 7_2_00203A40 mov eax, dword ptr fs:[00000030h]7_2_00203A40
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 7_2_001B4100 mov eax, dword ptr fs:[00000030h]7_2_001B4100
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 9_2_00203A40 mov eax, dword ptr fs:[00000030h]9_2_00203A40
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 9_2_00203A40 mov eax, dword ptr fs:[00000030h]9_2_00203A40
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 9_2_001B4100 mov eax, dword ptr fs:[00000030h]9_2_001B4100
            Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, RageMP131.exe, 00000009.00000002.4129486258.0000000000458000.00000040.00000001.01000000.00000006.sdmpBinary or memory string: JProgram Manager
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\ProgramData\MPGPH131\MPGPH131.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeCode function: 0_2_0073F26A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,0_2_0073F26A
            Source: C:\Users\user\Desktop\LisectAVT_2403002A_228.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

            Stealing of Sensitive Information

            barindex
            Source: Yara matchFile source: 00000009.00000003.1923737159.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.1692149200.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000003.1846088953.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000003.1766573230.0000000004950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000003.1767150400.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: LisectAVT_2403002A_228.exe PID: 6740, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: MPGPH131.exe PID: 4948, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: MPGPH131.exe PID: 344, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: RageMP131.exe PID: 7252, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: RageMP131.exe PID: 7556, type: MEMORYSTR

            Remote Access Functionality

            barindex
            Source: Yara matchFile source: 00000009.00000003.1923737159.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.1692149200.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000003.1846088953.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000003.1766573230.0000000004950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000003.1767150400.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: LisectAVT_2403002A_228.exe PID: 6740, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: MPGPH131.exe PID: 4948, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: MPGPH131.exe PID: 344, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: RageMP131.exe PID: 7252, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: RageMP131.exe PID: 7556, type: MEMORYSTR
            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid Accounts3
            Command and Scripting Interpreter
            1
            Scheduled Task/Job
            2
            Process Injection
            1
            Masquerading
            OS Credential Dumping1
            System Time Discovery
            Remote Services1
            Archive Collected Data
            1
            Encrypted Channel
            Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault Accounts1
            Scheduled Task/Job
            1
            Registry Run Keys / Startup Folder
            1
            Scheduled Task/Job
            24
            Virtualization/Sandbox Evasion
            LSASS Memory641
            Security Software Discovery
            Remote Desktop ProtocolData from Removable Media1
            Non-Standard Port
            Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain Accounts1
            Native API
            1
            DLL Side-Loading
            1
            Registry Run Keys / Startup Folder
            2
            Process Injection
            Security Account Manager24
            Virtualization/Sandbox Evasion
            SMB/Windows Admin SharesData from Network Shared Drive1
            Ingress Tool Transfer
            Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
            DLL Side-Loading
            1
            Deobfuscate/Decode Files or Information
            NTDS2
            Process Discovery
            Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script3
            Obfuscated Files or Information
            LSA Secrets1
            Application Window Discovery
            SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts12
            Software Packing
            Cached Domain Credentials214
            System Information Discovery
            VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
            DLL Side-Loading
            DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 signatures2 2 Behavior Graph ID: 1482398 Sample: LisectAVT_2403002A_228.exe Startdate: 25/07/2024 Architecture: WINDOWS Score: 100 36 Antivirus / Scanner detection for submitted sample 2->36 38 Yara detected RisePro Stealer 2->38 40 Machine Learning detection for sample 2->40 42 3 other signatures 2->42 7 LisectAVT_2403002A_228.exe 1 9 2->7         started        12 MPGPH131.exe 2 2->12         started        14 RageMP131.exe 2 2->14         started        16 2 other processes 2->16 process3 dnsIp4 34 193.233.132.74, 49730, 49731, 49732 FREE-NET-ASFREEnetEU Russian Federation 7->34 26 C:\Users\user\AppData\Local\...\RageMP131.exe, PE32 7->26 dropped 28 C:\ProgramData\MPGPH131\MPGPH131.exe, PE32 7->28 dropped 30 C:\Users\...\RageMP131.exe:Zone.Identifier, ASCII 7->30 dropped 32 C:\...\MPGPH131.exe:Zone.Identifier, ASCII 7->32 dropped 44 Detected unpacking (changes PE section rights) 7->44 46 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 7->46 48 Uses schtasks.exe or at.exe to add and modify task schedules 7->48 64 2 other signatures 7->64 18 schtasks.exe 1 7->18         started        20 schtasks.exe 1 7->20         started        50 Antivirus detection for dropped file 12->50 52 Machine Learning detection for dropped file 12->52 54 Tries to evade debugger and weak emulator (self modifying code) 12->54 56 Tries to detect sandboxes and other dynamic analysis tools (window names) 14->56 58 Hides threads from debuggers 14->58 60 Tries to detect sandboxes / dynamic malware analysis system (registry check) 14->60 62 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 16->62 file5 signatures6 process7 process8 22 conhost.exe 18->22         started        24 conhost.exe 20->24         started       

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand
            SourceDetectionScannerLabelLink
            LisectAVT_2403002A_228.exe100%AviraTR/Redcap.hkdqs
            LisectAVT_2403002A_228.exe100%Joe Sandbox ML
            SourceDetectionScannerLabelLink
            C:\Users\user\AppData\Local\RageMP131\RageMP131.exe100%AviraTR/Redcap.hkdqs
            C:\ProgramData\MPGPH131\MPGPH131.exe100%AviraTR/Redcap.hkdqs
            C:\Users\user\AppData\Local\RageMP131\RageMP131.exe100%Joe Sandbox ML
            C:\ProgramData\MPGPH131\MPGPH131.exe100%Joe Sandbox ML
            No Antivirus matches
            No Antivirus matches
            SourceDetectionScannerLabelLink
            http://www.winimage.com/zLibDll0%URL Reputationsafe
            https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll0%Avira URL Cloudsafe
            https://t.me/RiseProSUPPORTmJ0%Avira URL Cloudsafe
            https://t.me/RiseProSUPPORTHr0%Avira URL Cloudsafe
            https://t.me/RiseProSUPPORT0%Avira URL Cloudsafe
            No contacted domains info
            NameSourceMaliciousAntivirus DetectionReputation
            https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dllLisectAVT_2403002A_228.exe, 00000000.00000003.1692149200.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002A_228.exe, 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000005.00000003.1767150400.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000006.00000003.1766573230.0000000004950000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000007.00000003.1846088953.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000003.1923737159.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmpfalse
            • Avira URL Cloud: safe
            unknown
            https://t.me/RiseProSUPPORTmJRageMP131.exe, 00000009.00000002.4130699493.0000000000E1B000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            unknown
            http://www.winimage.com/zLibDllLisectAVT_2403002A_228.exe, 00000000.00000003.1692149200.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002A_228.exe, 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000005.00000003.1767150400.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000006.00000003.1766573230.0000000004950000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000007.00000003.1846088953.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000003.1923737159.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmpfalse
            • URL Reputation: safe
            unknown
            https://t.me/RiseProSUPPORTMPGPH131.exe, 00000006.00000002.4130999077.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.4130773514.0000000000D0E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000009.00000002.4130699493.0000000000E1B000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            unknown
            https://t.me/RiseProSUPPORTHrMPGPH131.exe, 00000005.00000002.4131028142.000000000144D000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            unknown
            • No. of IPs < 25%
            • 25% < No. of IPs < 50%
            • 50% < No. of IPs < 75%
            • 75% < No. of IPs
            IPDomainCountryFlagASNASN NameMalicious
            193.233.132.74
            unknownRussian Federation
            2895FREE-NET-ASFREEnetEUtrue
            Joe Sandbox version:40.0.0 Tourmaline
            Analysis ID:1482398
            Start date and time:2024-07-25 22:23:01 +02:00
            Joe Sandbox product:CloudBasic
            Overall analysis duration:0h 11m 20s
            Hypervisor based Inspection enabled:false
            Report type:full
            Cookbook file name:default.jbs
            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
            Number of analysed new started processes analysed:13
            Number of new started drivers analysed:0
            Number of existing processes analysed:0
            Number of existing drivers analysed:0
            Number of injected processes analysed:0
            Technologies:
            • HCA enabled
            • EGA enabled
            • AMSI enabled
            Analysis Mode:default
            Analysis stop reason:Timeout
            Sample name:LisectAVT_2403002A_228.exe
            Detection:MAL
            Classification:mal100.troj.evad.winEXE@11/5@0/1
            EGA Information:
            • Successful, ratio: 100%
            HCA Information:Failed
            Cookbook Comments:
            • Found application associated with file extension: .exe
            • Override analysis time to 240000 for current running targets taking high CPU consumption
            • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
            • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
            • Not all processes where analyzed, report is missing behavior information
            • VT rate limit hit for: LisectAVT_2403002A_228.exe
            TimeTypeDescription
            16:24:22API Interceptor3830998x Sleep call for process: LisectAVT_2403002A_228.exe modified
            16:24:29API Interceptor5504x Sleep call for process: MPGPH131.exe modified
            16:24:37API Interceptor5441613x Sleep call for process: RageMP131.exe modified
            21:23:58Task SchedulerRun new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
            21:23:58Task SchedulerRun new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
            21:23:58AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
            21:24:07AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            193.233.132.74LisectAVT_2403002A_376.exeGet hashmaliciousRisePro StealerBrowse
              LisectAVT_2403002B_242.exeGet hashmaliciousRisePro StealerBrowse
                LisectAVT_2403002A_224.exeGet hashmaliciousRisePro StealerBrowse
                  80OrFCsz0u.exeGet hashmaliciousGCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro StealerBrowse
                    SecuriteInfo.com.Win64.Evo-gen.28136.30716.exeGet hashmaliciousGCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro StealerBrowse
                      file.exeGet hashmaliciousRisePro StealerBrowse
                        vGDqFBB1Jz.exeGet hashmaliciousRisePro StealerBrowse
                          iKV7MCWDJF.exeGet hashmaliciousRisePro StealerBrowse
                            8TFD6H44Pz.exeGet hashmaliciousRisePro StealerBrowse
                              uRLTbkeYF7.exeGet hashmaliciousRisePro StealerBrowse
                                No context
                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                FREE-NET-ASFREEnetEULisectAVT_2403002A_30.exeGet hashmaliciousAmadeyBrowse
                                • 193.233.132.56
                                LisectAVT_2403002A_33.exeGet hashmaliciousAmadeyBrowse
                                • 193.233.132.56
                                LisectAVT_2403002A_376.exeGet hashmaliciousRisePro StealerBrowse
                                • 193.233.132.74
                                LisectAVT_2403002A_389.exeGet hashmaliciousAmadeyBrowse
                                • 193.233.132.56
                                LisectAVT_2403002A_419.exeGet hashmaliciousRisePro StealerBrowse
                                • 193.233.132.67
                                LisectAVT_2403002A_419.exeGet hashmaliciousRisePro StealerBrowse
                                • 193.233.132.67
                                LisectAVT_2403002A_464.exeGet hashmaliciousRisePro StealerBrowse
                                • 193.233.132.109
                                LisectAVT_2403002A_464.exeGet hashmaliciousRisePro StealerBrowse
                                • 193.233.132.109
                                LisectAVT_2403002A_79.exeGet hashmaliciousAmadeyBrowse
                                • 193.233.132.56
                                LisectAVT_2403002B_242.exeGet hashmaliciousRisePro StealerBrowse
                                • 193.233.132.74
                                No context
                                No context
                                Process:C:\Users\user\Desktop\LisectAVT_2403002A_228.exe
                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                Category:dropped
                                Size (bytes):2337286
                                Entropy (8bit):7.9651626019668145
                                Encrypted:false
                                SSDEEP:49152:yb0//IOrbf7t6DpoXoY4huCcvZj8vL23ExBbmbJPJCdTk:ybgIOgDpoLsXij8jIJPJMk
                                MD5:CE5A350B93125774AA74515271C6D8AD
                                SHA1:4E7F67212BD95ECE241D4914BE2CDBF9D5DC9573
                                SHA-256:5DBDCFB4702811E2F7CDAC39BA83DCCDC4A16DFA6B29A02B3879A1A70B3019DD
                                SHA-512:CA0DDD1CDC8EEEB7BEEC028F6D4A3EBFE62EB225C46532774BB155EF8A5037DACF9C8A8245047225B4C7D1C68449EA6502BE83F2DF4D27173A9F5534D784896A
                                Malicious:true
                                Antivirus:
                                • Antivirus: Avira, Detection: 100%
                                • Antivirus: Joe Sandbox ML, Detection: 100%
                                Reputation:low
                                Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$......."...f.{Tf.{Tf.{T-.xUk.{T-.~U..{T-.|Ug.{T)..Tb.{T)..Ut.{T).xUq.{T).~U3.{T-..U..{T-.}Ug.{T-.zU}.{Tf.zT@.{T..rUz.{T..{Ug.{T...Tg.{Tf..Tg.{T..yUg.{TRichf.{T................PE..L.....e...............".....0........Y...........@...........................Y.....*A$...@...........................Y.L...U...i.......X+.......................................................................................................... . .p..........................@....rsrc...X+..........................@....idata ............."..............@... ..+..........$..............@...ycahdotv.....@?......&..............@...urypsrur......Y.......#.............@...........................................................................................................................................................................................................................
                                Process:C:\Users\user\Desktop\LisectAVT_2403002A_228.exe
                                File Type:ASCII text, with CRLF line terminators
                                Category:dropped
                                Size (bytes):26
                                Entropy (8bit):3.95006375643621
                                Encrypted:false
                                SSDEEP:3:ggPYV:rPYV
                                MD5:187F488E27DB4AF347237FE461A079AD
                                SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                Malicious:true
                                Reputation:high, very likely benign file
                                Preview:[ZoneTransfer]....ZoneId=0
                                Process:C:\Users\user\Desktop\LisectAVT_2403002A_228.exe
                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                Category:dropped
                                Size (bytes):2337286
                                Entropy (8bit):7.9651626019668145
                                Encrypted:false
                                SSDEEP:49152:yb0//IOrbf7t6DpoXoY4huCcvZj8vL23ExBbmbJPJCdTk:ybgIOgDpoLsXij8jIJPJMk
                                MD5:CE5A350B93125774AA74515271C6D8AD
                                SHA1:4E7F67212BD95ECE241D4914BE2CDBF9D5DC9573
                                SHA-256:5DBDCFB4702811E2F7CDAC39BA83DCCDC4A16DFA6B29A02B3879A1A70B3019DD
                                SHA-512:CA0DDD1CDC8EEEB7BEEC028F6D4A3EBFE62EB225C46532774BB155EF8A5037DACF9C8A8245047225B4C7D1C68449EA6502BE83F2DF4D27173A9F5534D784896A
                                Malicious:true
                                Antivirus:
                                • Antivirus: Avira, Detection: 100%
                                • Antivirus: Joe Sandbox ML, Detection: 100%
                                Reputation:low
                                Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$......."...f.{Tf.{Tf.{T-.xUk.{T-.~U..{T-.|Ug.{T)..Tb.{T)..Ut.{T).xUq.{T).~U3.{T-..U..{T-.}Ug.{T-.zU}.{Tf.zT@.{T..rUz.{T..{Ug.{T...Tg.{Tf..Tg.{T..yUg.{TRichf.{T................PE..L.....e...............".....0........Y...........@...........................Y.....*A$...@...........................Y.L...U...i.......X+.......................................................................................................... . .p..........................@....rsrc...X+..........................@....idata ............."..............@... ..+..........$..............@...ycahdotv.....@?......&..............@...urypsrur......Y.......#.............@...........................................................................................................................................................................................................................
                                Process:C:\Users\user\Desktop\LisectAVT_2403002A_228.exe
                                File Type:ASCII text, with CRLF line terminators
                                Category:dropped
                                Size (bytes):26
                                Entropy (8bit):3.95006375643621
                                Encrypted:false
                                SSDEEP:3:ggPYV:rPYV
                                MD5:187F488E27DB4AF347237FE461A079AD
                                SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                Malicious:true
                                Reputation:high, very likely benign file
                                Preview:[ZoneTransfer]....ZoneId=0
                                Process:C:\Users\user\Desktop\LisectAVT_2403002A_228.exe
                                File Type:ASCII text, with no line terminators
                                Category:modified
                                Size (bytes):13
                                Entropy (8bit):3.085055102756477
                                Encrypted:false
                                SSDEEP:3:LEC:/
                                MD5:4E5C5CB89626FA7D0EDCAF1228F50DA4
                                SHA1:22C4A47291C45A696D94D7734F3D9F912C114325
                                SHA-256:A17A5239385AA70374295DFE3E1BB1EAAAB1CCBD626A6ABBDED268D5A52EEB2D
                                SHA-512:B32FF5F4B011D38228C943C40BD22F29E3904D5A3DC117A533EB23D4E81E991258F72E08100828361E431FD9BB82F7410BEA5AB687A274BC1E49CD58D456A8CC
                                Malicious:false
                                Reputation:low
                                Preview:1721945890305
                                File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                Entropy (8bit):7.9651626019668145
                                TrID:
                                • Win32 Executable (generic) a (10002005/4) 99.96%
                                • Generic Win/DOS Executable (2004/3) 0.02%
                                • DOS Executable Generic (2002/1) 0.02%
                                • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                File name:LisectAVT_2403002A_228.exe
                                File size:2'337'286 bytes
                                MD5:ce5a350b93125774aa74515271c6d8ad
                                SHA1:4e7f67212bd95ece241d4914be2cdbf9d5dc9573
                                SHA256:5dbdcfb4702811e2f7cdac39ba83dccdc4a16dfa6b29a02b3879a1a70b3019dd
                                SHA512:ca0ddd1cdc8eeeb7beec028f6d4a3ebfe62eb225c46532774bb155ef8a5037dacf9c8a8245047225b4c7d1c68449ea6502be83f2df4d27173a9f5534d784896a
                                SSDEEP:49152:yb0//IOrbf7t6DpoXoY4huCcvZj8vL23ExBbmbJPJCdTk:ybgIOgDpoLsXij8jIJPJMk
                                TLSH:94B533B1DE345312CE1F87751699966E1C942B720434EBFEA5C83E3B3A2F095CF1A258
                                File Content Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$......."...f.{Tf.{Tf.{T-.xUk.{T-.~U..{T-.|Ug.{T)..Tb.{T)..Ut.{T).xUq.{T).~U3.{T-..U..{T-.}Ug.{T-.zU}.{Tf.zT@.{T..rUz.{T..{Ug.{T...Tg.{
                                Icon Hash:c769eccc64f6e2bb
                                Entrypoint:0x99c000
                                Entrypoint Section:urypsrur
                                Digitally signed:false
                                Imagebase:0x400000
                                Subsystem:windows gui
                                Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                Time Stamp:0x65FE94C6 [Sat Mar 23 08:37:26 2024 UTC]
                                TLS Callbacks:
                                CLR (.Net) Version:
                                OS Version Major:6
                                OS Version Minor:0
                                File Version Major:6
                                File Version Minor:0
                                Subsystem Version Major:6
                                Subsystem Version Minor:0
                                Import Hash:2eabe9054cad5152567f0699947a2c5b
                                Instruction
                                push edi
                                mov dword ptr [esp], 572ECACCh
                                mov dword ptr [esp], esi
                                push edi
                                mov dword ptr [esp], eax
                                mov dword ptr [esp], 2DFA528Bh
                                mov dword ptr [esp], eax
                                push ebx
                                push esp
                                pop ebx
                                add ebx, 00000004h
                                sub ebx, 04h
                                xchg dword ptr [esp], ebx
                                pop esp
                                mov dword ptr [esp], ebx
                                call 00007F33ECE7D786h
                                int3
                                push dword ptr [esp]
                                pop eax
                                push edx
                                mov edx, esp
                                add edx, 00000004h
                                add edx, 04h
                                xchg dword ptr [esp], edx
                                pop esp
                                push ecx
                                mov ecx, esp
                                add ecx, 00000004h
                                sub ecx, 04h
                                xchg dword ptr [esp], ecx
                                pop esp
                                mov dword ptr [esp], eax
                                pop ebx
                                push ecx
                                mov ecx, FFFFFFFFh
                                add eax, 7BEFF931h
                                sub eax, ecx
                                sub eax, 7BEFF931h
                                pop ecx
                                push esi
                                mov esi, 001A8000h
                                add eax, 4DD76D87h
                                sub eax, esi
                                sub eax, 4DD76D87h
                                mov esi, dword ptr [esp]
                                add esp, 00000004h
                                sub eax, 0DB90032h
                                add eax, 0DB90000h
                                cmp byte ptr [ebx], FFFFFFCCh
                                jne 00007F33ECE7D81Ah
                                push eax
                                push ebx
                                mov bh, 21h
                                push cx
                                mov ch, 21h
                                sub bh, ch
                                pop cx
                                mov al, bh
                                pop ebx
                                mov byte ptr [ebx], al
                                pop eax
                                mov ebx, 3DDF79B0h
                                inc ebx
                                push ebx
                                push ebp
                                pop ebx
                                pop ebp
                                not ebp
                                xchg ebx, ebp
                                sub ebx, 4FEDA7B6h
                                and ebx, 3FDE80A4h
                                NameVirtual AddressVirtual Size Is in Section
                                IMAGE_DIRECTORY_ENTRY_EXPORT0x5993a80x4cycahdotv
                                IMAGE_DIRECTORY_ENTRY_IMPORT0x13b0550x69.idata
                                IMAGE_DIRECTORY_ENTRY_RESOURCE0x1380000x2b58.rsrc
                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                IMAGE_DIRECTORY_ENTRY_BASERELOC0x13b1f80x8.idata
                                IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
                                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                0x10000x1370000x90600b55b71c2043ab40ff0035bc71a4121e1False0.9992069128787879data7.988928375890931IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                .rsrc0x1380000x2b580xc008a37ca7557530049471ab63bec9a1af7False0.8401692708333334data7.035166645143444IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                .idata 0x13b0000x10000x200745dea56938759dccaf9e183aa01b020False0.146484375data0.998472215956371IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                0x13c0000x2b80000x20013e3decc9ef08adfec4ff09b3b762cd2unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                ycahdotv0x3f40000x1a80000x1a8000b3a315c6f67b8c5d3d3d119b10643342False0.9896050219265919data7.949088772265462IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                urypsrur0x59c0000x10000x40014bc9c4a12da57b8d3c38934d739ab56False0.71875data5.796848375085057IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                NameRVASizeTypeLanguageCountryZLIB Complexity
                                RT_ICON0x5993f40x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9216RussianRussia0.1892116182572614
                                RT_GROUP_ICON0x59b99c0x14dataRussianRussia1.15
                                RT_VERSION0x59b9b00x2e4dataRussianRussia0.4689189189189189
                                RT_MANIFEST0x59bc940x17dXML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.5931758530183727
                                DLLImport
                                kernel32.dlllstrcpy
                                NameOrdinalAddress
                                Start10x466e80
                                Language of compilation systemCountry where language is spokenMap
                                RussianRussia
                                EnglishUnited States
                                TimestampProtocolSIDSignatureSource PortDest PortSource IPDest IP
                                2024-07-25T22:24:05.139725+0200TCP2049060ET MALWARE RisePro TCP Heartbeat Packet4973158709192.168.2.4193.233.132.74
                                2024-07-25T22:24:24.342287+0200TCP2046269ET MALWARE [ANY.RUN] RisePro TCP (Activity)4974058709192.168.2.4193.233.132.74
                                2024-07-25T22:24:12.593647+0200TCP2049060ET MALWARE RisePro TCP Heartbeat Packet4973558709192.168.2.4193.233.132.74
                                2024-07-25T22:24:15.575871+0200TCP2046269ET MALWARE [ANY.RUN] RisePro TCP (Activity)4973558709192.168.2.4193.233.132.74
                                2024-07-25T22:24:08.131869+0200TCP2046269ET MALWARE [ANY.RUN] RisePro TCP (Activity)4973158709192.168.2.4193.233.132.74
                                2024-07-25T22:24:00.403951+0200TCP2046269ET MALWARE [ANY.RUN] RisePro TCP (Activity)4973058709192.168.2.4193.233.132.74
                                2024-07-25T22:24:08.131731+0200TCP2046269ET MALWARE [ANY.RUN] RisePro TCP (Activity)4973258709192.168.2.4193.233.132.74
                                2024-07-25T22:24:51.619679+0200TCP2022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow4434974140.68.123.157192.168.2.4
                                2024-07-25T22:23:57.416907+0200TCP2049060ET MALWARE RisePro TCP Heartbeat Packet4973058709192.168.2.4193.233.132.74
                                2024-07-25T22:24:13.208194+0200TCP2022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow4434973340.68.123.157192.168.2.4
                                TimestampSource PortDest PortSource IPDest IP
                                Jul 25, 2024 22:23:57.389735937 CEST4973058709192.168.2.4193.233.132.74
                                Jul 25, 2024 22:23:57.395093918 CEST5870949730193.233.132.74192.168.2.4
                                Jul 25, 2024 22:23:57.395277977 CEST4973058709192.168.2.4193.233.132.74
                                Jul 25, 2024 22:23:57.416907072 CEST4973058709192.168.2.4193.233.132.74
                                Jul 25, 2024 22:23:57.421960115 CEST5870949730193.233.132.74192.168.2.4
                                Jul 25, 2024 22:24:00.403950930 CEST4973058709192.168.2.4193.233.132.74
                                Jul 25, 2024 22:24:00.408853054 CEST5870949730193.233.132.74192.168.2.4
                                Jul 25, 2024 22:24:05.113605976 CEST4973158709192.168.2.4193.233.132.74
                                Jul 25, 2024 22:24:05.117317915 CEST4973258709192.168.2.4193.233.132.74
                                Jul 25, 2024 22:24:05.118588924 CEST5870949731193.233.132.74192.168.2.4
                                Jul 25, 2024 22:24:05.118670940 CEST4973158709192.168.2.4193.233.132.74
                                Jul 25, 2024 22:24:05.122208118 CEST5870949732193.233.132.74192.168.2.4
                                Jul 25, 2024 22:24:05.122270107 CEST4973258709192.168.2.4193.233.132.74
                                Jul 25, 2024 22:24:05.139724970 CEST4973158709192.168.2.4193.233.132.74
                                Jul 25, 2024 22:24:05.140465021 CEST4973258709192.168.2.4193.233.132.74
                                Jul 25, 2024 22:24:05.144505024 CEST5870949731193.233.132.74192.168.2.4
                                Jul 25, 2024 22:24:05.145281076 CEST5870949732193.233.132.74192.168.2.4
                                Jul 25, 2024 22:24:08.131731033 CEST4973258709192.168.2.4193.233.132.74
                                Jul 25, 2024 22:24:08.131869078 CEST4973158709192.168.2.4193.233.132.74
                                Jul 25, 2024 22:24:08.137083054 CEST5870949732193.233.132.74192.168.2.4
                                Jul 25, 2024 22:24:08.137151957 CEST5870949731193.233.132.74192.168.2.4
                                Jul 25, 2024 22:24:12.556581020 CEST4973558709192.168.2.4193.233.132.74
                                Jul 25, 2024 22:24:12.561547041 CEST5870949735193.233.132.74192.168.2.4
                                Jul 25, 2024 22:24:12.561629057 CEST4973558709192.168.2.4193.233.132.74
                                Jul 25, 2024 22:24:12.593647003 CEST4973558709192.168.2.4193.233.132.74
                                Jul 25, 2024 22:24:12.605525970 CEST5870949735193.233.132.74192.168.2.4
                                Jul 25, 2024 22:24:15.575870991 CEST4973558709192.168.2.4193.233.132.74
                                Jul 25, 2024 22:24:15.580918074 CEST5870949735193.233.132.74192.168.2.4
                                Jul 25, 2024 22:24:18.756926060 CEST5870949730193.233.132.74192.168.2.4
                                Jul 25, 2024 22:24:18.757280111 CEST4973058709192.168.2.4193.233.132.74
                                Jul 25, 2024 22:24:21.324589014 CEST4974058709192.168.2.4193.233.132.74
                                Jul 25, 2024 22:24:21.333573103 CEST5870949740193.233.132.74192.168.2.4
                                Jul 25, 2024 22:24:21.333697081 CEST4974058709192.168.2.4193.233.132.74
                                Jul 25, 2024 22:24:21.358338118 CEST4974058709192.168.2.4193.233.132.74
                                Jul 25, 2024 22:24:21.363604069 CEST5870949740193.233.132.74192.168.2.4
                                Jul 25, 2024 22:24:24.342287064 CEST4974058709192.168.2.4193.233.132.74
                                Jul 25, 2024 22:24:24.347750902 CEST5870949740193.233.132.74192.168.2.4
                                Jul 25, 2024 22:24:26.500253916 CEST5870949731193.233.132.74192.168.2.4
                                Jul 25, 2024 22:24:26.500509024 CEST4973158709192.168.2.4193.233.132.74
                                Jul 25, 2024 22:24:26.517926931 CEST5870949732193.233.132.74192.168.2.4
                                Jul 25, 2024 22:24:26.518088102 CEST4973258709192.168.2.4193.233.132.74
                                Jul 25, 2024 22:24:34.081971884 CEST5870949735193.233.132.74192.168.2.4
                                Jul 25, 2024 22:24:34.082101107 CEST4973558709192.168.2.4193.233.132.74
                                Jul 25, 2024 22:24:42.704160929 CEST5870949740193.233.132.74192.168.2.4
                                Jul 25, 2024 22:24:42.704272032 CEST4974058709192.168.2.4193.233.132.74

                                Click to jump to process

                                Click to jump to process

                                Click to dive into process behavior distribution

                                Click to jump to process

                                Target ID:0
                                Start time:16:23:51
                                Start date:25/07/2024
                                Path:C:\Users\user\Desktop\LisectAVT_2403002A_228.exe
                                Wow64 process (32bit):true
                                Commandline:"C:\Users\user\Desktop\LisectAVT_2403002A_228.exe"
                                Imagebase:0x660000
                                File size:2'337'286 bytes
                                MD5 hash:CE5A350B93125774AA74515271C6D8AD
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Yara matches:
                                • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000003.1692149200.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
                                Reputation:low
                                Has exited:false

                                Target ID:1
                                Start time:16:23:56
                                Start date:25/07/2024
                                Path:C:\Windows\SysWOW64\schtasks.exe
                                Wow64 process (32bit):true
                                Commandline:schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
                                Imagebase:0x590000
                                File size:187'904 bytes
                                MD5 hash:48C2FE20575769DE916F48EF0676A965
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:true

                                Target ID:2
                                Start time:16:23:56
                                Start date:25/07/2024
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:true

                                Target ID:3
                                Start time:16:23:56
                                Start date:25/07/2024
                                Path:C:\Windows\SysWOW64\schtasks.exe
                                Wow64 process (32bit):true
                                Commandline:schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
                                Imagebase:0x590000
                                File size:187'904 bytes
                                MD5 hash:48C2FE20575769DE916F48EF0676A965
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:true

                                Target ID:4
                                Start time:16:23:56
                                Start date:25/07/2024
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:true

                                Target ID:5
                                Start time:16:23:58
                                Start date:25/07/2024
                                Path:C:\ProgramData\MPGPH131\MPGPH131.exe
                                Wow64 process (32bit):true
                                Commandline:C:\ProgramData\MPGPH131\MPGPH131.exe
                                Imagebase:0x90000
                                File size:2'337'286 bytes
                                MD5 hash:CE5A350B93125774AA74515271C6D8AD
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Yara matches:
                                • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security
                                • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000005.00000003.1767150400.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                Antivirus matches:
                                • Detection: 100%, Avira
                                • Detection: 100%, Joe Sandbox ML
                                Reputation:low
                                Has exited:false

                                Target ID:6
                                Start time:16:23:58
                                Start date:25/07/2024
                                Path:C:\ProgramData\MPGPH131\MPGPH131.exe
                                Wow64 process (32bit):true
                                Commandline:C:\ProgramData\MPGPH131\MPGPH131.exe
                                Imagebase:0x90000
                                File size:2'337'286 bytes
                                MD5 hash:CE5A350B93125774AA74515271C6D8AD
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Yara matches:
                                • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security
                                • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000006.00000003.1766573230.0000000004950000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                Reputation:low
                                Has exited:false

                                Target ID:7
                                Start time:16:24:07
                                Start date:25/07/2024
                                Path:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                Wow64 process (32bit):true
                                Commandline:"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
                                Imagebase:0x1a0000
                                File size:2'337'286 bytes
                                MD5 hash:CE5A350B93125774AA74515271C6D8AD
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Yara matches:
                                • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Author: Joe Security
                                • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000003.1846088953.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                Antivirus matches:
                                • Detection: 100%, Avira
                                • Detection: 100%, Joe Sandbox ML
                                Reputation:low
                                Has exited:false

                                Target ID:9
                                Start time:16:24:15
                                Start date:25/07/2024
                                Path:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                Wow64 process (32bit):true
                                Commandline:"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
                                Imagebase:0x1a0000
                                File size:2'337'286 bytes
                                MD5 hash:CE5A350B93125774AA74515271C6D8AD
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Yara matches:
                                • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000009.00000003.1923737159.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Author: Joe Security
                                Reputation:low
                                Has exited:false

                                Reset < >

                                  Execution Graph

                                  Execution Coverage:2.7%
                                  Dynamic/Decrypted Code Coverage:3%
                                  Signature Coverage:2.6%
                                  Total number of Nodes:626
                                  Total number of Limit Nodes:61
                                  execution_graph 19637 67e0a0 WSAStartup 19638 67e0d8 19637->19638 19641 67e1a7 19637->19641 19639 67e175 socket 19638->19639 19638->19641 19640 67e18b connect 19639->19640 19639->19641 19640->19641 19642 67e19d closesocket 19640->19642 19642->19639 19642->19641 21761 5130a81 21762 5130a9b GetCurrentHwProfileW 21761->21762 21764 5130af3 21762->21764 20389 513090a 20390 513092e 20389->20390 20393 51309c3 20390->20393 20394 51309e2 20393->20394 20397 5130a73 20394->20397 20398 5130a8e GetCurrentHwProfileW 20397->20398 20400 5130af3 20398->20400 19654 5130acc GetCurrentHwProfileW 19655 5130af3 19654->19655 19643 6c3a40 19644 6c3a55 19643->19644 19645 6c3b28 GetPEB 19644->19645 19646 6c3a73 GetPEB 19644->19646 19647 6c3b9d Sleep 19644->19647 19648 6c3ae8 Sleep 19644->19648 19649 6c3bc7 19644->19649 19645->19644 19646->19644 19647->19644 19648->19644 19650 5130afe 19651 5130a9e GetCurrentHwProfileW 19650->19651 19653 5130af3 19650->19653 19651->19653 21799 5130ae0 21800 5130a7e 21799->21800 21802 5130ae6 21799->21802 21801 5130acf GetCurrentHwProfileW 21800->21801 21800->21802 21801->21802 18912 66a210 18945 73f290 18912->18945 18914 66a248 18950 662ae0 18914->18950 18916 66a28b 18966 745362 18916->18966 18920 66a377 18922 66a34e 18922->18920 18995 7447b0 18922->18995 18926 749136 4 API calls 18927 66a2fc 18926->18927 18932 66a318 18927->18932 18981 6ccf60 18927->18981 18986 74dbdf 18932->18986 18947 6621d0 Concurrency::cancel_current_task ___std_exception_copy std::_Facet_Register 18945->18947 18946 73f2af 18946->18914 18947->18946 18998 740651 18947->18998 18951 662ba5 18950->18951 18956 662af6 18950->18956 19216 662270 18951->19216 18953 662b02 std::_Locinfo::_Locinfo_ctor 18953->18916 18954 662baa 19226 6621d0 18954->19226 18956->18953 18958 662b65 18956->18958 18959 662b6e 18956->18959 18962 662b2a 18956->18962 18957 662b3d 18961 7447b0 RtlAllocateHeap 18957->18961 18965 662b46 std::_Locinfo::_Locinfo_ctor 18957->18965 18958->18954 18958->18962 18964 73f290 std::_Facet_Register RtlAllocateHeap 18959->18964 18959->18965 18960 73f290 std::_Facet_Register RtlAllocateHeap 18960->18957 18963 662bb4 18961->18963 18962->18960 18964->18965 18965->18916 19239 7452a0 18966->19239 18968 66a2d7 18968->18922 18969 749136 18968->18969 18970 749149 __fread_nolock 18969->18970 19263 748e8d 18970->19263 18972 74915e 18973 7444dc __fread_nolock RtlAllocateHeap 18972->18973 18974 66a2ea 18973->18974 18975 744eeb 18974->18975 18976 744efe __fread_nolock 18975->18976 19396 744801 18976->19396 18978 744f0a 18979 7444dc __fread_nolock RtlAllocateHeap 18978->18979 18980 66a2f0 18979->18980 18980->18926 18982 6ccfa7 18981->18982 18985 6ccf78 __fread_nolock 18981->18985 19444 6d0560 18982->19444 18984 6ccfba 18984->18932 18985->18932 19459 74dbfc 18986->19459 18988 66a348 18989 748be8 18988->18989 18990 748bfb __fread_nolock 18989->18990 19583 748ac3 18990->19583 18992 748c07 18993 7444dc __fread_nolock RtlAllocateHeap 18992->18993 18994 748c13 18993->18994 18994->18922 18996 7446ec __fread_nolock RtlAllocateHeap 18995->18996 18997 7447bf __Getctype 18996->18997 18999 662213 18998->18999 19000 74065e ___std_exception_copy 18998->19000 18999->18914 19000->18999 19001 74068b 19000->19001 19004 7556b8 19000->19004 19013 74d7d6 19001->19013 19005 7556d4 19004->19005 19006 7556c6 19004->19006 19016 74d23f 19005->19016 19006->19005 19011 7556ec 19006->19011 19008 7556dc 19019 7447a0 19008->19019 19010 7556e6 19010->19001 19011->19010 19012 74d23f __dosmaperr RtlAllocateHeap 19011->19012 19012->19008 19014 756db3 ___std_exception_destroy RtlAllocateHeap 19013->19014 19015 74d7ee 19014->19015 19015->18999 19022 755d2c 19016->19022 19127 7446ec 19019->19127 19023 755d35 __Getctype 19022->19023 19030 74d244 19023->19030 19033 7563f3 19023->19033 19025 755d79 __Getctype 19026 755d81 __Getctype 19025->19026 19027 755db9 19025->19027 19037 756db3 19026->19037 19041 755a09 19027->19041 19030->19008 19032 756db3 ___std_exception_destroy RtlAllocateHeap 19032->19030 19034 756400 __Getctype std::_Facet_Register 19033->19034 19035 75642b RtlAllocateHeap 19034->19035 19036 75643e __dosmaperr 19034->19036 19035->19034 19035->19036 19036->19025 19038 756dbe __dosmaperr 19037->19038 19040 756de8 19037->19040 19039 74d23f __dosmaperr RtlAllocateHeap 19038->19039 19038->19040 19039->19040 19040->19030 19042 755a77 __Getctype 19041->19042 19045 7559af 19042->19045 19044 755aa0 19044->19032 19046 7559bb __fread_nolock std::_Lockit::_Lockit 19045->19046 19049 755b90 19046->19049 19048 7559dd __Getctype 19048->19044 19050 755bc6 __Getctype 19049->19050 19051 755b9f __Getctype 19049->19051 19050->19048 19051->19050 19053 75f2a7 19051->19053 19054 75f327 19053->19054 19057 75f2bd 19053->19057 19055 75f375 19054->19055 19058 756db3 ___std_exception_destroy RtlAllocateHeap 19054->19058 19121 75f418 19055->19121 19057->19054 19059 75f2f0 19057->19059 19064 756db3 ___std_exception_destroy RtlAllocateHeap 19057->19064 19060 75f349 19058->19060 19061 75f312 19059->19061 19066 756db3 ___std_exception_destroy RtlAllocateHeap 19059->19066 19062 756db3 ___std_exception_destroy RtlAllocateHeap 19060->19062 19063 756db3 ___std_exception_destroy RtlAllocateHeap 19061->19063 19065 75f35c 19062->19065 19068 75f31c 19063->19068 19070 75f2e5 19064->19070 19067 756db3 ___std_exception_destroy RtlAllocateHeap 19065->19067 19072 75f307 19066->19072 19073 75f36a 19067->19073 19074 756db3 ___std_exception_destroy RtlAllocateHeap 19068->19074 19069 75f3e3 19075 756db3 ___std_exception_destroy RtlAllocateHeap 19069->19075 19081 75e5ab 19070->19081 19071 75f383 19071->19069 19077 756db3 RtlAllocateHeap ___std_exception_destroy 19071->19077 19109 75ea0a 19072->19109 19079 756db3 ___std_exception_destroy RtlAllocateHeap 19073->19079 19074->19054 19080 75f3e9 19075->19080 19077->19071 19079->19055 19080->19050 19082 75e5bc 19081->19082 19108 75e6a5 19081->19108 19083 75e5cd 19082->19083 19084 756db3 ___std_exception_destroy RtlAllocateHeap 19082->19084 19085 75e5df 19083->19085 19086 756db3 ___std_exception_destroy RtlAllocateHeap 19083->19086 19084->19083 19087 75e5f1 19085->19087 19089 756db3 ___std_exception_destroy RtlAllocateHeap 19085->19089 19086->19085 19088 75e603 19087->19088 19090 756db3 ___std_exception_destroy RtlAllocateHeap 19087->19090 19091 75e615 19088->19091 19092 756db3 ___std_exception_destroy RtlAllocateHeap 19088->19092 19089->19087 19090->19088 19093 75e627 19091->19093 19094 756db3 ___std_exception_destroy RtlAllocateHeap 19091->19094 19092->19091 19095 75e639 19093->19095 19097 756db3 ___std_exception_destroy RtlAllocateHeap 19093->19097 19094->19093 19096 75e64b 19095->19096 19098 756db3 ___std_exception_destroy RtlAllocateHeap 19095->19098 19099 75e65d 19096->19099 19100 756db3 ___std_exception_destroy RtlAllocateHeap 19096->19100 19097->19095 19098->19096 19101 75e66f 19099->19101 19102 756db3 ___std_exception_destroy RtlAllocateHeap 19099->19102 19100->19099 19103 75e681 19101->19103 19105 756db3 ___std_exception_destroy RtlAllocateHeap 19101->19105 19102->19101 19104 75e693 19103->19104 19106 756db3 ___std_exception_destroy RtlAllocateHeap 19103->19106 19107 756db3 ___std_exception_destroy RtlAllocateHeap 19104->19107 19104->19108 19105->19103 19106->19104 19107->19108 19108->19059 19110 75ea17 19109->19110 19120 75ea6f 19109->19120 19111 75ea27 19110->19111 19112 756db3 ___std_exception_destroy RtlAllocateHeap 19110->19112 19113 75ea39 19111->19113 19114 756db3 ___std_exception_destroy RtlAllocateHeap 19111->19114 19112->19111 19115 75ea4b 19113->19115 19116 756db3 ___std_exception_destroy RtlAllocateHeap 19113->19116 19114->19113 19117 75ea5d 19115->19117 19118 756db3 ___std_exception_destroy RtlAllocateHeap 19115->19118 19116->19115 19119 756db3 ___std_exception_destroy RtlAllocateHeap 19117->19119 19117->19120 19118->19117 19119->19120 19120->19061 19122 75f425 19121->19122 19123 75f444 19121->19123 19122->19123 19124 75ef31 __Getctype RtlAllocateHeap 19122->19124 19123->19071 19125 75f43e 19124->19125 19126 756db3 ___std_exception_destroy RtlAllocateHeap 19125->19126 19126->19123 19128 7446fe __fread_nolock 19127->19128 19133 744723 19128->19133 19130 744716 19140 7444dc 19130->19140 19134 744733 19133->19134 19137 74473a __fread_nolock __Getctype 19133->19137 19146 744541 19134->19146 19136 744748 19136->19130 19137->19136 19138 7446ec __fread_nolock RtlAllocateHeap 19137->19138 19139 7447ac 19138->19139 19139->19130 19141 7444e8 19140->19141 19143 7444ff 19141->19143 19161 744587 19141->19161 19144 744587 __fread_nolock RtlAllocateHeap 19143->19144 19145 744512 19143->19145 19144->19145 19145->19010 19147 744550 19146->19147 19150 755ddd 19147->19150 19151 755df0 __Getctype 19150->19151 19152 7563f3 __Getctype RtlAllocateHeap 19151->19152 19160 744572 19151->19160 19153 755e20 __Getctype 19152->19153 19154 755e28 __Getctype 19153->19154 19155 755e5c 19153->19155 19156 756db3 ___std_exception_destroy RtlAllocateHeap 19154->19156 19157 755a09 __Getctype RtlAllocateHeap 19155->19157 19156->19160 19158 755e67 19157->19158 19159 756db3 ___std_exception_destroy RtlAllocateHeap 19158->19159 19159->19160 19160->19137 19162 744591 19161->19162 19163 74459a 19161->19163 19164 744541 __fread_nolock RtlAllocateHeap 19162->19164 19163->19143 19165 744596 19164->19165 19165->19163 19168 750259 19165->19168 19169 75025e std::locale::_Setgloballocale 19168->19169 19173 750269 std::locale::_Setgloballocale 19169->19173 19174 75c7c6 19169->19174 19195 74f224 19173->19195 19175 75c7d2 __fread_nolock 19174->19175 19176 755d2c __dosmaperr RtlAllocateHeap 19175->19176 19177 75c822 19175->19177 19180 75c803 std::locale::_Setgloballocale 19175->19180 19182 75c834 std::_Lockit::_Lockit std::locale::_Setgloballocale 19175->19182 19176->19180 19178 74d23f __dosmaperr RtlAllocateHeap 19177->19178 19179 75c827 19178->19179 19181 7447a0 __fread_nolock RtlAllocateHeap 19179->19181 19180->19177 19180->19182 19194 75c80c 19180->19194 19181->19194 19183 75c9a4 std::_Lockit::~_Lockit 19182->19183 19184 75c8a7 19182->19184 19186 75c8d5 std::locale::_Setgloballocale 19182->19186 19185 74f224 std::locale::_Setgloballocale RtlAllocateHeap 19183->19185 19184->19186 19198 755bdb 19184->19198 19187 75c9b7 19185->19187 19189 755bdb __Getctype RtlAllocateHeap 19186->19189 19192 75c92a 19186->19192 19186->19194 19189->19192 19191 755bdb __Getctype RtlAllocateHeap 19191->19186 19193 755bdb __Getctype RtlAllocateHeap 19192->19193 19192->19194 19193->19194 19194->19173 19212 74f094 19195->19212 19197 74f235 19199 755be4 __Getctype 19198->19199 19200 7563f3 __Getctype RtlAllocateHeap 19199->19200 19209 755bfb 19199->19209 19202 755c28 __Getctype 19200->19202 19201 755c8b 19201->19191 19204 755c68 19202->19204 19206 755c30 __Getctype 19202->19206 19203 750259 __Getctype RtlAllocateHeap 19205 755c95 19203->19205 19208 755a09 __Getctype RtlAllocateHeap 19204->19208 19207 756db3 ___std_exception_destroy RtlAllocateHeap 19206->19207 19207->19209 19210 755c73 19208->19210 19209->19201 19209->19203 19211 756db3 ___std_exception_destroy RtlAllocateHeap 19210->19211 19211->19209 19213 74f0c1 std::locale::_Setgloballocale 19212->19213 19214 74ef23 std::locale::_Setgloballocale RtlAllocateHeap 19213->19214 19215 74f10a std::locale::_Setgloballocale 19214->19215 19215->19197 19230 73d6e9 19216->19230 19227 6621de Concurrency::cancel_current_task 19226->19227 19228 740651 ___std_exception_copy RtlAllocateHeap 19227->19228 19229 662213 19228->19229 19229->18957 19233 73d4af 19230->19233 19232 73d6fa Concurrency::cancel_current_task 19236 663010 19233->19236 19237 740651 ___std_exception_copy RtlAllocateHeap 19236->19237 19238 66303d 19237->19238 19238->19232 19241 7452ac __fread_nolock 19239->19241 19240 7452b3 19242 74d23f __dosmaperr RtlAllocateHeap 19240->19242 19241->19240 19243 7452d3 19241->19243 19244 7452b8 19242->19244 19245 7452e5 19243->19245 19246 7452d8 19243->19246 19247 7447a0 __fread_nolock RtlAllocateHeap 19244->19247 19253 756688 19245->19253 19248 74d23f __dosmaperr RtlAllocateHeap 19246->19248 19252 7452c3 19247->19252 19248->19252 19250 7452ee 19251 74d23f __dosmaperr RtlAllocateHeap 19250->19251 19250->19252 19251->19252 19252->18968 19254 756694 __fread_nolock std::_Lockit::_Lockit 19253->19254 19257 75672c 19254->19257 19256 7566af 19256->19250 19261 75674f __fread_nolock 19257->19261 19258 7563f3 __Getctype RtlAllocateHeap 19259 7567b0 19258->19259 19260 756db3 ___std_exception_destroy RtlAllocateHeap 19259->19260 19262 756795 __fread_nolock 19260->19262 19261->19258 19261->19261 19261->19262 19262->19256 19264 748e99 __fread_nolock 19263->19264 19265 748e9f 19264->19265 19267 748ee2 __fread_nolock 19264->19267 19266 744723 __fread_nolock RtlAllocateHeap 19265->19266 19269 748eba 19266->19269 19270 749010 19267->19270 19269->18972 19271 749036 19270->19271 19272 749023 19270->19272 19279 748f37 19271->19279 19272->19269 19274 749059 19275 7490e7 19274->19275 19283 7455d3 19274->19283 19275->19269 19280 748fa0 19279->19280 19281 748f48 19279->19281 19280->19274 19281->19280 19292 74e13d 19281->19292 19284 7455ec 19283->19284 19285 745613 19283->19285 19284->19285 19319 755f82 19284->19319 19289 74e17d 19285->19289 19287 745608 19326 75538b 19287->19326 19290 74e05c __fread_nolock 2 API calls 19289->19290 19291 74e196 19290->19291 19291->19275 19293 74e151 __fread_nolock 19292->19293 19298 74e05c 19293->19298 19295 74e166 19296 7444dc __fread_nolock RtlAllocateHeap 19295->19296 19297 74e175 19296->19297 19297->19280 19303 75a6de 19298->19303 19300 74e06e 19301 74e08a SetFilePointerEx 19300->19301 19302 74e076 __fread_nolock 19300->19302 19301->19302 19302->19295 19304 75a700 19303->19304 19305 75a6eb 19303->19305 19307 74d22c __dosmaperr RtlAllocateHeap 19304->19307 19309 75a725 19304->19309 19316 74d22c 19305->19316 19310 75a730 19307->19310 19309->19300 19312 74d23f __dosmaperr RtlAllocateHeap 19310->19312 19311 74d23f __dosmaperr RtlAllocateHeap 19314 75a6f8 19311->19314 19313 75a738 19312->19313 19315 7447a0 __fread_nolock RtlAllocateHeap 19313->19315 19314->19300 19315->19314 19317 755d2c __dosmaperr RtlAllocateHeap 19316->19317 19318 74d231 19317->19318 19318->19311 19320 755fa3 19319->19320 19321 755f8e 19319->19321 19320->19287 19322 74d23f __dosmaperr RtlAllocateHeap 19321->19322 19323 755f93 19322->19323 19324 7447a0 __fread_nolock RtlAllocateHeap 19323->19324 19325 755f9e 19324->19325 19325->19287 19327 755397 __fread_nolock 19326->19327 19328 7553d8 19327->19328 19330 75541e 19327->19330 19332 75539f 19327->19332 19329 744723 __fread_nolock RtlAllocateHeap 19328->19329 19329->19332 19330->19332 19333 75549c 19330->19333 19332->19285 19334 7554c4 19333->19334 19346 7554e7 __fread_nolock 19333->19346 19335 7554c8 19334->19335 19337 755523 19334->19337 19336 744723 __fread_nolock RtlAllocateHeap 19335->19336 19336->19346 19338 755541 19337->19338 19339 74e17d 2 API calls 19337->19339 19347 754fe1 19338->19347 19339->19338 19342 7555a0 19343 755609 WriteFile 19342->19343 19342->19346 19343->19346 19344 755559 19344->19346 19352 754bb2 19344->19352 19346->19332 19358 760d44 19347->19358 19349 754ff3 19350 755021 19349->19350 19367 749d10 19349->19367 19350->19342 19350->19344 19353 754c1a 19352->19353 19354 749d10 std::_Locinfo::_Locinfo_dtor 2 API calls 19353->19354 19356 754c2b std::_Locinfo::_Locinfo_dtor std::_Locinfo::_Locinfo_ctor 19353->19356 19354->19356 19355 7584be RtlAllocateHeap RtlAllocateHeap 19355->19356 19356->19355 19357 754ee1 _ValidateLocalCookies 19356->19357 19357->19346 19357->19357 19359 760d51 19358->19359 19360 760d5e 19358->19360 19361 74d23f __dosmaperr RtlAllocateHeap 19359->19361 19363 760d6a 19360->19363 19364 74d23f __dosmaperr RtlAllocateHeap 19360->19364 19362 760d56 19361->19362 19362->19349 19363->19349 19365 760d8b 19364->19365 19366 7447a0 __fread_nolock RtlAllocateHeap 19365->19366 19366->19362 19368 744587 __fread_nolock RtlAllocateHeap 19367->19368 19369 749d20 19368->19369 19374 755ef3 19369->19374 19375 749d3d 19374->19375 19376 755f0a 19374->19376 19378 755f51 19375->19378 19376->19375 19382 75f4f3 19376->19382 19379 755f68 19378->19379 19381 749d4a 19378->19381 19379->19381 19391 75d81e 19379->19391 19381->19350 19383 75f4ff __fread_nolock 19382->19383 19384 755bdb __Getctype RtlAllocateHeap 19383->19384 19386 75f508 std::_Lockit::_Lockit 19384->19386 19385 75f54e 19385->19375 19386->19385 19387 75f574 __Getctype RtlAllocateHeap 19386->19387 19388 75f537 __Getctype 19387->19388 19388->19385 19389 750259 __Getctype RtlAllocateHeap 19388->19389 19390 75f573 19389->19390 19392 755bdb __Getctype RtlAllocateHeap 19391->19392 19393 75d823 19392->19393 19394 75d736 std::_Locinfo::_Locinfo_dtor RtlAllocateHeap RtlAllocateHeap 19393->19394 19395 75d82e 19394->19395 19395->19381 19397 74480d __fread_nolock 19396->19397 19398 744814 19397->19398 19399 744835 __fread_nolock 19397->19399 19400 744723 __fread_nolock RtlAllocateHeap 19398->19400 19403 744910 19399->19403 19402 74482d 19400->19402 19402->18978 19406 744942 19403->19406 19405 744922 19405->19402 19407 744951 19406->19407 19408 744979 19406->19408 19409 744723 __fread_nolock RtlAllocateHeap 19407->19409 19410 755f82 __fread_nolock RtlAllocateHeap 19408->19410 19411 74496c __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 19409->19411 19412 744982 19410->19412 19411->19405 19419 74e11f 19412->19419 19415 744a2c 19422 744cae 19415->19422 19416 744a43 19416->19411 19430 744ae3 19416->19430 19437 74df37 19419->19437 19421 7449a0 19421->19411 19421->19415 19421->19416 19423 744cbd 19422->19423 19424 755f82 __fread_nolock RtlAllocateHeap 19423->19424 19425 744cd9 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 19424->19425 19426 74e11f 2 API calls 19425->19426 19429 744ce5 _ValidateLocalCookies 19425->19429 19427 744d39 19426->19427 19428 74e11f 2 API calls 19427->19428 19427->19429 19428->19429 19429->19411 19431 755f82 __fread_nolock RtlAllocateHeap 19430->19431 19432 744af6 19431->19432 19433 74e11f 2 API calls 19432->19433 19435 744b40 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 19432->19435 19434 744b9d 19433->19434 19434->19435 19436 74e11f 2 API calls 19434->19436 19435->19411 19436->19435 19439 74df43 __fread_nolock 19437->19439 19438 74df4b 19438->19421 19439->19438 19440 74df86 19439->19440 19442 74dfcc 19439->19442 19441 744723 __fread_nolock RtlAllocateHeap 19440->19441 19441->19438 19442->19438 19443 74e05c __fread_nolock 2 API calls 19442->19443 19443->19438 19445 6d06a9 19444->19445 19449 6d0585 19444->19449 19446 662270 RtlAllocateHeap 19445->19446 19447 6d06ae 19446->19447 19448 6621d0 Concurrency::cancel_current_task RtlAllocateHeap 19447->19448 19457 6d05aa __fread_nolock std::_Locinfo::_Locinfo_ctor 19448->19457 19450 6d05f0 19449->19450 19451 6d05e3 19449->19451 19454 6d059a 19449->19454 19456 73f290 std::_Facet_Register RtlAllocateHeap 19450->19456 19450->19457 19451->19447 19451->19454 19452 73f290 std::_Facet_Register RtlAllocateHeap 19452->19457 19453 7447b0 RtlAllocateHeap 19455 6d06b8 19453->19455 19454->19452 19456->19457 19457->19453 19458 6d0667 __fread_nolock std::_Locinfo::_Locinfo_ctor 19457->19458 19458->18984 19461 74dc08 __fread_nolock 19459->19461 19460 74dc40 __fread_nolock 19460->18988 19461->19460 19462 74dc1b __fread_nolock 19461->19462 19464 74dc52 __fread_nolock 19461->19464 19463 74d23f __dosmaperr RtlAllocateHeap 19462->19463 19465 74dc35 19463->19465 19468 74da06 19464->19468 19467 7447a0 __fread_nolock RtlAllocateHeap 19465->19467 19467->19460 19472 74da18 __fread_nolock 19468->19472 19474 74da35 19468->19474 19469 74da25 19470 74d23f __dosmaperr RtlAllocateHeap 19469->19470 19471 74da2a 19470->19471 19473 7447a0 __fread_nolock RtlAllocateHeap 19471->19473 19472->19469 19472->19474 19479 74da76 __fread_nolock 19472->19479 19473->19474 19474->19460 19475 74dba1 __fread_nolock 19478 74d23f __dosmaperr RtlAllocateHeap 19475->19478 19477 755f82 __fread_nolock RtlAllocateHeap 19477->19479 19478->19471 19479->19474 19479->19475 19479->19477 19481 754623 19479->19481 19540 748a2b 19479->19540 19482 754635 19481->19482 19483 75464d 19481->19483 19484 74d22c __dosmaperr RtlAllocateHeap 19482->19484 19485 75498f 19483->19485 19489 754690 19483->19489 19486 75463a 19484->19486 19487 74d22c __dosmaperr RtlAllocateHeap 19485->19487 19488 74d23f __dosmaperr RtlAllocateHeap 19486->19488 19490 754994 19487->19490 19493 754642 19488->19493 19491 75469b 19489->19491 19489->19493 19498 7546cb 19489->19498 19492 74d23f __dosmaperr RtlAllocateHeap 19490->19492 19494 74d22c __dosmaperr RtlAllocateHeap 19491->19494 19495 7546a8 19492->19495 19493->19479 19496 7546a0 19494->19496 19497 7447a0 __fread_nolock RtlAllocateHeap 19495->19497 19499 74d23f __dosmaperr RtlAllocateHeap 19496->19499 19497->19493 19500 7546e4 19498->19500 19501 7546f1 19498->19501 19502 75471f 19498->19502 19499->19495 19500->19501 19506 75470d 19500->19506 19503 74d22c __dosmaperr RtlAllocateHeap 19501->19503 19554 756e2d 19502->19554 19505 7546f6 19503->19505 19508 74d23f __dosmaperr RtlAllocateHeap 19505->19508 19509 760d44 __fread_nolock RtlAllocateHeap 19506->19509 19511 7546fd 19508->19511 19522 75486b 19509->19522 19510 756db3 ___std_exception_destroy RtlAllocateHeap 19512 754739 19510->19512 19513 7447a0 __fread_nolock RtlAllocateHeap 19511->19513 19515 756db3 ___std_exception_destroy RtlAllocateHeap 19512->19515 19539 754708 __fread_nolock 19513->19539 19514 7548e3 ReadFile 19516 754957 19514->19516 19517 7548fb 19514->19517 19518 754740 19515->19518 19527 754964 19516->19527 19536 7548b5 19516->19536 19517->19516 19519 7548d4 19517->19519 19520 754765 19518->19520 19521 75474a 19518->19521 19530 754937 19519->19530 19531 754920 19519->19531 19519->19539 19525 74e13d __fread_nolock 2 API calls 19520->19525 19523 74d23f __dosmaperr RtlAllocateHeap 19521->19523 19522->19514 19526 75489b 19522->19526 19528 75474f 19523->19528 19524 756db3 ___std_exception_destroy RtlAllocateHeap 19524->19493 19525->19506 19526->19519 19526->19536 19529 74d23f __dosmaperr RtlAllocateHeap 19527->19529 19532 74d22c __dosmaperr RtlAllocateHeap 19528->19532 19533 754969 19529->19533 19530->19539 19575 75417b 19530->19575 19565 754335 19531->19565 19532->19539 19537 74d22c __dosmaperr RtlAllocateHeap 19533->19537 19536->19539 19560 74d1e5 19536->19560 19537->19539 19539->19524 19541 748a3c 19540->19541 19549 748a38 std::_Locinfo::_Locinfo_ctor 19540->19549 19542 748a43 19541->19542 19545 748a56 __fread_nolock 19541->19545 19543 74d23f __dosmaperr RtlAllocateHeap 19542->19543 19544 748a48 19543->19544 19546 7447a0 __fread_nolock RtlAllocateHeap 19544->19546 19547 748a84 19545->19547 19548 748a8d 19545->19548 19545->19549 19546->19549 19550 74d23f __dosmaperr RtlAllocateHeap 19547->19550 19548->19549 19551 74d23f __dosmaperr RtlAllocateHeap 19548->19551 19549->19479 19552 748a89 19550->19552 19551->19552 19553 7447a0 __fread_nolock RtlAllocateHeap 19552->19553 19553->19549 19555 756e6b 19554->19555 19556 756e3b __Getctype std::_Facet_Register 19554->19556 19558 74d23f __dosmaperr RtlAllocateHeap 19555->19558 19556->19555 19557 756e56 RtlAllocateHeap 19556->19557 19557->19556 19559 754730 19557->19559 19558->19559 19559->19510 19561 74d22c __dosmaperr RtlAllocateHeap 19560->19561 19562 74d1f0 __dosmaperr 19561->19562 19563 74d23f __dosmaperr RtlAllocateHeap 19562->19563 19564 74d203 19563->19564 19564->19539 19579 75402e 19565->19579 19568 7543c7 19569 74d23f __dosmaperr RtlAllocateHeap 19568->19569 19571 75437d 19569->19571 19570 7543d7 19572 74e13d __fread_nolock 2 API calls 19570->19572 19573 754391 __fread_nolock 19570->19573 19571->19539 19572->19573 19573->19571 19574 74d1e5 __dosmaperr RtlAllocateHeap 19573->19574 19574->19571 19577 7541b5 19575->19577 19576 754246 19576->19539 19577->19576 19578 74e13d __fread_nolock 2 API calls 19577->19578 19578->19576 19580 754062 19579->19580 19581 7540ce 19580->19581 19582 74e13d __fread_nolock 2 API calls 19580->19582 19581->19568 19581->19570 19581->19571 19581->19573 19582->19581 19584 748acf __fread_nolock 19583->19584 19585 748ad9 19584->19585 19588 748afc __fread_nolock 19584->19588 19586 744723 __fread_nolock RtlAllocateHeap 19585->19586 19587 748af4 19586->19587 19587->18992 19588->19587 19590 748b5a 19588->19590 19591 748b67 19590->19591 19592 748b8a 19590->19592 19593 744723 __fread_nolock RtlAllocateHeap 19591->19593 19594 7455d3 4 API calls 19592->19594 19602 748b82 19592->19602 19593->19602 19595 748ba2 19594->19595 19604 756ded 19595->19604 19598 755f82 __fread_nolock RtlAllocateHeap 19599 748bb6 19598->19599 19608 754a3f 19599->19608 19602->19587 19603 756db3 ___std_exception_destroy RtlAllocateHeap 19603->19602 19605 756e04 19604->19605 19606 748baa 19604->19606 19605->19606 19607 756db3 ___std_exception_destroy RtlAllocateHeap 19605->19607 19606->19598 19607->19606 19609 754a68 19608->19609 19614 748bbd 19608->19614 19610 754ab7 19609->19610 19612 754a8f 19609->19612 19611 744723 __fread_nolock RtlAllocateHeap 19610->19611 19611->19614 19615 7549ae 19612->19615 19614->19602 19614->19603 19616 7549ba __fread_nolock 19615->19616 19617 7549f9 19616->19617 19619 754b12 19616->19619 19617->19614 19620 75a6de __fread_nolock RtlAllocateHeap 19619->19620 19623 754b22 19620->19623 19621 754b28 19631 75a64d 19621->19631 19623->19621 19624 754b5a 19623->19624 19626 75a6de __fread_nolock RtlAllocateHeap 19623->19626 19624->19621 19625 75a6de __fread_nolock RtlAllocateHeap 19624->19625 19627 754b66 FindCloseChangeNotification 19625->19627 19628 754b51 19626->19628 19627->19621 19629 75a6de __fread_nolock RtlAllocateHeap 19628->19629 19629->19624 19630 754b80 __fread_nolock 19630->19617 19632 75a65c 19631->19632 19633 74d23f __dosmaperr RtlAllocateHeap 19632->19633 19636 75a686 19632->19636 19634 75a6c8 19633->19634 19635 74d22c __dosmaperr RtlAllocateHeap 19634->19635 19635->19636 19636->19630

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 0 67e0a0-67e0d2 WSAStartup 1 67e1b7-67e1c0 0->1 2 67e0d8-67e102 call 666bd0 * 2 0->2 7 67e104-67e108 2->7 8 67e10e-67e165 2->8 7->1 7->8 10 67e167-67e16d 8->10 11 67e1b1 8->11 12 67e1c5-67e1cf 10->12 13 67e16f 10->13 11->1 12->11 17 67e1d1-67e1d9 12->17 14 67e175-67e189 socket 13->14 14->11 16 67e18b-67e19b connect 14->16 18 67e1c1 16->18 19 67e19d-67e1a5 closesocket 16->19 18->12 19->14 20 67e1a7-67e1ab 19->20 20->11
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: Startupclosesocketconnectsocket
                                  • String ID:
                                  • API String ID: 3098855095-0
                                  • Opcode ID: f33b47496da6a7008d4213df58c163c01d6bdc89d68335f1b9169eb7e70f1333
                                  • Instruction ID: 89591955219a7e0a3c147fa799b6a32b0d4610f0da6cce392adf32b2165a710d
                                  • Opcode Fuzzy Hash: f33b47496da6a7008d4213df58c163c01d6bdc89d68335f1b9169eb7e70f1333
                                  • Instruction Fuzzy Hash: 8631E6716043009BD7209F25C84976BB7E6EB89334F404F5DF9A8A23D0D33699088BA2

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 193 6c3a40-6c3a52 194 6c3a55-6c3a61 193->194 196 6c3b28-6c3b31 GetPEB 194->196 197 6c3a67-6c3a6d 194->197 198 6c3b34-6c3b48 196->198 197->196 199 6c3a73-6c3a7f GetPEB 197->199 200 6c3b99-6c3b9b 198->200 201 6c3b4a-6c3b4f 198->201 202 6c3a80-6c3a94 199->202 200->198 201->200 203 6c3b51-6c3b59 201->203 204 6c3ae4-6c3ae6 202->204 205 6c3a96-6c3a9b 202->205 206 6c3b60-6c3b73 203->206 204->202 205->204 207 6c3a9d-6c3aa3 205->207 208 6c3b75-6c3b88 206->208 209 6c3b92-6c3b97 206->209 210 6c3aa5-6c3ab8 207->210 208->208 211 6c3b8a-6c3b90 208->211 209->200 209->206 212 6c3add-6c3ae2 210->212 213 6c3aba 210->213 211->209 214 6c3b9d-6c3bc2 Sleep 211->214 212->204 212->210 215 6c3ac0-6c3ad3 213->215 214->194 215->215 216 6c3ad5-6c3adb 215->216 216->212 217 6c3ae8-6c3b0d Sleep 216->217 218 6c3b13-6c3b1a 217->218 218->196 219 6c3b1c-6c3b22 218->219 219->196 220 6c3bc7-6c3bd8 call 666bd0 219->220 223 6c3bde 220->223 224 6c3bda-6c3bdc 220->224 225 6c3be0-6c3bfd call 666bd0 223->225 224->225
                                  APIs
                                  • Sleep.KERNELBASE(000003E9,?,00000001,00000000,?,?,?,?,?,?,?,?,006C3DB6), ref: 006C3B08
                                  • Sleep.KERNELBASE(00000001,?,00000001,00000000,?,?,?,?,?,?,?,?,006C3DB6), ref: 006C3BBA
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: Sleep
                                  • String ID:
                                  • API String ID: 3472027048-0
                                  • Opcode ID: 7c04d1678f462eaccc1a08c27865e273deb3eca2ec26ddf59d4caa4c256e7e40
                                  • Instruction ID: 4e563bfb87b1afdb8750f6c397bf936c9b40f99ad7cc0cdf1db5d18d530b1e19
                                  • Opcode Fuzzy Hash: 7c04d1678f462eaccc1a08c27865e273deb3eca2ec26ddf59d4caa4c256e7e40
                                  • Instruction Fuzzy Hash: CF519935A042299FCB24CF98C8D0FBAB7B2EF55704B29859ED445AB351D731EE05CB80

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 312 5130a73-5130abe 315 5130acf-5130adb GetCurrentHwProfileW 312->315 316 5130af3-5130e1a call 5130d1e 315->316
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(000000F1), ref: 05130AD1
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4135563814.0000000005130000.00000040.00001000.00020000.00000000.sdmp, Offset: 05130000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_5130000_LisectAVT_2403002A_228.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: fe97e979b03f463a44f515f3302a05003ceaa0abc720f2e0f1c61e25d7b4fc21
                                  • Instruction ID: 80d2042075e8ffd1445d0fe3449f05f71a89716c64526fad12801c16fdad85b2
                                  • Opcode Fuzzy Hash: fe97e979b03f463a44f515f3302a05003ceaa0abc720f2e0f1c61e25d7b4fc21
                                  • Instruction Fuzzy Hash: 9D4180EF54C215BDF22AC1412B7AAF657EFD6DA7307328467F807D650AE3850A4D1031

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 21 73f290-73f293 22 73f2a2-73f2a5 call 74df2c 21->22 24 73f2aa-73f2ad 22->24 25 73f295-73f2a0 call 7517d8 24->25 26 73f2af-73f2b0 24->26 25->22 29 73f2b1-73f2b5 25->29 30 6621d0-662220 call 6621b0 call 740efb call 740651 29->30 31 73f2bb 29->31 31->31
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 0066220E
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: `!f$`!f
                                  • API String ID: 2659868963-2207376674
                                  • Opcode ID: 81946be53899768fa2af59dc3972c378b2fdf8944d93f11835da37dfda107001
                                  • Instruction ID: ae7206aee93cba560999233a15bb18bfae0684a265f36f7d04ca412f55f54940
                                  • Opcode Fuzzy Hash: 81946be53899768fa2af59dc3972c378b2fdf8944d93f11835da37dfda107001
                                  • Instruction Fuzzy Hash: 28012B7540430DEBCB24AF98E80699A77ECAB04360F404439FE19DB692EB74E96487D1

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 38 744942-74494f 39 744951-744974 call 744723 38->39 40 744979-74498d call 755f82 38->40 45 744ae0-744ae2 39->45 46 744992-74499b call 74e11f 40->46 47 74498f 40->47 49 7449a0-7449af 46->49 47->46 50 7449b1 49->50 51 7449bf-7449c8 49->51 52 7449b7-7449b9 50->52 53 744a89-744a8e 50->53 54 7449dc-744a10 51->54 55 7449ca-7449d7 51->55 52->51 52->53 56 744ade-744adf 53->56 58 744a12-744a1c 54->58 59 744a6d-744a79 54->59 57 744adc 55->57 56->45 57->56 62 744a43-744a4f 58->62 63 744a1e-744a2a 58->63 60 744a90-744a93 59->60 61 744a7b-744a82 59->61 64 744a96-744a9e 60->64 61->53 62->60 66 744a51-744a6b call 744e59 62->66 63->62 65 744a2c-744a3e call 744cae 63->65 67 744aa0-744aa6 64->67 68 744ada 64->68 65->56 66->64 72 744abe-744ac2 67->72 73 744aa8-744abc call 744ae3 67->73 68->57 76 744ac4-744ad2 call 764a10 72->76 77 744ad5-744ad7 72->77 73->56 76->77 77->68
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID:
                                  • String ID: Ot
                                  • API String ID: 0-3529488939
                                  • Opcode ID: afd9d19ac9d7468ba473f79cba0ba898873926be17af783f8231372baea39a40
                                  • Instruction ID: 3e5287382474039c4eca1ad66060e10b31c9613e8c9ec1552b8ec1e819e9c1b3
                                  • Opcode Fuzzy Hash: afd9d19ac9d7468ba473f79cba0ba898873926be17af783f8231372baea39a40
                                  • Instruction Fuzzy Hash: 9051BF70B40208EFDF14CF58CC85BAABBA1EF49364F24C159F8599B252D335AE41EB94

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 81 754623-754633 82 754635-754648 call 74d22c call 74d23f 81->82 83 75464d-75464f 81->83 99 7549a7 82->99 85 754655-75465b 83->85 86 75498f-75499c call 74d22c call 74d23f 83->86 85->86 88 754661-75468a 85->88 102 7549a2 call 7447a0 86->102 88->86 91 754690-754699 88->91 94 7546b3-7546b5 91->94 95 75469b-7546ae call 74d22c call 74d23f 91->95 97 75498b-75498d 94->97 98 7546bb-7546bf 94->98 95->102 104 7549aa-7549ad 97->104 98->97 103 7546c5-7546c9 98->103 99->104 102->99 103->95 107 7546cb-7546e2 103->107 109 7546e4-7546e7 107->109 110 754717-75471d 107->110 112 75470d-754715 109->112 113 7546e9-7546ef 109->113 114 7546f1-754708 call 74d22c call 74d23f call 7447a0 110->114 115 75471f-754726 110->115 117 75478a-7547a9 112->117 113->112 113->114 146 7548c2 114->146 118 754728 115->118 119 75472a-75472b call 756e2d 115->119 120 754865-75486e call 760d44 117->120 121 7547af-7547bb 117->121 118->119 125 754730-754748 call 756db3 * 2 119->125 135 754870-754882 120->135 136 7548df 120->136 121->120 124 7547c1-7547c3 121->124 124->120 128 7547c9-7547ea 124->128 149 754765-754788 call 74e13d 125->149 150 75474a-754760 call 74d23f call 74d22c 125->150 128->120 132 7547ec-754802 128->132 132->120 138 754804-754806 132->138 135->136 141 754884-754893 135->141 137 7548e3-7548f9 ReadFile 136->137 142 754957-754962 137->142 143 7548fb-754901 137->143 138->120 144 754808-75482b 138->144 141->136 153 754895-754899 141->153 161 754964-754976 call 74d23f call 74d22c 142->161 162 75497b-75497e 142->162 143->142 147 754903 143->147 144->120 148 75482d-754843 144->148 151 7548c5-7548cf call 756db3 146->151 155 754906-754918 147->155 148->120 156 754845-754847 148->156 149->117 150->146 151->104 153->137 160 75489b-7548b3 153->160 155->151 163 75491a-75491e 155->163 156->120 164 754849-754860 156->164 181 7548b5-7548ba 160->181 182 7548d4-7548dd 160->182 161->146 171 754984-754986 162->171 172 7548bb-7548c1 call 74d1e5 162->172 169 754937-754944 163->169 170 754920-754930 call 754335 163->170 164->120 178 754946 call 75448c 169->178 179 754950-754955 call 75417b 169->179 189 754933-754935 170->189 171->151 172->146 190 75494b-75494e 178->190 179->190 181->172 182->155 189->151 190->189
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 03aba45fa24f0c7562dbcb0b5d5fb0d5e9b97caf7d08174e5fa37fecce9a5651
                                  • Instruction ID: c6f9abca2130b8801e0e7a029977ffbd6b0dc7dd7f0d4361bedb88c0d3b50fd0
                                  • Opcode Fuzzy Hash: 03aba45fa24f0c7562dbcb0b5d5fb0d5e9b97caf7d08174e5fa37fecce9a5651
                                  • Instruction Fuzzy Hash: 50B10774A04245EFDB11DFA8D845BEEBBB1BF45309F144159EC4097282D7F8AD8ACB60

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 228 5130ae0-5130ae2 229 5130ae4 228->229 230 5130aee-5130af1 228->230 231 5130ae6-5130aea 229->231 232 5130a7e-5130abe 229->232 233 5130af3-5130e1a call 5130d1e 230->233 231->230 236 5130acf-5130adb GetCurrentHwProfileW 232->236 236->233
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(000000F1), ref: 05130AD1
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4135563814.0000000005130000.00000040.00001000.00020000.00000000.sdmp, Offset: 05130000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_5130000_LisectAVT_2403002A_228.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: cd506555b4c6bafd282a968737027e1e1cd111aa2452c683b7a76e2921f0d773
                                  • Instruction ID: 4d229194914ad5b1a94254a67b66dba4d9f5d197b15afda900486f14a32d788f
                                  • Opcode Fuzzy Hash: cd506555b4c6bafd282a968737027e1e1cd111aa2452c683b7a76e2921f0d773
                                  • Instruction Fuzzy Hash: AB51D7EF54C214AEF32AC1512B7EAF66BEED6DA73033284ABF407D6146E3854A4D4131

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 272 5130a81-5130abe 274 5130acf-5130adb GetCurrentHwProfileW 272->274 275 5130af3-5130e1a call 5130d1e 274->275
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(000000F1), ref: 05130AD1
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4135563814.0000000005130000.00000040.00001000.00020000.00000000.sdmp, Offset: 05130000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_5130000_LisectAVT_2403002A_228.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: e1c9f7610d27955ab19ee0056127174c0e6488e0379e60663b14bda07382ba7c
                                  • Instruction ID: 0d773e6bd12ae92c5011ea1bff979e2d95fb1d5207e1df8ca77e1a2383656b08
                                  • Opcode Fuzzy Hash: e1c9f7610d27955ab19ee0056127174c0e6488e0379e60663b14bda07382ba7c
                                  • Instruction Fuzzy Hash: 134192EF54C214BDF22AC1412B7AAF69BEFD6DA7303328867F807D6506E7850A4D5031

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 353 66a210-66a2ab call 73f290 call 662ae0 358 66a2b0-66a2bb 353->358 358->358 359 66a2bd-66a2c8 358->359 360 66a2cd-66a2de call 745362 359->360 361 66a2ca 359->361 364 66a2e0-66a305 call 749136 call 744eeb call 749136 360->364 365 66a351-66a357 360->365 361->360 383 66a307 364->383 384 66a30c-66a316 364->384 367 66a381-66a393 365->367 368 66a359-66a365 365->368 370 66a377-66a37e call 73f511 368->370 371 66a367-66a375 368->371 370->367 371->370 373 66a394-66a3ae call 7447b0 371->373 380 66a3b0-66a3bb 373->380 380->380 382 66a3bd-66a3c8 380->382 385 66a3cd-66a3df call 745362 382->385 386 66a3ca 382->386 383->384 387 66a328-66a32f call 6ccf60 384->387 388 66a318-66a31c 384->388 397 66a3e1-66a3f9 call 749136 call 744eeb call 748be8 385->397 398 66a3fc-66a403 385->398 386->385 393 66a334-66a33a 387->393 391 66a320-66a326 388->391 392 66a31e 388->392 391->393 392->391 395 66a33e-66a349 call 74dbdf call 748be8 393->395 396 66a33c 393->396 413 66a34e 395->413 396->395 397->398 399 66a405-66a411 398->399 400 66a42d-66a433 398->400 403 66a423-66a42a call 73f511 399->403 404 66a413-66a421 399->404 403->400 404->403 407 66a434-66a45e call 7447b0 404->407 420 66a460-66a464 407->420 421 66a46f-66a474 407->421 413->365 420->421 422 66a466-66a46e 420->422
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: __fread_nolock
                                  • String ID:
                                  • API String ID: 2638373210-0
                                  • Opcode ID: 57ae2b9fa2849966f2bbd28727f428a203389f7c45c6d2553a1f11ddfb2dcb5b
                                  • Instruction ID: b8b7b08a0b98c76c19387d18d546714687046235d3b93ef145c9daf5a01fb430
                                  • Opcode Fuzzy Hash: 57ae2b9fa2849966f2bbd28727f428a203389f7c45c6d2553a1f11ddfb2dcb5b
                                  • Instruction Fuzzy Hash: 6B710570900204EBDB14DFA8DC49BAEBBE9EF41704F10456DF815EB782D7B99A41CB92

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 423 5130afe-5130aff 424 5130b01 423->424 425 5130a9e-5130adb GetCurrentHwProfileW 423->425 427 5130b03-5130e1a call 5130d1e 424->427 431 5130af3-5130af8 425->431 431->427
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(000000F1), ref: 05130AD1
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4135563814.0000000005130000.00000040.00001000.00020000.00000000.sdmp, Offset: 05130000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_5130000_LisectAVT_2403002A_228.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: 716898e054ad46e3b4206f546747739224a25274ba8a7ccc3359168ddea7c8aa
                                  • Instruction ID: 6144b0d67c1ba6e4b15f19dc749e9f4a50913306a0cd271819c79e9851515199
                                  • Opcode Fuzzy Hash: 716898e054ad46e3b4206f546747739224a25274ba8a7ccc3359168ddea7c8aa
                                  • Instruction Fuzzy Hash: C741B0EF14C214ADF22AC1412B7EAF667EEE6DA7303328867F807D650AE3854A4D4031

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 465 5130acc-5130adb GetCurrentHwProfileW 466 5130af3-5130e1a call 5130d1e 465->466
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(000000F1), ref: 05130AD1
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4135563814.0000000005130000.00000040.00001000.00020000.00000000.sdmp, Offset: 05130000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_5130000_LisectAVT_2403002A_228.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: 4f47a5db72aa5c3298c2f009d108abd35b437eb8ab2c02ab0c1d24d9e2516469
                                  • Instruction ID: b58cae883addbd3ea2d9eb241a37f3c3d7697fcca492b3a36e286184580de29b
                                  • Opcode Fuzzy Hash: 4f47a5db72aa5c3298c2f009d108abd35b437eb8ab2c02ab0c1d24d9e2516469
                                  • Instruction Fuzzy Hash: 364192EF54C114ADE229C2412B7EAF657EFE6DA7307328866F807D150AE7854A4D5031

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 503 75549c-7554be 504 7554c4-7554c6 503->504 505 7556b1 503->505 507 7554f2-755515 504->507 508 7554c8-7554e7 call 744723 504->508 506 7556b3-7556b7 505->506 510 755517-755519 507->510 511 75551b-755521 507->511 516 7554ea-7554ed 508->516 510->511 512 755523-755534 510->512 511->508 511->512 514 755547-755557 call 754fe1 512->514 515 755536-755544 call 74e17d 512->515 521 7555a0-7555b2 514->521 522 755559-75555f 514->522 515->514 516->506 523 7555b4-7555ba 521->523 524 755609-755629 WriteFile 521->524 525 755561-755564 522->525 526 755588-75559e call 754bb2 522->526 530 7555f5-755607 call 75505e 523->530 531 7555bc-7555bf 523->531 527 755634 524->527 528 75562b-755631 524->528 532 755566-755569 525->532 533 75556f-75557e call 754f79 525->533 542 755581-755583 526->542 535 755637-755642 527->535 528->527 554 7555dc-7555df 530->554 536 7555e1-7555f3 call 755222 531->536 537 7555c1-7555c4 531->537 532->533 538 755649-75564c 532->538 533->542 543 755644-755647 535->543 544 7556ac-7556af 535->544 536->554 545 75564f-755651 537->545 546 7555ca-7555d7 call 755139 537->546 538->545 542->535 543->538 544->506 551 755653-755658 545->551 552 75567f-75568b 545->552 546->554 555 755671-75567a call 74d208 551->555 556 75565a-75566c 551->556 557 755695-7556a7 552->557 558 75568d-755693 552->558 554->542 555->516 556->516 557->516 558->505 558->557
                                  APIs
                                  • WriteFile.KERNELBASE(?,00000000,00749087,?,00000000,00000000,00000000,?,00000000,?,0066A3EB,00749087,00000000,0066A3EB,?,?), ref: 00755621
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: FileWrite
                                  • String ID:
                                  • API String ID: 3934441357-0
                                  • Opcode ID: 8ebcc8919e8121a63f266c60759a6bce6ea63c99926e9c0293f4676e7ae05da0
                                  • Instruction ID: 223d123e507414878a49e3ea842199088ccb2039de21be772ae94d09c55c9442
                                  • Opcode Fuzzy Hash: 8ebcc8919e8121a63f266c60759a6bce6ea63c99926e9c0293f4676e7ae05da0
                                  • Instruction Fuzzy Hash: 2661C271D00559AFDF11DFA8C894EEEBBBAEF09305F140149EC00A7255D7BAD919CBA0

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 561 6d0560-6d057f 562 6d06a9 call 662270 561->562 563 6d0585-6d0598 561->563 567 6d06ae call 6621d0 562->567 564 6d059a 563->564 565 6d05c0-6d05c8 563->565 570 6d059c-6d05a1 564->570 568 6d05ca-6d05cf 565->568 569 6d05d1-6d05d5 565->569 575 6d06b3-6d06b8 call 7447b0 567->575 568->570 572 6d05d9-6d05e1 569->572 573 6d05d7 569->573 574 6d05a4-6d05a5 call 73f290 570->574 576 6d05f0-6d05f2 572->576 577 6d05e3-6d05e8 572->577 573->572 579 6d05aa-6d05af 574->579 582 6d05f4-6d05ff call 73f290 576->582 583 6d0601 576->583 577->567 581 6d05ee 577->581 579->575 584 6d05b5-6d05be 579->584 581->574 587 6d0603-6d0629 582->587 583->587 584->587 589 6d062b-6d0655 call 740f70 call 7414f0 587->589 590 6d0680-6d06a6 call 740f70 call 7414f0 587->590 599 6d0669-6d067d call 73f511 589->599 600 6d0657-6d0665 589->600 600->575 601 6d0667 600->601 601->599
                                  APIs
                                  • Concurrency::cancel_current_task.LIBCPMT ref: 006D06AE
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: Concurrency::cancel_current_task
                                  • String ID:
                                  • API String ID: 118556049-0
                                  • Opcode ID: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
                                  • Instruction ID: 56aa59fe3d135c6c610207b554944d21219032208f2f75ca222ea0bcd14b98ed
                                  • Opcode Fuzzy Hash: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
                                  • Instruction Fuzzy Hash: D9410672E00114DBDB15EF68DD806AE7BA6AF89350F1402AAFC05DB346D730DE618BE1

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 604 754b12-754b26 call 75a6de 607 754b2c-754b34 604->607 608 754b28-754b2a 604->608 610 754b36-754b3d 607->610 611 754b3f-754b42 607->611 609 754b7a-754b9a call 75a64d 608->609 620 754bac 609->620 621 754b9c-754baa call 74d208 609->621 610->611 613 754b4a-754b5e call 75a6de * 2 610->613 614 754b44-754b48 611->614 615 754b60-754b70 call 75a6de FindCloseChangeNotification 611->615 613->608 613->615 614->613 614->615 615->608 623 754b72-754b78 615->623 625 754bae-754bb1 620->625 621->625 623->609
                                  APIs
                                  • FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,007549F9,00000000,CF830579,00791140,0000000C,00754AB5,00748BBD,?), ref: 00754B68
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ChangeCloseFindNotification
                                  • String ID:
                                  • API String ID: 2591292051-0
                                  • Opcode ID: 2570f7b5daf07c6b58ee6d5bf1437fd564c1f2d1a9a0d032062a98c76f4340d0
                                  • Instruction ID: e8393ca93a46f585e96fbbe29539b5ec131be3dbbd9a71eb960589ccafbd0fa5
                                  • Opcode Fuzzy Hash: 2570f7b5daf07c6b58ee6d5bf1437fd564c1f2d1a9a0d032062a98c76f4340d0
                                  • Instruction Fuzzy Hash: 3E116B73A4415466D72523346809BFE678ACB827BAF29031DFC048B1C2EEFDDCC94155

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 630 74e05c-74e074 call 75a6de 633 74e076-74e07d 630->633 634 74e08a-74e0a0 SetFilePointerEx 630->634 635 74e084-74e088 633->635 636 74e0b5-74e0bf 634->636 637 74e0a2-74e0b3 call 74d208 634->637 638 74e0db-74e0de 635->638 636->635 639 74e0c1-74e0d6 636->639 637->635 639->638
                                  APIs
                                  • SetFilePointerEx.KERNELBASE(00000000,00000000,00790DF8,0066A3EB,00000002,0066A3EB,00000000,?,?,?,0074E166,00000000,?,0066A3EB,00000002,00790DF8), ref: 0074E098
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: FilePointer
                                  • String ID:
                                  • API String ID: 973152223-0
                                  • Opcode ID: e38227b18c76bab3017228781c5cb66e78586fa020053dcf4cde0a5f1846ca6a
                                  • Instruction ID: 9811deaad074255088a3e50390237c8e85042b2a72a8bff32acd2618bcf9a16c
                                  • Opcode Fuzzy Hash: e38227b18c76bab3017228781c5cb66e78586fa020053dcf4cde0a5f1846ca6a
                                  • Instruction Fuzzy Hash: 7601C432610155AFCF159F59DC09C9E7B69EB81370B340248F8609B2A1E7B5ED518B90
                                  APIs
                                  • RtlAllocateHeap.NTDLL(00000008,007491F7,00000000,?,00755D79,00000001,00000364,00000000,00000006,000000FF,?,00000000,0074D244,007489C3,007491F7,00000000), ref: 00756434
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: AllocateHeap
                                  • String ID:
                                  • API String ID: 1279760036-0
                                  • Opcode ID: 6576fa4872485cc277949ac1750f32f8fe288b9ecd6d65b3eabb9fd03ca5b6e0
                                  • Instruction ID: 7c64d7dee444d5a9956b915c3517c8737170c36c4872c9282bd85e17dd3abddd
                                  • Opcode Fuzzy Hash: 6576fa4872485cc277949ac1750f32f8fe288b9ecd6d65b3eabb9fd03ca5b6e0
                                  • Instruction Fuzzy Hash: 34F0E031905164A6DB217B669C067DB37496F41773FA58011EC0497090CBF8DE0946F1
                                  APIs
                                  • RtlAllocateHeap.NTDLL(00000000,0075D635,4D88C033,?,0075D635,00000220,?,007557EF,4D88C033), ref: 00756E60
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: AllocateHeap
                                  • String ID:
                                  • API String ID: 1279760036-0
                                  • Opcode ID: 2b2e66b5d539bebc5225bb130687269fe58df1f338b91a845fa385a27da70166
                                  • Instruction ID: c49ff64eef0724dac35613c38eacc2a2fe494828a52e38ed4f0f67b465d85228
                                  • Opcode Fuzzy Hash: 2b2e66b5d539bebc5225bb130687269fe58df1f338b91a845fa385a27da70166
                                  • Instruction Fuzzy Hash: 78E0ED3A102621A6DA3022A9EC06BDB7648BB927A3F850521EC04930D0CBECCC0881A8
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4135642819.0000000005140000.00000040.00001000.00020000.00000000.sdmp, Offset: 05140000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_5140000_LisectAVT_2403002A_228.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: c2de2cb8a4d657b6657e10ac9ad74b2572539ddc4c6758f7136d586490ee4645
                                  • Instruction ID: df5da9297357dc5fe84cb0d4370537123f6ec2de7ffb21d94fef48a1f887afdd
                                  • Opcode Fuzzy Hash: c2de2cb8a4d657b6657e10ac9ad74b2572539ddc4c6758f7136d586490ee4645
                                  • Instruction Fuzzy Hash: 1B2192EB14C2107EB216C1922A58EFB6B6EE6DB730332942BF902C9546D39E0A4E5571
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4135642819.0000000005140000.00000040.00001000.00020000.00000000.sdmp, Offset: 05140000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_5140000_LisectAVT_2403002A_228.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 6de3581bc7a2586adb2f99fb790f337878c016a400b07af1ee6df61e939698f7
                                  • Instruction ID: 0258e1f456a499410910e055d9be6f79f2c916c2d38a262668c2aee693372030
                                  • Opcode Fuzzy Hash: 6de3581bc7a2586adb2f99fb790f337878c016a400b07af1ee6df61e939698f7
                                  • Instruction Fuzzy Hash: E001C9EB148120BD7156D1962B28EFB5B6EE1D6730332C42BF907C5546E3990A4D6431
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4135642819.0000000005140000.00000040.00001000.00020000.00000000.sdmp, Offset: 05140000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_5140000_LisectAVT_2403002A_228.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 871ca6400e2b946d1932c2a553d3382493219656948701a98f171fd392a03d2a
                                  • Instruction ID: 6808802a933432dd8f811296515e6472f3a99ad3ab27d65a12469b66a34dc3f2
                                  • Opcode Fuzzy Hash: 871ca6400e2b946d1932c2a553d3382493219656948701a98f171fd392a03d2a
                                  • Instruction Fuzzy Hash: EFF0C9EB148210BD7156D1923B28EFB6B6EE1C7730331892BF943C5546E3890A4D6432
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4135642819.0000000005140000.00000040.00001000.00020000.00000000.sdmp, Offset: 05140000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_5140000_LisectAVT_2403002A_228.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 03e6f20920947449d5804aba66ea9f6a58ff103af9e27c391ee2b93605f98091
                                  • Instruction ID: 72208ee7882de6cc1f0485e6b15bec1acb1ba7f8e8807cc7e6b0520606ec25de
                                  • Opcode Fuzzy Hash: 03e6f20920947449d5804aba66ea9f6a58ff103af9e27c391ee2b93605f98091
                                  • Instruction Fuzzy Hash: 87F0E7EB148510BDB046D1923F28EFBAB6EE1C6730331C92BF843C5546E3890A4D6432
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4135642819.0000000005140000.00000040.00001000.00020000.00000000.sdmp, Offset: 05140000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_5140000_LisectAVT_2403002A_228.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 336c827f069fb03c9451a009af5dadcf887ba305d19d3f80d3f965e972403a15
                                  • Instruction ID: f89e32fb8124fc4504b093f5116bac97ad7a8defbdfb3ccde7a3c1d5c428ff00
                                  • Opcode Fuzzy Hash: 336c827f069fb03c9451a009af5dadcf887ba305d19d3f80d3f965e972403a15
                                  • Instruction Fuzzy Hash: 09F0D4EB14C1107D7056D1923B29AFAAB2EE1C37343318927F443C1987E3C90A4E6432
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID:
                                  • String ID: $$%s|%s$,$,$.$.$131$:$type must be boolean, but is $|Ny$|Ny
                                  • API String ID: 0-2705838571
                                  • Opcode ID: 970d7495ce5e7183850099c7c7e238d663871dd2b22c9f62ed301253becbe355
                                  • Instruction ID: ccce78d0e5c7c6bbb6e626dfaa132027ef16bf343f0f5970c0dd62d44db52ae5
                                  • Opcode Fuzzy Hash: 970d7495ce5e7183850099c7c7e238d663871dd2b22c9f62ed301253becbe355
                                  • Instruction Fuzzy Hash: C623BE70D002588FDB29DF68C858BEDBBB6EF05300F14819DE449AB392DB359A85CF95
                                  Strings
                                  • unordered_map/set too long, xrefs: 006D78C7
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID:
                                  • String ID: unordered_map/set too long
                                  • API String ID: 0-306623848
                                  • Opcode ID: 672ab6accc8b543953b88e16e7be94248224f42b2ec6020e2d798ed33474600e
                                  • Instruction ID: 80abd5362dcb06e26ef6d0c61a066c617d8d92215ffac7fb94bd340a7603dd2a
                                  • Opcode Fuzzy Hash: 672ab6accc8b543953b88e16e7be94248224f42b2ec6020e2d798ed33474600e
                                  • Instruction Fuzzy Hash: 99626375E046099FCB14DF68C88069DFBB6FF48310F24866AE819AB395E730ED51CB91
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
                                  • Instruction ID: 44cdc96652ee4aaff86904d06bb62eac9ce26abdd3268507188d13741d24f025
                                  • Opcode Fuzzy Hash: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
                                  • Instruction Fuzzy Hash: 6F024B71E00219DBDF54CFA8C8806AEFBF5FF48314F258269D919E7381DB35A9418B91
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID:
                                  • String ID: /Kim$/Kim$type must be number, but is $type must be string, but is
                                  • API String ID: 0-1144537432
                                  • Opcode ID: 2f35932d627d7810249d034e8ddf9262c3f5bfde46febbff959a7d24c0a08b35
                                  • Instruction ID: f86c3b1d90ba0f0d99b5245bd7247c785cb8684724f866c846ffe1de655b2fb9
                                  • Opcode Fuzzy Hash: 2f35932d627d7810249d034e8ddf9262c3f5bfde46febbff959a7d24c0a08b35
                                  • Instruction Fuzzy Hash: 88913A71E006089FCB08CF6CD8557DDBBAAEB88310F14826EE81AD7791E7799D05CB84
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID:
                                  • String ID: /$/\/$\
                                  • API String ID: 0-1523196992
                                  • Opcode ID: 89309097bdbaa7ea50148df00edab1657010fdebc1ce99e8b5130e5c71420afb
                                  • Instruction ID: 3d4912c1db68ae60d05a50d80a20bfe33f5f0940d1c62fa5ac7e70f8f958a4bd
                                  • Opcode Fuzzy Hash: 89309097bdbaa7ea50148df00edab1657010fdebc1ce99e8b5130e5c71420afb
                                  • Instruction Fuzzy Hash: 6A92E571D002499FDF19CFA8C8947EEBBBAEF45314F1442ADD845AB382E7315A46CB60
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID:
                                  • String ID: Ly$Ly
                                  • API String ID: 0-3580214937
                                  • Opcode ID: ee8a77dba6692929c6d5299f299a86099af97cb2e76cabd8b0ff328aa87cfffc
                                  • Instruction ID: 9e3b0d84c0b450af55212138e44bdd344155704c3bc5892c13e96aa5757c1a7c
                                  • Opcode Fuzzy Hash: ee8a77dba6692929c6d5299f299a86099af97cb2e76cabd8b0ff328aa87cfffc
                                  • Instruction Fuzzy Hash: C47104B4E009579FDB24CF68C8E1BFEBBB6EB1A300F044169D855E7742C7289906C7A4
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID:
                                  • String ID: File
                                  • API String ID: 0-749574446
                                  • Opcode ID: 151b0fd3bcd8bc3407a2bce97c4b3aa6a7af9e7e62e4b29fdce6e1605946ba58
                                  • Instruction ID: d57a591ac6cd46c03471cd0344b04c4e7aae02ca947780a1438270fdfe64043f
                                  • Opcode Fuzzy Hash: 151b0fd3bcd8bc3407a2bce97c4b3aa6a7af9e7e62e4b29fdce6e1605946ba58
                                  • Instruction Fuzzy Hash: 62C1A070D00259DEEF24DFA4DC89BEEBBBAEF05300F10406DE905AB282DB759945CB65
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID:
                                  • String ID: 0
                                  • API String ID: 0-4108050209
                                  • Opcode ID: 27a96bdb271f713a54386b53d44c1276f4ac72084652c4e8980b347f6e86fcf1
                                  • Instruction ID: 08c8597568fe12275b3798a60f2a775b87b0b25ae2efee73bed789f3bc4d361b
                                  • Opcode Fuzzy Hash: 27a96bdb271f713a54386b53d44c1276f4ac72084652c4e8980b347f6e86fcf1
                                  • Instruction Fuzzy Hash: 6DB1E07490164ACFDB66CF68C884ABAB7B1FF05300F244619D966A72A2D739EC49CF50
                                  APIs
                                  • GetSystemTimePreciseAsFileTime.KERNEL32(?,?,0073EC78,?,?,?,?,006740EB,?,006C3C2E), ref: 0073F283
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: Time$FilePreciseSystem
                                  • String ID:
                                  • API String ID: 1802150274-0
                                  • Opcode ID: d4435c7a3ca9ac868bafe16c3ab436576b5e7f93abc14c5b36183659fff3fb0e
                                  • Instruction ID: 3a38f9c8c9e86396ec43d8685d67e94fb7ae017105777ab0deea7f311bccd121
                                  • Opcode Fuzzy Hash: d4435c7a3ca9ac868bafe16c3ab436576b5e7f93abc14c5b36183659fff3fb0e
                                  • Instruction Fuzzy Hash: B2D02233A02238D38A112BE0BC048AEBB18AA0AB907008136E80593214CA595C008BC8
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 8dcc571f79b35ef6cd7f08b26c96ad0db8e33a125f218d9c6022d3c9f2b1f570
                                  • Instruction ID: 76413b926acdb1ffc65afe597c536cf8a8d895ee461e243a178a83726e10271a
                                  • Opcode Fuzzy Hash: 8dcc571f79b35ef6cd7f08b26c96ad0db8e33a125f218d9c6022d3c9f2b1f570
                                  • Instruction Fuzzy Hash: FA6272B0E013959FDB18CF9AC5846AEBBF2AF84304F2881ADD9049B346D735D946CF91
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: c46cfed599879c375c2c797383806fca9c83e9d6604b1bef404a39cc82ff05a2
                                  • Instruction ID: ca7f37eac12162a10251d0a9c788abd63d8ec83626679d2853cffc573daae264
                                  • Opcode Fuzzy Hash: c46cfed599879c375c2c797383806fca9c83e9d6604b1bef404a39cc82ff05a2
                                  • Instruction Fuzzy Hash: F1B1E6355007459BDB389B24CC96BFBB3A8EB44309F14853DED86C6584EBB9B989CB10
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: fb23b8ddaa471d251d08b6590ab980283731e32d47a4e3105af6b710b9890f3a
                                  • Instruction ID: 3add0e4de080667e3fb3d3714a84eef98c5924213f655ad4ac93746b6196c136
                                  • Opcode Fuzzy Hash: fb23b8ddaa471d251d08b6590ab980283731e32d47a4e3105af6b710b9890f3a
                                  • Instruction Fuzzy Hash: F5B13B31610608DFD715CF28C48ABA57BE0FF45365F29865CEA99CF2A1C379E985CB40
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: dc17075128a27b10b3ffac6d6e6daeb165f4f5d837751deddc5f0ade846d8e44
                                  • Instruction ID: 9645cdb875993d5c0a7bc9b50516a2f3902ae81a3bcd497e0a1db5179f58be60
                                  • Opcode Fuzzy Hash: dc17075128a27b10b3ffac6d6e6daeb165f4f5d837751deddc5f0ade846d8e44
                                  • Instruction Fuzzy Hash: 56618371710164CFD718CF1EECC45267352A78E389386822AEAC4D73A6C739F966C7A4
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 3dcc942d13e219507d254f669ef22d5292c4626908e3ffe0ed8eaab9a81111d5
                                  • Instruction ID: 64178cdce18b8182cde741d5f940ab639f30a74ebe6397acb8cc25fa467c1257
                                  • Opcode Fuzzy Hash: 3dcc942d13e219507d254f669ef22d5292c4626908e3ffe0ed8eaab9a81111d5
                                  • Instruction Fuzzy Hash: A88171B082439C9EDF18CF95D445AEEBFB9EF05304F50809ED452AB651D378520ACB66
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4135563814.0000000005130000.00000040.00001000.00020000.00000000.sdmp, Offset: 05130000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_5130000_LisectAVT_2403002A_228.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: dbcd339b71423bb4878a59a3a4d7b209a506ffaaa171e6143115522b1257148a
                                  • Instruction ID: 708072deef65c0e6132dac18aefb0a3863a115eed3fee7504a40c7c40fb8caa0
                                  • Opcode Fuzzy Hash: dbcd339b71423bb4878a59a3a4d7b209a506ffaaa171e6143115522b1257148a
                                  • Instruction Fuzzy Hash: 44318FEF14C214BDF22AC1412B7AAFA97EFE6CA7307328867F807D551AE3854A4D5031
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: a7df0d1ee623b98582a278c67bdfe5ccf561c0fef8c70a1484dbd265bbf7dd47
                                  • Instruction ID: 7d6a65f49f5ccb50ebb0a55e4f5122bc058fdef13adf4ada52ba571f33d826ef
                                  • Opcode Fuzzy Hash: a7df0d1ee623b98582a278c67bdfe5ccf561c0fef8c70a1484dbd265bbf7dd47
                                  • Instruction Fuzzy Hash: 9751AE71E002099FCB14DF98D885AEEBBB6FF48310F54856DE429A7341DB35AE44CBA4
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 920c44e739ca4d08db5b5969fbc7a5a158caad0a814d8dad7807257cb044add9
                                  • Instruction ID: a2527096350bd766bddc75a54a4e7f9389034632327bef679d52c1fbccb5a1ec
                                  • Opcode Fuzzy Hash: 920c44e739ca4d08db5b5969fbc7a5a158caad0a814d8dad7807257cb044add9
                                  • Instruction Fuzzy Hash: 9B519072E00219EFDF14CF98C941AEEBBB2FF89310F198458E915AB201D7389A50DB91
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                                  • Instruction ID: c7d805c1eeace01661115665858e54d265479593f5292e97be250404f6ceedcd
                                  • Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                                  • Instruction Fuzzy Hash: 44112BB7B4408243D6148A3DD8B46B7A395EFC93207ED437AF0428B75AD32AD9679D10
                                  APIs
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 006CF833
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 006CF855
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 006CF875
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 006CF89F
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 006CF90D
                                  • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 006CF959
                                  • std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 006CF973
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 006CFA08
                                  • std::_Facet_Register.LIBCPMT ref: 006CFA15
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
                                  • String ID: bad locale name$"x
                                  • API String ID: 3375549084-3017787300
                                  • Opcode ID: 4397eedbca1d9260b8e538af95577fef4480a908f106e802977e9f362727d48b
                                  • Instruction ID: 77e395a9f3a236bbc606c0fc4682dc2ffd9686bdaca01fdfa62aeb1e68878d5b
                                  • Opcode Fuzzy Hash: 4397eedbca1d9260b8e538af95577fef4480a908f106e802977e9f362727d48b
                                  • Instruction Fuzzy Hash: 01616CB1D00248DBEF20DFA4D889BAEBBB6EF14310F144169E815A7342DB78A905CB91
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 00663E7F
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: @3f$@3f$G>f$G>f$`!f$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                  • API String ID: 2659868963-894825180
                                  • Opcode ID: 369998465c4d1a8cc7736f7b58e6d8bbf80e3c7f29420f8fc7faa0e0e6760832
                                  • Instruction ID: 320c36b54b090b10a29e6031f889b452628063637cdefe86080acd69aa5da6ec
                                  • Opcode Fuzzy Hash: 369998465c4d1a8cc7736f7b58e6d8bbf80e3c7f29420f8fc7faa0e0e6760832
                                  • Instruction Fuzzy Hash: BF41D2B2900218AFCB04DF68D845BEEBBF9EF49310F14852EF915D7741E774AA118BA4
                                  APIs
                                  • _ValidateLocalCookies.LIBCMT ref: 00742E47
                                  • ___except_validate_context_record.LIBVCRUNTIME ref: 00742E4F
                                  • _ValidateLocalCookies.LIBCMT ref: 00742ED8
                                  • __IsNonwritableInCurrentImage.LIBCMT ref: 00742F03
                                  • _ValidateLocalCookies.LIBCMT ref: 00742F58
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                  • String ID: iy$csm
                                  • API String ID: 1170836740-1503127939
                                  • Opcode ID: e7afa8a886569c2e2a8fea078c934d148998f372dc0d6720f398279d6d30095b
                                  • Instruction ID: 56c2dc7abcb8535f9c6750c0a19d654dfcc65dd64dab95040d5a65e7eeba7a7f
                                  • Opcode Fuzzy Hash: e7afa8a886569c2e2a8fea078c934d148998f372dc0d6720f398279d6d30095b
                                  • Instruction Fuzzy Hash: DC41C730A00219EBCF10DF68D889A9EBBB5AF44314F548155F8189B353D73ADE66CB90
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 00663E7F
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: @3f$@3f$`!f$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                  • API String ID: 2659868963-1762149872
                                  • Opcode ID: 9fb90eeb6974f268d49e2bdfe2f7a1f5bbf58f9d5c3f6bb31686e8c633a69be6
                                  • Instruction ID: 51b85e3ac239f2ae03652da08bd240d2428622f0c663520eab430e633a2159af
                                  • Opcode Fuzzy Hash: 9fb90eeb6974f268d49e2bdfe2f7a1f5bbf58f9d5c3f6bb31686e8c633a69be6
                                  • Instruction Fuzzy Hash: CD2108B29007156FC714EF58D805B96B7D9AF04310F18883AFA6987742E775EA218BE1
                                  APIs
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 00664F72
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 00664FFF
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 006650C8
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_destroy$___std_exception_copy
                                  • String ID: @3f$`!f$recursive_directory_iterator::operator++
                                  • API String ID: 1206660477-3008882262
                                  • Opcode ID: d7729e0805e1cd0d40f4cc0ec177d391c5dcdf64f7f22f8f03b15b68b4ee7e17
                                  • Instruction ID: 16130382592a6580ef39a5e1df88a79b9e97abd588e622540aab377444b8f638
                                  • Opcode Fuzzy Hash: d7729e0805e1cd0d40f4cc0ec177d391c5dcdf64f7f22f8f03b15b68b4ee7e17
                                  • Instruction Fuzzy Hash: 4FE104B19006049FDB28DF68D845BAEF7FAFF44300F148A2DE45693B81DB75A904CBA5
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 0066799A
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 00667B75
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: `!f$`!f$out_of_range$type_error
                                  • API String ID: 2659868963-2465812000
                                  • Opcode ID: 3ae5a2597eef9a40229b0fcd6710ba98d337426617aeb9a3d31b9cbffc9641f9
                                  • Instruction ID: c32f8e34a05569827d8c099ab3513182cc0b56726d3086eec570abfc8710742c
                                  • Opcode Fuzzy Hash: 3ae5a2597eef9a40229b0fcd6710ba98d337426617aeb9a3d31b9cbffc9641f9
                                  • Instruction Fuzzy Hash: C0C149B1D002089FDB18CFA8D88479DBBF6FF48314F148669E419EB752E7789981CB54
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 006632C6
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 00663350
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy___std_exception_destroy
                                  • String ID: +4f$@3f$`!f$`!f
                                  • API String ID: 2970364248-2676833062
                                  • Opcode ID: 93e1f843086a9c41d0cd6aa4ab61881ec1b41e5bd63b910551a12e11e66eb1f2
                                  • Instruction ID: 87eaf995a0c427e6c2c447a3f482a028279f70e8538b24f3bafc78c5fb3a1442
                                  • Opcode Fuzzy Hash: 93e1f843086a9c41d0cd6aa4ab61881ec1b41e5bd63b910551a12e11e66eb1f2
                                  • Instruction Fuzzy Hash: 52518F719002589FDB08CF98D895BEEBBFAFF49300F14812EE815A7391D7749A41CB91
                                  APIs
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 00663A58
                                  • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00663AA4
                                  • __Getctype.LIBCPMT ref: 00663ABA
                                  • std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00663AE6
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 00663B7B
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
                                  • String ID: bad locale name
                                  • API String ID: 1840309910-1405518554
                                  • Opcode ID: efcf5b3b3d555b56e13ae064c4a28c6365c6f5a659f82e116b68e7fbbe684787
                                  • Instruction ID: 97159b7953f53380caaa4460ef3ae901a739fb60cf35f0395be0832169b06520
                                  • Opcode Fuzzy Hash: efcf5b3b3d555b56e13ae064c4a28c6365c6f5a659f82e116b68e7fbbe684787
                                  • Instruction Fuzzy Hash: EB5132B1D00258DBEF10DFA4D985BDEBBB9AF14310F144069E849AB382E779DA04CB61
                                  APIs
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 006CDE93
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 006CDEB6
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 006CDED6
                                  • std::_Facet_Register.LIBCPMT ref: 006CDF4B
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 006CDF63
                                  • Concurrency::cancel_current_task.LIBCPMT ref: 006CDF7B
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
                                  • String ID:
                                  • API String ID: 2081738530-0
                                  • Opcode ID: 5c248a3a78260ddbcfac89d18bad514499bd810e96f55620e22e8bde90022a5d
                                  • Instruction ID: ce762c1d8c957d2855da385ce0a0c07ffddd29ed07312c3afb756d330dc485f7
                                  • Opcode Fuzzy Hash: 5c248a3a78260ddbcfac89d18bad514499bd810e96f55620e22e8bde90022a5d
                                  • Instruction Fuzzy Hash: AD41CEB1900219DBCB24DF54D885BAEBBB5FB04720F14426DE8259B352D734AD01CBD5
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 00667340
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: `!f$`!f$parse error$parse_error
                                  • API String ID: 2659868963-584353518
                                  • Opcode ID: 403ec6b04ccbac44431bea8e22b6d6e936ecb98a957b1a0fd2f5eeacb4071ea9
                                  • Instruction ID: c8a1dafd9271a0b61ce485625b2cf07c075d8c9d79e3cf262102679418241785
                                  • Opcode Fuzzy Hash: 403ec6b04ccbac44431bea8e22b6d6e936ecb98a957b1a0fd2f5eeacb4071ea9
                                  • Instruction Fuzzy Hash: B9E15F709042489FDB18CF68C89479DBBB2BF49304F2482ADE419EB792D7749A81CF95
                                  APIs
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 006675BE
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 006675CD
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_destroy
                                  • String ID: at line $, column $`!f
                                  • API String ID: 4194217158-1819449957
                                  • Opcode ID: 7210caea310162375c77960381b8cce653ed08fbef21646031725b03972e44ad
                                  • Instruction ID: eaf085709aed2509e68456aed31151a4c04d8234c0f23dc1fc291b78a93d5c68
                                  • Opcode Fuzzy Hash: 7210caea310162375c77960381b8cce653ed08fbef21646031725b03972e44ad
                                  • Instruction Fuzzy Hash: EE612871A042049FDB08CF68DC88BADBBB6FF44304F24466CF416A7782DB74AA51CB95
                                  APIs
                                    • Part of subcall function 00663190: ___std_exception_copy.LIBVCRUNTIME ref: 006632C6
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 0066345F
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: +4f$@3f$@3f$`!f
                                  • API String ID: 2659868963-506372394
                                  • Opcode ID: 61e156b2d5306be1661e46d0f193363d525f431851e5a3036cce9bb7350f643c
                                  • Instruction ID: 8671e7033bdd2bbc369f861590dc340c20fff519456ce9642b941e838a7aead3
                                  • Opcode Fuzzy Hash: 61e156b2d5306be1661e46d0f193363d525f431851e5a3036cce9bb7350f643c
                                  • Instruction Fuzzy Hash: 8B3183B19002099FCB18DFA8D845A9DFBF9FF08310F10852AE515E7751E774AA50CBA5
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 0066345F
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: +4f$@3f$@3f$`!f
                                  • API String ID: 2659868963-506372394
                                  • Opcode ID: 73334d14d3c747d9ca0c1f6eb0ff4c27fcabc3e8afe4dfc63cbf6f15fd62489e
                                  • Instruction ID: 3a5d13ed8d8c6e166310b34afcafcca9939551f3adb8b5ef5aeb2dec38c1364f
                                  • Opcode Fuzzy Hash: 73334d14d3c747d9ca0c1f6eb0ff4c27fcabc3e8afe4dfc63cbf6f15fd62489e
                                  • Instruction Fuzzy Hash: 1D01FFB6500209AFC704DFA9E445C96FBFDBF49310740843AEA2A97711E7B4E524CBA4
                                  APIs
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 00666F11
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 00666F20
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_destroy
                                  • String ID: [json.exception.$`!f
                                  • API String ID: 4194217158-1755348418
                                  • Opcode ID: 5fa05a7ca1bc93ac98af6f96eadf68a4544ea157579b820edd1074dd32c84fbe
                                  • Instruction ID: 049d4f888b1c88889992dff279698877ea9fc510252901ab46e160e7d5ddeac5
                                  • Opcode Fuzzy Hash: 5fa05a7ca1bc93ac98af6f96eadf68a4544ea157579b820edd1074dd32c84fbe
                                  • Instruction Fuzzy Hash: 0591B470A002049FDB18CF68D984B9EBBF6FF45300F20866DF419AB792D775A941CB91
                                  APIs
                                  • std::_Xinvalid_argument.LIBCPMT ref: 00662275
                                    • Part of subcall function 0073D6E9: std::invalid_argument::invalid_argument.LIBCONCRT ref: 0073D6F5
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: Xinvalid_argumentstd::_std::invalid_argument::invalid_argument
                                  • String ID: string too long$Ly$Ly
                                  • API String ID: 1997705970-3208177595
                                  • Opcode ID: 749f7b4b71cd538df4d40f77eea0db4902642b43abf3f14df166b44c7fd736dd
                                  • Instruction ID: 85224480f71fde5ea2f3a0e912399aa25a4f28e15469b78413132aa8427566a1
                                  • Opcode Fuzzy Hash: 749f7b4b71cd538df4d40f77eea0db4902642b43abf3f14df166b44c7fd736dd
                                  • Instruction Fuzzy Hash: B9812675A046869FDB05CF68C460BEEBFF2EF5A300F1841AEC894A7742C7798546C7A0
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 006677B4
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: `!f$`!f$invalid_iterator
                                  • API String ID: 2659868963-1141855991
                                  • Opcode ID: 71ff0cf9798dbaa2c3ac4fe7988f03101f01666660614e13f3a4498e73ea20ba
                                  • Instruction ID: 164c2d1d96048f2335b7fa17fed365a7550f3a262c7218c45cdb37b0def62588
                                  • Opcode Fuzzy Hash: 71ff0cf9798dbaa2c3ac4fe7988f03101f01666660614e13f3a4498e73ea20ba
                                  • Instruction Fuzzy Hash: 6F5139B09002489FDB18CFA8D89479DFBF2FB48314F14866DE419EB752E7789980CB94
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 00667D67
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: `!f$`!f$other_error
                                  • API String ID: 2659868963-3990178052
                                  • Opcode ID: b29db21b0998f25e6dfb293927b4f777e66b930e531b8c5adb1ff9a79722c59f
                                  • Instruction ID: 2f7ce9bb08b524bc7439f3c03ddd68d9e52dc474ddea23e91442a73fc43306ca
                                  • Opcode Fuzzy Hash: b29db21b0998f25e6dfb293927b4f777e66b930e531b8c5adb1ff9a79722c59f
                                  • Instruction Fuzzy Hash: C3515CB0D002488FDB18CFA8D8847ADBBF2FF48304F248669E459EB752D7789981CB55
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 006CD06F
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 006CD096
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: `!f$`!f
                                  • API String ID: 2659868963-2207376674
                                  • Opcode ID: bf5bede58ee9f0301537d68714dde94c7d3dc11bd6d5d6e062eddca5f82d9ba3
                                  • Instruction ID: 4a4754b3506ca72f568a64690b5404401f52a96a0d57c271c89bbdd1b8611c16
                                  • Opcode Fuzzy Hash: bf5bede58ee9f0301537d68714dde94c7d3dc11bd6d5d6e062eddca5f82d9ba3
                                  • Instruction Fuzzy Hash: 2A01A8B6500605AF8704DF59D409882FBF8FB48710301853BE92AC7B11D7B4E528CFA0
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 006DB3DF
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 006DB406
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: `!f$`!f
                                  • API String ID: 2659868963-2207376674
                                  • Opcode ID: 3b8fc986330f9440f775df20662fb20d2ad23589f8c88a3ee4da2c8eecbe29f0
                                  • Instruction ID: 50fdf3dba2f747abe2c5011f02ad75e458b7653a9139386d1ae666768ed25172
                                  • Opcode Fuzzy Hash: 3b8fc986330f9440f775df20662fb20d2ad23589f8c88a3ee4da2c8eecbe29f0
                                  • Instruction Fuzzy Hash: 6CF0C9B6500605AF8704DF54E409886BBE8FB44710301853BE52ACBB11E7B4E524CFA4
                                  APIs
                                  • std::_Xinvalid_argument.LIBCPMT ref: 006DB612
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: Xinvalid_argumentstd::_
                                  • String ID: Pxm$invalid hash bucket count
                                  • API String ID: 909987262-1747986253
                                  • Opcode ID: c9aa73ec7033dbd1eb423bead37d9243106224b7c3463d961b5a1d54ae4257e0
                                  • Instruction ID: fe561c73fe0da1906f22cbbd223d8b932fda5e5c2f95bf044f8b8d0742895611
                                  • Opcode Fuzzy Hash: c9aa73ec7033dbd1eb423bead37d9243106224b7c3463d961b5a1d54ae4257e0
                                  • Instruction Fuzzy Hash: 7571E1B5A00605DFCB14CF49D180869FBF6FF89310725C5AAD8599B359D731EA42CF90
                                  APIs
                                  • Concurrency::cancel_current_task.LIBCPMT ref: 006DE491
                                  Strings
                                  • type must be boolean, but is , xrefs: 006DE582
                                  • type must be string, but is , xrefs: 006DE4F8
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: Concurrency::cancel_current_task
                                  • String ID: type must be boolean, but is $type must be string, but is
                                  • API String ID: 118556049-436076039
                                  • Opcode ID: 1eb23897b908e168d79d3607fe00b945f1a50f612181dd00cbc10341e7f65022
                                  • Instruction ID: 7ddf8f3d1d2e1a2bd103929b8815c3b1f3788593e1ef82955edcd49037a806ea
                                  • Opcode Fuzzy Hash: 1eb23897b908e168d79d3607fe00b945f1a50f612181dd00cbc10341e7f65022
                                  • Instruction Fuzzy Hash: E4417EB1D00248AFDB14FBA4D812FAE77AADB00310F14467DF419DB782EB3AA910C395
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 00663078
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.4129219697.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Offset: 00660000, based on PE: true
                                  • Associated: 00000000.00000002.4129153779.0000000000660000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129219697.0000000000793000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129423468.0000000000798000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A06000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4129455815.0000000000A54000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130021296.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.4130283659.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_660000_LisectAVT_2403002A_228.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: `!f$`!f
                                  • API String ID: 2659868963-2207376674
                                  • Opcode ID: e0cc09a460aede515c02d464330e08a63ee95165a5df9cd0c60ac7e2c85cf0e4
                                  • Instruction ID: 60439676527264f8e28e1c3ae8a60a40d90d8d2803c04cf111900cc83c3dca87
                                  • Opcode Fuzzy Hash: e0cc09a460aede515c02d464330e08a63ee95165a5df9cd0c60ac7e2c85cf0e4
                                  • Instruction Fuzzy Hash: 9FE012B29013089BC710DFA8E8059CAFFF8AB59701F0186BAE949D7301F7B4D9648BD5

                                  Execution Graph

                                  Execution Coverage:2.6%
                                  Dynamic/Decrypted Code Coverage:0.8%
                                  Signature Coverage:0%
                                  Total number of Nodes:612
                                  Total number of Limit Nodes:61
                                  execution_graph 20815 556059b 20816 55605ac GetCurrentHwProfileW 20815->20816 20818 5560831 20816->20818 19793 f3a40 19796 f3a55 19793->19796 19794 f3b28 GetPEB 19794->19796 19795 f3a73 GetPEB 19795->19796 19796->19794 19796->19795 19797 f3b9d Sleep 19796->19797 19798 f3ae8 Sleep 19796->19798 19799 f3bc7 19796->19799 19797->19796 19798->19796 19062 9a210 19095 16f290 19062->19095 19064 9a248 19100 92ae0 19064->19100 19066 9a28b 19116 175362 19066->19116 19070 9a377 19073 9a34e 19073->19070 19145 1747b0 19073->19145 19076 179136 4 API calls 19077 9a2fc 19076->19077 19082 9a318 19077->19082 19131 fcf60 19077->19131 19136 17dbdf 19082->19136 19097 921d0 Concurrency::cancel_current_task ___std_exception_copy std::_Facet_Register 19095->19097 19096 16f2af 19096->19064 19097->19096 19148 170651 19097->19148 19101 92ba5 19100->19101 19107 92af6 19100->19107 19366 92270 19101->19366 19102 92b02 std::locale::_Init 19102->19066 19104 92b2a 19108 16f290 std::_Facet_Register RtlAllocateHeap 19104->19108 19105 92baa 19376 921d0 19105->19376 19107->19102 19107->19104 19110 92b6e 19107->19110 19111 92b65 19107->19111 19109 92b3d 19108->19109 19112 1747b0 RtlAllocateHeap 19109->19112 19115 92b46 std::locale::_Init 19109->19115 19113 16f290 std::_Facet_Register RtlAllocateHeap 19110->19113 19110->19115 19111->19104 19111->19105 19114 92bb4 19112->19114 19113->19115 19115->19066 19389 1752a0 19116->19389 19118 9a2d7 19118->19073 19119 179136 19118->19119 19120 179149 __fread_nolock 19119->19120 19413 178e8d 19120->19413 19122 17915e 19123 1744dc __fread_nolock RtlAllocateHeap 19122->19123 19124 9a2ea 19123->19124 19125 174eeb 19124->19125 19126 174efe __fread_nolock 19125->19126 19546 174801 19126->19546 19128 174f0a 19129 1744dc __fread_nolock RtlAllocateHeap 19128->19129 19130 9a2f0 19129->19130 19130->19076 19132 fcfa7 19131->19132 19135 fcf78 __fread_nolock 19131->19135 19594 100560 19132->19594 19134 fcfba 19134->19082 19135->19082 19609 17dbfc 19136->19609 19138 9a348 19139 178be8 19138->19139 19140 178bfb __fread_nolock 19139->19140 19733 178ac3 19140->19733 19142 178c07 19143 1744dc __fread_nolock RtlAllocateHeap 19142->19143 19144 178c13 19143->19144 19144->19073 19146 1746ec __fread_nolock RtlAllocateHeap 19145->19146 19147 1747bf __Getctype 19146->19147 19149 17065e ___std_exception_copy 19148->19149 19153 92213 19148->19153 19152 17068b 19149->19152 19149->19153 19154 1856b8 19149->19154 19163 17d7d6 19152->19163 19153->19064 19155 1856c6 19154->19155 19156 1856d4 19154->19156 19155->19156 19161 1856ec 19155->19161 19166 17d23f 19156->19166 19158 1856dc 19169 1747a0 19158->19169 19160 1856e6 19160->19152 19161->19160 19162 17d23f __dosmaperr RtlAllocateHeap 19161->19162 19162->19158 19164 186db3 ___std_exception_destroy RtlAllocateHeap 19163->19164 19165 17d7ee 19164->19165 19165->19153 19172 185d2c 19166->19172 19277 1746ec 19169->19277 19173 185d35 __Getctype 19172->19173 19180 17d244 19173->19180 19183 1863f3 19173->19183 19175 185d79 __Getctype 19176 185db9 19175->19176 19177 185d81 __Getctype 19175->19177 19191 185a09 19176->19191 19187 186db3 19177->19187 19180->19158 19182 186db3 ___std_exception_destroy RtlAllocateHeap 19182->19180 19186 186400 __Getctype std::_Facet_Register 19183->19186 19184 18642b RtlAllocateHeap 19185 18643e __dosmaperr 19184->19185 19184->19186 19185->19175 19186->19184 19186->19185 19188 186dbe __dosmaperr 19187->19188 19190 186de8 19187->19190 19189 17d23f __dosmaperr RtlAllocateHeap 19188->19189 19188->19190 19189->19190 19190->19180 19192 185a77 __Getctype 19191->19192 19195 1859af 19192->19195 19194 185aa0 19194->19182 19196 1859bb __fread_nolock std::_Lockit::_Lockit 19195->19196 19199 185b90 19196->19199 19198 1859dd __Getctype 19198->19194 19200 185bc6 __Getctype 19199->19200 19201 185b9f __Getctype 19199->19201 19200->19198 19201->19200 19203 18f2a7 19201->19203 19204 18f327 19203->19204 19207 18f2bd 19203->19207 19206 186db3 ___std_exception_destroy RtlAllocateHeap 19204->19206 19230 18f375 19204->19230 19209 18f349 19206->19209 19207->19204 19208 18f2f0 19207->19208 19211 186db3 ___std_exception_destroy RtlAllocateHeap 19207->19211 19217 186db3 ___std_exception_destroy RtlAllocateHeap 19208->19217 19229 18f312 19208->19229 19210 186db3 ___std_exception_destroy RtlAllocateHeap 19209->19210 19212 18f35c 19210->19212 19216 18f2e5 19211->19216 19218 186db3 ___std_exception_destroy RtlAllocateHeap 19212->19218 19213 186db3 ___std_exception_destroy RtlAllocateHeap 19219 18f31c 19213->19219 19214 18f3e3 19221 186db3 ___std_exception_destroy RtlAllocateHeap 19214->19221 19215 18f383 19215->19214 19228 186db3 RtlAllocateHeap ___std_exception_destroy 19215->19228 19231 18e5ab 19216->19231 19223 18f307 19217->19223 19224 18f36a 19218->19224 19220 186db3 ___std_exception_destroy RtlAllocateHeap 19219->19220 19220->19204 19225 18f3e9 19221->19225 19259 18ea0a 19223->19259 19227 186db3 ___std_exception_destroy RtlAllocateHeap 19224->19227 19225->19200 19227->19230 19228->19215 19229->19213 19271 18f418 19230->19271 19232 18e5bc 19231->19232 19258 18e6a5 19231->19258 19233 18e5cd 19232->19233 19234 186db3 ___std_exception_destroy RtlAllocateHeap 19232->19234 19235 18e5df 19233->19235 19236 186db3 ___std_exception_destroy RtlAllocateHeap 19233->19236 19234->19233 19237 18e5f1 19235->19237 19238 186db3 ___std_exception_destroy RtlAllocateHeap 19235->19238 19236->19235 19239 18e603 19237->19239 19240 186db3 ___std_exception_destroy RtlAllocateHeap 19237->19240 19238->19237 19241 18e615 19239->19241 19242 186db3 ___std_exception_destroy RtlAllocateHeap 19239->19242 19240->19239 19243 186db3 ___std_exception_destroy RtlAllocateHeap 19241->19243 19247 18e627 19241->19247 19242->19241 19243->19247 19244 186db3 ___std_exception_destroy RtlAllocateHeap 19246 18e639 19244->19246 19245 18e64b 19249 18e65d 19245->19249 19250 186db3 ___std_exception_destroy RtlAllocateHeap 19245->19250 19246->19245 19248 186db3 ___std_exception_destroy RtlAllocateHeap 19246->19248 19247->19244 19247->19246 19248->19245 19251 18e66f 19249->19251 19252 186db3 ___std_exception_destroy RtlAllocateHeap 19249->19252 19250->19249 19253 18e681 19251->19253 19254 186db3 ___std_exception_destroy RtlAllocateHeap 19251->19254 19252->19251 19255 18e693 19253->19255 19256 186db3 ___std_exception_destroy RtlAllocateHeap 19253->19256 19254->19253 19257 186db3 ___std_exception_destroy RtlAllocateHeap 19255->19257 19255->19258 19256->19255 19257->19258 19258->19208 19260 18ea6f 19259->19260 19261 18ea17 19259->19261 19260->19229 19262 18ea27 19261->19262 19264 186db3 ___std_exception_destroy RtlAllocateHeap 19261->19264 19263 18ea39 19262->19263 19265 186db3 ___std_exception_destroy RtlAllocateHeap 19262->19265 19266 18ea4b 19263->19266 19267 186db3 ___std_exception_destroy RtlAllocateHeap 19263->19267 19264->19262 19265->19263 19268 18ea5d 19266->19268 19269 186db3 ___std_exception_destroy RtlAllocateHeap 19266->19269 19267->19266 19268->19260 19270 186db3 ___std_exception_destroy RtlAllocateHeap 19268->19270 19269->19268 19270->19260 19272 18f425 19271->19272 19273 18f444 19271->19273 19272->19273 19274 18ef31 __Getctype RtlAllocateHeap 19272->19274 19273->19215 19275 18f43e 19274->19275 19276 186db3 ___std_exception_destroy RtlAllocateHeap 19275->19276 19276->19273 19278 1746fe __fread_nolock 19277->19278 19283 174723 19278->19283 19280 174716 19290 1744dc 19280->19290 19284 174733 19283->19284 19287 17473a __fread_nolock __Getctype 19283->19287 19296 174541 19284->19296 19286 174748 19286->19280 19287->19286 19288 1746ec __fread_nolock RtlAllocateHeap 19287->19288 19289 1747ac 19288->19289 19289->19280 19291 1744e8 19290->19291 19292 1744ff 19291->19292 19311 174587 19291->19311 19294 174512 19292->19294 19295 174587 __fread_nolock RtlAllocateHeap 19292->19295 19294->19160 19295->19294 19297 174550 19296->19297 19300 185ddd 19297->19300 19301 185df0 __Getctype 19300->19301 19302 1863f3 __Getctype RtlAllocateHeap 19301->19302 19310 174572 19301->19310 19303 185e20 __Getctype 19302->19303 19304 185e5c 19303->19304 19305 185e28 __Getctype 19303->19305 19306 185a09 __Getctype RtlAllocateHeap 19304->19306 19307 186db3 ___std_exception_destroy RtlAllocateHeap 19305->19307 19308 185e67 19306->19308 19307->19310 19309 186db3 ___std_exception_destroy RtlAllocateHeap 19308->19309 19309->19310 19310->19287 19312 174591 19311->19312 19313 17459a 19311->19313 19314 174541 __fread_nolock RtlAllocateHeap 19312->19314 19313->19292 19315 174596 19314->19315 19315->19313 19318 180259 19315->19318 19319 18025e std::locale::_Setgloballocale 19318->19319 19323 180269 std::locale::_Setgloballocale 19319->19323 19324 18c7c6 19319->19324 19345 17f224 19323->19345 19328 18c7d2 __fread_nolock 19324->19328 19325 185d2c __dosmaperr RtlAllocateHeap 19331 18c803 std::locale::_Setgloballocale 19325->19331 19326 18c822 19327 17d23f __dosmaperr RtlAllocateHeap 19326->19327 19330 18c827 19327->19330 19328->19325 19328->19326 19328->19331 19333 18c834 std::_Lockit::_Lockit std::locale::_Setgloballocale 19328->19333 19329 18c80c 19329->19323 19332 1747a0 __fread_nolock RtlAllocateHeap 19330->19332 19331->19326 19331->19329 19331->19333 19332->19329 19334 18c9a4 std::_Lockit::~_Lockit 19333->19334 19335 18c8a7 19333->19335 19337 18c8d5 std::locale::_Setgloballocale 19333->19337 19336 17f224 std::locale::_Setgloballocale RtlAllocateHeap 19334->19336 19335->19337 19348 185bdb 19335->19348 19338 18c9b7 19336->19338 19337->19329 19340 185bdb __Getctype RtlAllocateHeap 19337->19340 19343 18c92a 19337->19343 19340->19343 19342 185bdb __Getctype RtlAllocateHeap 19342->19337 19343->19329 19344 185bdb __Getctype RtlAllocateHeap 19343->19344 19344->19329 19362 17f094 19345->19362 19347 17f235 19349 185be4 __Getctype 19348->19349 19350 1863f3 __Getctype RtlAllocateHeap 19349->19350 19352 185bfb 19349->19352 19353 185c28 __Getctype 19350->19353 19351 185c8b 19351->19342 19352->19351 19354 180259 __Getctype RtlAllocateHeap 19352->19354 19355 185c68 19353->19355 19356 185c30 __Getctype 19353->19356 19357 185c95 19354->19357 19359 185a09 __Getctype RtlAllocateHeap 19355->19359 19358 186db3 ___std_exception_destroy RtlAllocateHeap 19356->19358 19358->19352 19360 185c73 19359->19360 19361 186db3 ___std_exception_destroy RtlAllocateHeap 19360->19361 19361->19352 19363 17f0c1 std::locale::_Setgloballocale 19362->19363 19364 17ef23 std::locale::_Setgloballocale RtlAllocateHeap 19363->19364 19365 17f10a std::locale::_Setgloballocale 19364->19365 19365->19347 19380 16d6e9 19366->19380 19377 921de Concurrency::cancel_current_task 19376->19377 19378 170651 ___std_exception_copy RtlAllocateHeap 19377->19378 19379 92213 19378->19379 19379->19109 19383 16d4af 19380->19383 19382 16d6fa Concurrency::cancel_current_task 19386 93010 19383->19386 19387 170651 ___std_exception_copy RtlAllocateHeap 19386->19387 19388 9303d 19387->19388 19388->19382 19391 1752ac __fread_nolock 19389->19391 19390 1752b3 19392 17d23f __dosmaperr RtlAllocateHeap 19390->19392 19391->19390 19393 1752d3 19391->19393 19394 1752b8 19392->19394 19396 1752e5 19393->19396 19397 1752d8 19393->19397 19395 1747a0 __fread_nolock RtlAllocateHeap 19394->19395 19402 1752c3 19395->19402 19403 186688 19396->19403 19398 17d23f __dosmaperr RtlAllocateHeap 19397->19398 19398->19402 19400 1752ee 19401 17d23f __dosmaperr RtlAllocateHeap 19400->19401 19400->19402 19401->19402 19402->19118 19404 186694 __fread_nolock std::_Lockit::_Lockit 19403->19404 19407 18672c 19404->19407 19406 1866af 19406->19400 19408 18674f __fread_nolock 19407->19408 19409 1863f3 __Getctype RtlAllocateHeap 19408->19409 19412 186795 __fread_nolock 19408->19412 19410 1867b0 19409->19410 19411 186db3 ___std_exception_destroy RtlAllocateHeap 19410->19411 19411->19412 19412->19406 19415 178e99 __fread_nolock 19413->19415 19414 178e9f 19416 174723 __fread_nolock RtlAllocateHeap 19414->19416 19415->19414 19417 178ee2 __fread_nolock 19415->19417 19419 178eba 19416->19419 19420 179010 19417->19420 19419->19122 19421 179036 19420->19421 19422 179023 19420->19422 19429 178f37 19421->19429 19422->19419 19424 1790e7 19424->19419 19425 179059 19425->19424 19433 1755d3 19425->19433 19430 178f48 19429->19430 19432 178fa0 19429->19432 19430->19432 19442 17e13d 19430->19442 19432->19425 19434 1755ec 19433->19434 19438 175613 19433->19438 19434->19438 19469 185f82 19434->19469 19436 175608 19476 18538b 19436->19476 19439 17e17d 19438->19439 19440 17e05c __fread_nolock 2 API calls 19439->19440 19441 17e196 19440->19441 19441->19424 19443 17e151 __fread_nolock 19442->19443 19448 17e05c 19443->19448 19445 17e166 19446 1744dc __fread_nolock RtlAllocateHeap 19445->19446 19447 17e175 19446->19447 19447->19432 19453 18a6de 19448->19453 19450 17e06e 19451 17e08a SetFilePointerEx 19450->19451 19452 17e076 __fread_nolock 19450->19452 19451->19452 19452->19445 19454 18a6eb 19453->19454 19455 18a700 19453->19455 19466 17d22c 19454->19466 19457 17d22c __dosmaperr RtlAllocateHeap 19455->19457 19459 18a725 19455->19459 19460 18a730 19457->19460 19459->19450 19463 17d23f __dosmaperr RtlAllocateHeap 19460->19463 19461 17d23f __dosmaperr RtlAllocateHeap 19462 18a6f8 19461->19462 19462->19450 19464 18a738 19463->19464 19465 1747a0 __fread_nolock RtlAllocateHeap 19464->19465 19465->19462 19467 185d2c __dosmaperr RtlAllocateHeap 19466->19467 19468 17d231 19467->19468 19468->19461 19470 185f8e 19469->19470 19471 185fa3 19469->19471 19472 17d23f __dosmaperr RtlAllocateHeap 19470->19472 19471->19436 19473 185f93 19472->19473 19474 1747a0 __fread_nolock RtlAllocateHeap 19473->19474 19475 185f9e 19474->19475 19475->19436 19478 185397 __fread_nolock 19476->19478 19477 18539f 19477->19438 19478->19477 19479 1853d8 19478->19479 19481 18541e 19478->19481 19480 174723 __fread_nolock RtlAllocateHeap 19479->19480 19480->19477 19481->19477 19483 18549c 19481->19483 19484 1854c4 19483->19484 19496 1854e7 __fread_nolock 19483->19496 19485 1854c8 19484->19485 19487 185523 19484->19487 19486 174723 __fread_nolock RtlAllocateHeap 19485->19486 19486->19496 19488 185541 19487->19488 19489 17e17d 2 API calls 19487->19489 19497 184fe1 19488->19497 19489->19488 19492 185559 19492->19496 19502 184bb2 19492->19502 19493 1855a0 19494 185609 WriteFile 19493->19494 19493->19496 19494->19496 19496->19477 19508 190d44 19497->19508 19499 184ff3 19501 185021 19499->19501 19517 179d10 19499->19517 19501->19492 19501->19493 19503 184c1a 19502->19503 19504 179d10 std::_Locinfo::_Locinfo_dtor 2 API calls 19503->19504 19505 184c2b std::locale::_Init std::_Locinfo::_Locinfo_dtor 19503->19505 19504->19505 19506 1884be RtlAllocateHeap RtlAllocateHeap 19505->19506 19507 184ee1 _ValidateLocalCookies 19505->19507 19506->19505 19507->19496 19509 190d5e 19508->19509 19510 190d51 19508->19510 19513 190d6a 19509->19513 19514 17d23f __dosmaperr RtlAllocateHeap 19509->19514 19511 17d23f __dosmaperr RtlAllocateHeap 19510->19511 19512 190d56 19511->19512 19512->19499 19513->19499 19515 190d8b 19514->19515 19516 1747a0 __fread_nolock RtlAllocateHeap 19515->19516 19516->19512 19518 174587 __fread_nolock RtlAllocateHeap 19517->19518 19519 179d20 19518->19519 19524 185ef3 19519->19524 19525 185f0a 19524->19525 19526 179d3d 19524->19526 19525->19526 19532 18f4f3 19525->19532 19528 185f51 19526->19528 19529 179d4a 19528->19529 19530 185f68 19528->19530 19529->19501 19530->19529 19541 18d81e 19530->19541 19533 18f4ff __fread_nolock 19532->19533 19534 185bdb __Getctype RtlAllocateHeap 19533->19534 19535 18f508 std::_Lockit::_Lockit 19534->19535 19536 18f574 __Getctype RtlAllocateHeap 19535->19536 19538 18f54e 19535->19538 19537 18f537 __Getctype 19536->19537 19537->19538 19539 180259 __Getctype RtlAllocateHeap 19537->19539 19538->19526 19540 18f573 19539->19540 19542 185bdb __Getctype RtlAllocateHeap 19541->19542 19543 18d823 19542->19543 19544 18d736 std::_Locinfo::_Locinfo_dtor RtlAllocateHeap RtlAllocateHeap 19543->19544 19545 18d82e 19544->19545 19545->19529 19547 17480d __fread_nolock 19546->19547 19548 174835 __fread_nolock 19547->19548 19549 174814 19547->19549 19553 174910 19548->19553 19550 174723 __fread_nolock RtlAllocateHeap 19549->19550 19552 17482d 19550->19552 19552->19128 19556 174942 19553->19556 19555 174922 19555->19552 19557 174951 19556->19557 19558 174979 19556->19558 19559 174723 __fread_nolock RtlAllocateHeap 19557->19559 19560 185f82 __fread_nolock RtlAllocateHeap 19558->19560 19568 17496c __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 19559->19568 19561 174982 19560->19561 19569 17e11f 19561->19569 19564 174a2c 19572 174cae 19564->19572 19566 174a43 19566->19568 19580 174ae3 19566->19580 19568->19555 19587 17df37 19569->19587 19571 1749a0 19571->19564 19571->19566 19571->19568 19573 174cbd 19572->19573 19574 185f82 __fread_nolock RtlAllocateHeap 19573->19574 19575 174cd9 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 19574->19575 19576 17e11f 2 API calls 19575->19576 19579 174ce5 _ValidateLocalCookies 19575->19579 19577 174d39 19576->19577 19578 17e11f 2 API calls 19577->19578 19577->19579 19578->19579 19579->19568 19581 185f82 __fread_nolock RtlAllocateHeap 19580->19581 19582 174af6 19581->19582 19583 17e11f 2 API calls 19582->19583 19586 174b40 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 19582->19586 19584 174b9d 19583->19584 19585 17e11f 2 API calls 19584->19585 19584->19586 19585->19586 19586->19568 19588 17df43 __fread_nolock 19587->19588 19589 17df86 19588->19589 19591 17dfcc 19588->19591 19593 17df4b 19588->19593 19590 174723 __fread_nolock RtlAllocateHeap 19589->19590 19590->19593 19592 17e05c __fread_nolock 2 API calls 19591->19592 19591->19593 19592->19593 19593->19571 19595 1006a9 19594->19595 19599 100585 19594->19599 19596 92270 RtlAllocateHeap 19595->19596 19597 1006ae 19596->19597 19598 921d0 Concurrency::cancel_current_task RtlAllocateHeap 19597->19598 19607 1005aa __fread_nolock std::locale::_Init 19598->19607 19601 1005f0 19599->19601 19602 1005e3 19599->19602 19604 10059a 19599->19604 19600 16f290 std::_Facet_Register RtlAllocateHeap 19600->19607 19605 16f290 std::_Facet_Register RtlAllocateHeap 19601->19605 19601->19607 19602->19597 19602->19604 19603 1747b0 RtlAllocateHeap 19606 1006b8 19603->19606 19604->19600 19605->19607 19607->19603 19608 100667 __fread_nolock std::locale::_Init 19607->19608 19608->19134 19611 17dc08 __fread_nolock 19609->19611 19610 17dc40 __fread_nolock 19610->19138 19611->19610 19613 17dc52 __fread_nolock 19611->19613 19615 17dc1b __fread_nolock 19611->19615 19612 17d23f __dosmaperr RtlAllocateHeap 19616 17dc35 19612->19616 19618 17da06 19613->19618 19615->19612 19617 1747a0 __fread_nolock RtlAllocateHeap 19616->19617 19617->19610 19622 17da18 __fread_nolock 19618->19622 19624 17da35 19618->19624 19619 17da25 19620 17d23f __dosmaperr RtlAllocateHeap 19619->19620 19621 17da2a 19620->19621 19623 1747a0 __fread_nolock RtlAllocateHeap 19621->19623 19622->19619 19622->19624 19629 17da76 __fread_nolock 19622->19629 19623->19624 19624->19610 19625 17dba1 __fread_nolock 19627 17d23f __dosmaperr RtlAllocateHeap 19625->19627 19627->19621 19628 185f82 __fread_nolock RtlAllocateHeap 19628->19629 19629->19624 19629->19625 19629->19628 19631 184623 19629->19631 19690 178a2b 19629->19690 19632 18464d 19631->19632 19633 184635 19631->19633 19635 18498f 19632->19635 19640 184690 19632->19640 19634 17d22c __dosmaperr RtlAllocateHeap 19633->19634 19637 18463a 19634->19637 19636 17d22c __dosmaperr RtlAllocateHeap 19635->19636 19638 184994 19636->19638 19639 17d23f __dosmaperr RtlAllocateHeap 19637->19639 19641 17d23f __dosmaperr RtlAllocateHeap 19638->19641 19642 184642 19639->19642 19640->19642 19643 18469b 19640->19643 19649 1846cb 19640->19649 19645 1846a8 19641->19645 19642->19629 19644 17d22c __dosmaperr RtlAllocateHeap 19643->19644 19646 1846a0 19644->19646 19648 1747a0 __fread_nolock RtlAllocateHeap 19645->19648 19647 17d23f __dosmaperr RtlAllocateHeap 19646->19647 19647->19645 19648->19642 19650 1846e4 19649->19650 19651 18471f 19649->19651 19652 1846f1 19649->19652 19650->19652 19675 18470d 19650->19675 19704 186e2d 19651->19704 19653 17d22c __dosmaperr RtlAllocateHeap 19652->19653 19655 1846f6 19653->19655 19657 17d23f __dosmaperr RtlAllocateHeap 19655->19657 19660 1846fd 19657->19660 19658 190d44 __fread_nolock RtlAllocateHeap 19663 18486b 19658->19663 19659 186db3 ___std_exception_destroy RtlAllocateHeap 19661 184739 19659->19661 19662 1747a0 __fread_nolock RtlAllocateHeap 19660->19662 19665 186db3 ___std_exception_destroy RtlAllocateHeap 19661->19665 19689 184708 __fread_nolock 19662->19689 19664 1848e3 ReadFile 19663->19664 19676 18489b 19663->19676 19666 1848fb 19664->19666 19667 184957 19664->19667 19668 184740 19665->19668 19666->19667 19669 1848d4 19666->19669 19677 184964 19667->19677 19687 1848b5 19667->19687 19670 18474a 19668->19670 19671 184765 19668->19671 19680 184920 19669->19680 19681 184937 19669->19681 19669->19689 19674 17d23f __dosmaperr RtlAllocateHeap 19670->19674 19673 17e13d __fread_nolock 2 API calls 19671->19673 19672 186db3 ___std_exception_destroy RtlAllocateHeap 19672->19642 19673->19675 19678 18474f 19674->19678 19675->19658 19676->19669 19676->19687 19679 17d23f __dosmaperr RtlAllocateHeap 19677->19679 19682 17d22c __dosmaperr RtlAllocateHeap 19678->19682 19683 184969 19679->19683 19715 184335 19680->19715 19681->19689 19725 18417b 19681->19725 19682->19689 19688 17d22c __dosmaperr RtlAllocateHeap 19683->19688 19687->19689 19710 17d1e5 19687->19710 19688->19689 19689->19672 19691 178a3c 19690->19691 19694 178a38 std::locale::_Init 19690->19694 19692 178a43 19691->19692 19696 178a56 __fread_nolock 19691->19696 19693 17d23f __dosmaperr RtlAllocateHeap 19692->19693 19695 178a48 19693->19695 19694->19629 19697 1747a0 __fread_nolock RtlAllocateHeap 19695->19697 19696->19694 19698 178a84 19696->19698 19699 178a8d 19696->19699 19697->19694 19700 17d23f __dosmaperr RtlAllocateHeap 19698->19700 19699->19694 19701 17d23f __dosmaperr RtlAllocateHeap 19699->19701 19702 178a89 19700->19702 19701->19702 19703 1747a0 __fread_nolock RtlAllocateHeap 19702->19703 19703->19694 19705 186e6b 19704->19705 19709 186e3b __Getctype std::_Facet_Register 19704->19709 19706 17d23f __dosmaperr RtlAllocateHeap 19705->19706 19708 184730 19706->19708 19707 186e56 RtlAllocateHeap 19707->19708 19707->19709 19708->19659 19709->19705 19709->19707 19711 17d22c __dosmaperr RtlAllocateHeap 19710->19711 19712 17d1f0 __dosmaperr 19711->19712 19713 17d23f __dosmaperr RtlAllocateHeap 19712->19713 19714 17d203 19713->19714 19714->19689 19729 18402e 19715->19729 19718 1843d7 19722 17e13d __fread_nolock 2 API calls 19718->19722 19723 184391 __fread_nolock 19718->19723 19719 1843c7 19720 17d23f __dosmaperr RtlAllocateHeap 19719->19720 19721 18437d 19720->19721 19721->19689 19722->19723 19723->19721 19724 17d1e5 __dosmaperr RtlAllocateHeap 19723->19724 19724->19721 19727 1841b5 19725->19727 19726 184246 19726->19689 19727->19726 19728 17e13d __fread_nolock 2 API calls 19727->19728 19728->19726 19730 184062 19729->19730 19731 1840ce 19730->19731 19732 17e13d __fread_nolock 2 API calls 19730->19732 19731->19718 19731->19719 19731->19721 19731->19723 19732->19731 19734 178acf __fread_nolock 19733->19734 19735 178ad9 19734->19735 19738 178afc __fread_nolock 19734->19738 19736 174723 __fread_nolock RtlAllocateHeap 19735->19736 19737 178af4 19736->19737 19737->19142 19738->19737 19740 178b5a 19738->19740 19741 178b67 19740->19741 19742 178b8a 19740->19742 19743 174723 __fread_nolock RtlAllocateHeap 19741->19743 19744 1755d3 4 API calls 19742->19744 19752 178b82 19742->19752 19743->19752 19745 178ba2 19744->19745 19754 186ded 19745->19754 19748 185f82 __fread_nolock RtlAllocateHeap 19749 178bb6 19748->19749 19758 184a3f 19749->19758 19752->19737 19753 186db3 ___std_exception_destroy RtlAllocateHeap 19753->19752 19755 178baa 19754->19755 19756 186e04 19754->19756 19755->19748 19756->19755 19757 186db3 ___std_exception_destroy RtlAllocateHeap 19756->19757 19757->19755 19760 178bbd 19758->19760 19761 184a68 19758->19761 19759 184ab7 19762 174723 __fread_nolock RtlAllocateHeap 19759->19762 19760->19752 19760->19753 19761->19759 19763 184a8f 19761->19763 19762->19760 19765 1849ae 19763->19765 19766 1849ba __fread_nolock 19765->19766 19768 1849f9 19766->19768 19769 184b12 19766->19769 19768->19760 19770 18a6de __fread_nolock RtlAllocateHeap 19769->19770 19773 184b22 19770->19773 19771 184b28 19781 18a64d 19771->19781 19773->19771 19774 184b5a 19773->19774 19776 18a6de __fread_nolock RtlAllocateHeap 19773->19776 19774->19771 19775 18a6de __fread_nolock RtlAllocateHeap 19774->19775 19777 184b66 FindCloseChangeNotification 19775->19777 19778 184b51 19776->19778 19777->19771 19779 18a6de __fread_nolock RtlAllocateHeap 19778->19779 19779->19774 19780 184b80 __fread_nolock 19780->19768 19782 18a65c 19781->19782 19783 17d23f __dosmaperr RtlAllocateHeap 19782->19783 19786 18a686 19782->19786 19784 18a6c8 19783->19784 19785 17d22c __dosmaperr RtlAllocateHeap 19784->19785 19785->19786 19786->19780 19800 5560809 GetCurrentHwProfileW 19801 5560831 19800->19801 19787 ae0a0 WSAStartup 19788 ae0d8 19787->19788 19792 ae1a7 19787->19792 19789 ae175 socket 19788->19789 19788->19792 19790 ae18b connect 19789->19790 19789->19792 19791 ae19d closesocket 19790->19791 19790->19792 19791->19789 19791->19792

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 151 f3a40-f3a52 152 f3a55-f3a61 151->152 154 f3b28-f3b31 GetPEB 152->154 155 f3a67-f3a6d 152->155 157 f3b34-f3b48 154->157 155->154 156 f3a73-f3a7f GetPEB 155->156 160 f3a80-f3a94 156->160 158 f3b4a-f3b4f 157->158 159 f3b99-f3b9b 157->159 158->159 161 f3b51-f3b59 158->161 159->157 162 f3a96-f3a9b 160->162 163 f3ae4-f3ae6 160->163 164 f3b60-f3b73 161->164 162->163 165 f3a9d-f3aa3 162->165 163->160 166 f3b75-f3b88 164->166 167 f3b92-f3b97 164->167 168 f3aa5-f3ab8 165->168 166->166 169 f3b8a-f3b90 166->169 167->159 167->164 170 f3add-f3ae2 168->170 171 f3aba 168->171 169->167 172 f3b9d-f3bc2 Sleep 169->172 170->163 170->168 173 f3ac0-f3ad3 171->173 172->152 173->173 174 f3ad5-f3adb 173->174 174->170 175 f3ae8-f3b0d Sleep 174->175 176 f3b13-f3b1a 175->176 176->154 177 f3b1c-f3b22 176->177 177->154 178 f3bc7-f3bd8 call 96bd0 177->178 181 f3bde 178->181 182 f3bda-f3bdc 178->182 183 f3be0-f3bfd call 96bd0 181->183 182->183
                                  APIs
                                  • Sleep.KERNELBASE(000003E9,?,00000001,00000000,?,?,?,?,?,?,?,?,000F3DB6), ref: 000F3B08
                                  • Sleep.KERNELBASE(00000001,?,00000001,00000000,?,?,?,?,?,?,?,?,000F3DB6), ref: 000F3BBA
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000005.00000002.4129149941.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129247202.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129552206.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130398355.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130736549.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: Sleep
                                  • String ID:
                                  • API String ID: 3472027048-0
                                  • Opcode ID: f219dae2e6c8b0f2b98327ddcd71d2fad512c10ac4dae119ae4fe311b8b8a247
                                  • Instruction ID: b3e39cc548b63e73fb1b36480fd3abfa39784650e7bc013b68c707b37e66a860
                                  • Opcode Fuzzy Hash: f219dae2e6c8b0f2b98327ddcd71d2fad512c10ac4dae119ae4fe311b8b8a247
                                  • Instruction Fuzzy Hash: 3151C835A042199FCB24CF48C8E0EBAB3F1FF45724B28449AD645ABB52D731EE45DB80

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 0 ae0a0-ae0d2 WSAStartup 1 ae0d8-ae102 call 96bd0 * 2 0->1 2 ae1b7-ae1c0 0->2 7 ae10e-ae165 1->7 8 ae104-ae108 1->8 10 ae1b1-ae1b6 7->10 11 ae167-ae16d 7->11 8->2 8->7 10->2 12 ae16f 11->12 13 ae1c5-ae1cf 11->13 14 ae175-ae189 socket 12->14 13->10 20 ae1d1-ae1d9 13->20 14->10 16 ae18b-ae19b connect 14->16 18 ae19d-ae1a5 closesocket 16->18 19 ae1c1 16->19 18->14 21 ae1a7-ae1ab 18->21 19->13 21->10
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000005.00000002.4129149941.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129247202.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129552206.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130398355.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130736549.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: Startupclosesocketconnectsocket
                                  • String ID:
                                  • API String ID: 3098855095-0
                                  • Opcode ID: bd064e6b59ae72d2492c865ed5204ba742d4cdfbebd424a64dcd73f10acf90cf
                                  • Instruction ID: ae71126c9b29429cecfa57858da9ba01f4d22369f7c75808555861bc06546652
                                  • Opcode Fuzzy Hash: bd064e6b59ae72d2492c865ed5204ba742d4cdfbebd424a64dcd73f10acf90cf
                                  • Instruction Fuzzy Hash: C031C4712053106BD7209F65CC44B6BB7E4EBC6774F104F1DF9A8A62D0D37599048BA2

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 22 16f290-16f293 23 16f2a2-16f2a5 call 17df2c 22->23 25 16f2aa-16f2ad 23->25 26 16f295-16f2a0 call 1817d8 25->26 27 16f2af-16f2b0 25->27 26->23 30 16f2b1-16f2b5 26->30 31 921d0-92220 call 921b0 call 170efb call 170651 30->31 32 16f2bb 30->32 32->32
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 0009220E
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000005.00000002.4129149941.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129247202.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129552206.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130398355.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130736549.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: `!$`!
                                  • API String ID: 2659868963-1174305143
                                  • Opcode ID: 8aed841b473b68f9eb65007730c7a68ac4ce50a3379f920c45c457fb712e03d7
                                  • Instruction ID: f63029ce59ff315aed0f986e4315aafc3869fedc89a889a500b891b6c5183d56
                                  • Opcode Fuzzy Hash: 8aed841b473b68f9eb65007730c7a68ac4ce50a3379f920c45c457fb712e03d7
                                  • Instruction Fuzzy Hash: F601F27650030DBBCB18AFA9EC0299977AC9B10320B50843DFA18DB691EB30E9658B91

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 39 184623-184633 40 18464d-18464f 39->40 41 184635-184648 call 17d22c call 17d23f 39->41 43 18498f-18499c call 17d22c call 17d23f 40->43 44 184655-18465b 40->44 59 1849a7 41->59 62 1849a2 call 1747a0 43->62 44->43 47 184661-18468a 44->47 47->43 50 184690-184699 47->50 53 18469b-1846ae call 17d22c call 17d23f 50->53 54 1846b3-1846b5 50->54 53->62 57 18498b-18498d 54->57 58 1846bb-1846bf 54->58 60 1849aa-1849ad 57->60 58->57 63 1846c5-1846c9 58->63 59->60 62->59 63->53 66 1846cb-1846e2 63->66 68 1846e4-1846e7 66->68 69 184717-18471d 66->69 72 1846e9-1846ef 68->72 73 18470d-184715 68->73 70 18471f-184726 69->70 71 1846f1-184708 call 17d22c call 17d23f call 1747a0 69->71 75 184728 70->75 76 18472a-18472b call 186e2d 70->76 100 1848c2 71->100 72->71 72->73 74 18478a-1847a9 73->74 78 1847af-1847bb 74->78 79 184865-18486e call 190d44 74->79 75->76 83 184730-184748 call 186db3 * 2 76->83 78->79 82 1847c1-1847c3 78->82 90 1848df 79->90 91 184870-184882 79->91 82->79 87 1847c9-1847ea 82->87 109 18474a-184760 call 17d23f call 17d22c 83->109 110 184765-184788 call 17e13d 83->110 87->79 92 1847ec-184802 87->92 97 1848e3-1848f9 ReadFile 90->97 91->90 96 184884-184893 91->96 92->79 98 184804-184806 92->98 96->90 113 184895-184899 96->113 101 1848fb-184901 97->101 102 184957-184962 97->102 98->79 103 184808-18482b 98->103 105 1848c5-1848cf call 186db3 100->105 101->102 107 184903 101->107 121 18497b-18497e 102->121 122 184964-184976 call 17d23f call 17d22c 102->122 103->79 108 18482d-184843 103->108 105->60 115 184906-184918 107->115 108->79 116 184845-184847 108->116 109->100 110->74 113->97 120 18489b-1848b3 113->120 115->105 123 18491a-18491e 115->123 116->79 124 184849-184860 116->124 141 1848d4-1848dd 120->141 142 1848b5-1848ba 120->142 129 1848bb-1848c1 call 17d1e5 121->129 130 184984-184986 121->130 122->100 127 184920-184930 call 184335 123->127 128 184937-184944 123->128 124->79 149 184933-184935 127->149 137 184950-184955 call 18417b 128->137 138 184946 call 18448c 128->138 129->100 130->105 146 18494b-18494e 137->146 138->146 141->115 142->129 146->149 149->105
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000005.00000002.4129149941.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129247202.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129552206.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130398355.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130736549.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: f4189a1843ddcb18fa91d2d61c7cbc4d402d0da8b0fc2c5c6809ea4f8ccf1cea
                                  • Instruction ID: 8b26312458cc7fc49e7d5d69ee179ade576958be4af9200aa931068dc77834c9
                                  • Opcode Fuzzy Hash: f4189a1843ddcb18fa91d2d61c7cbc4d402d0da8b0fc2c5c6809ea4f8ccf1cea
                                  • Instruction Fuzzy Hash: 95B1E670E0428AAFDF15EFA8D841BBEBBB1AF5A314F144159E44497292CF719E42CF50

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 186 55605e4-55605f0 187 55605f2-5560653 186->187 188 5560669-556066a 186->188 189 556066b-5560803 187->189 188->189 210 556080f-556081a GetCurrentHwProfileW 189->210 211 5560831-55609e1 call 55609e3 210->211
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4136334455.0000000005560000.00000040.00001000.00020000.00000000.sdmp, Offset: 05560000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_5560000_MPGPH131.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 9e4213f549673fb68b1deaa2aed35726a9ce040a60839f94da7e7081b34fab3e
                                  • Instruction ID: c25afe5ab3e39d2fa87d8b9eefd20ed96fc6e0437c770eec05a4a17999320991
                                  • Opcode Fuzzy Hash: 9e4213f549673fb68b1deaa2aed35726a9ce040a60839f94da7e7081b34fab3e
                                  • Instruction Fuzzy Hash: 4351B3EB64D191BD7102C1422F68EFB676FF6D6730330882BF407C7592E6984E8A51B2

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 231 5560658-5560663 232 5560665-5560666 231->232 233 5560628-5560653 231->233 234 5560626 232->234 235 5560668-556066a 232->235 239 556066b-5560803 233->239 234->233 235->239 254 556080f-556081a GetCurrentHwProfileW 239->254 255 5560831-55609e1 call 55609e3 254->255
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 05560813
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4136334455.0000000005560000.00000040.00001000.00020000.00000000.sdmp, Offset: 05560000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_5560000_MPGPH131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: 575b7574f4d80fd7b4e39822e6d3ab7b6af09ad91af73bd56f8a95c95e2e673e
                                  • Instruction ID: 66c40f1923d687bc85e6c9368ff9c09721ebc267f7230c73b567ad04b7f6cb68
                                  • Opcode Fuzzy Hash: 575b7574f4d80fd7b4e39822e6d3ab7b6af09ad91af73bd56f8a95c95e2e673e
                                  • Instruction Fuzzy Hash: F2519CEB64D1A5BC7512C0822F68AFB176FF2C67703308827F407C7592E6C84E8A51B2

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 275 556068a-5560803 287 556080f-556081a GetCurrentHwProfileW 275->287 288 5560831-55609e1 call 55609e3 287->288
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 05560813
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4136334455.0000000005560000.00000040.00001000.00020000.00000000.sdmp, Offset: 05560000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_5560000_MPGPH131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: 57dc4235a79af62dca3bedfd70af74602f826ead67381398c34104925a9d568c
                                  • Instruction ID: 51274c74405a9de25260a946aa6875ecf22dcc27820832f0018c76365cc26ab6
                                  • Opcode Fuzzy Hash: 57dc4235a79af62dca3bedfd70af74602f826ead67381398c34104925a9d568c
                                  • Instruction Fuzzy Hash: 0951BFEB64D295BDB202C0422F68AFB176FE6C6730730883BF407C7592E2844E8A51B1

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 308 55606f0-5560803 318 556080f-556081a GetCurrentHwProfileW 308->318 319 5560831-55609e1 call 55609e3 318->319
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4136334455.0000000005560000.00000040.00001000.00020000.00000000.sdmp, Offset: 05560000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_5560000_MPGPH131.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 745474414f9d7c4168189a7c1f34f211bedcc06254b6feec619d51ac13b064e5
                                  • Instruction ID: d32ca8df40edd84c25553d164eaf587355c17c4620d117c59e3264af84cf9ac6
                                  • Opcode Fuzzy Hash: 745474414f9d7c4168189a7c1f34f211bedcc06254b6feec619d51ac13b064e5
                                  • Instruction Fuzzy Hash: 10419CEB24C295BC7202C5426F68AFB176FF6C6730330882BF407C7192E3944E8A55B1

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 339 55606bf-5560803 351 556080f-556081a GetCurrentHwProfileW 339->351 352 5560831-55609e1 call 55609e3 351->352
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 05560813
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4136334455.0000000005560000.00000040.00001000.00020000.00000000.sdmp, Offset: 05560000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_5560000_MPGPH131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: 708092ee8a8dac674a2d1e0c384a333d0206d75d93ce9b40f78fd1485cb4fc89
                                  • Instruction ID: ff2a85a73cb88ae6967a9e95413cb2e0c38406665172deec20f7b477304aadc5
                                  • Opcode Fuzzy Hash: 708092ee8a8dac674a2d1e0c384a333d0206d75d93ce9b40f78fd1485cb4fc89
                                  • Instruction Fuzzy Hash: F5416DEB64D195BC7152C0822F68AFB176FE6D6B30730C82BF407C7192E2844E8A55B1

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 372 9a210-9a2ab call 16f290 call 92ae0 377 9a2b0-9a2bb 372->377 377->377 378 9a2bd-9a2c8 377->378 379 9a2ca 378->379 380 9a2cd-9a2de call 175362 378->380 379->380 383 9a351-9a357 380->383 384 9a2e0-9a305 call 179136 call 174eeb call 179136 380->384 386 9a359-9a365 383->386 387 9a381-9a393 383->387 402 9a30c-9a316 384->402 403 9a307 384->403 389 9a377-9a37e call 16f511 386->389 390 9a367-9a375 386->390 389->387 390->389 392 9a394-9a3ae call 1747b0 390->392 399 9a3b0-9a3bb 392->399 399->399 401 9a3bd-9a3c8 399->401 404 9a3ca 401->404 405 9a3cd-9a3df call 175362 401->405 406 9a328-9a32f call fcf60 402->406 407 9a318-9a31c 402->407 403->402 404->405 416 9a3fc-9a403 405->416 417 9a3e1-9a3f9 call 179136 call 174eeb call 178be8 405->417 412 9a334-9a33a 406->412 409 9a31e 407->409 410 9a320-9a326 407->410 409->410 410->412 414 9a33c 412->414 415 9a33e-9a349 call 17dbdf call 178be8 412->415 414->415 432 9a34e 415->432 420 9a42d-9a433 416->420 421 9a405-9a411 416->421 417->416 422 9a423-9a42a call 16f511 421->422 423 9a413-9a421 421->423 422->420 423->422 426 9a434-9a45e call 1747b0 423->426 439 9a46f-9a474 426->439 440 9a460-9a464 426->440 432->383 440->439 441 9a466-9a46e 440->441
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000005.00000002.4129149941.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129247202.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129552206.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130398355.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130736549.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: __fread_nolock
                                  • String ID:
                                  • API String ID: 2638373210-0
                                  • Opcode ID: 2d8bcc78023e3bf4ce219dbd24609c3c419d8000900797bcdbdb629a0bafd460
                                  • Instruction ID: af96c772d48f60447da91faf72e932bdb82a1ef6129dbc2ab01bbdf7dc5fbc8f
                                  • Opcode Fuzzy Hash: 2d8bcc78023e3bf4ce219dbd24609c3c419d8000900797bcdbdb629a0bafd460
                                  • Instruction Fuzzy Hash: 85710970A00204ABDF14DF68DC49BAEB7F8EF42710F10856DF8199B681D7B59A45C7D2

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 442 55606df-5560803 452 556080f-556081a GetCurrentHwProfileW 442->452 453 5560831-55609e1 call 55609e3 452->453
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 05560813
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4136334455.0000000005560000.00000040.00001000.00020000.00000000.sdmp, Offset: 05560000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_5560000_MPGPH131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: 6c8db4a3c0b95e7ab54413e1cc490d6374e50633b2bd77ffd66423146ab3a766
                                  • Instruction ID: 115020f31a0856f77c6a44a4d29b1e852a21a13625ac8f374a57a1b8cdbb7607
                                  • Opcode Fuzzy Hash: 6c8db4a3c0b95e7ab54413e1cc490d6374e50633b2bd77ffd66423146ab3a766
                                  • Instruction Fuzzy Hash: CA416AEB64D1A5BC7212C1822F68AFB576FF6D6B307308937F407C7192E2844E8A55B1

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 473 5560703-5560803 482 556080f-556081a GetCurrentHwProfileW 473->482 483 5560831-55609e1 call 55609e3 482->483
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 05560813
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4136334455.0000000005560000.00000040.00001000.00020000.00000000.sdmp, Offset: 05560000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_5560000_MPGPH131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: c3a4a1d5d67e07288c17ce326776959003a513e820a88629157abd7b9a97806a
                                  • Instruction ID: 25a93bf632700b217b891e7c103913137c381baa0d4ebcd7864a774862047760
                                  • Opcode Fuzzy Hash: c3a4a1d5d67e07288c17ce326776959003a513e820a88629157abd7b9a97806a
                                  • Instruction Fuzzy Hash: 1E416AEB24D165BC7212C1826F68AFB536FE2C6B30730C83BF407C7192E2944E8A55B1

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 503 5560718-5560803 511 556080f-556081a GetCurrentHwProfileW 503->511 512 5560831-55609e1 call 55609e3 511->512
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 05560813
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4136334455.0000000005560000.00000040.00001000.00020000.00000000.sdmp, Offset: 05560000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_5560000_MPGPH131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: ee2bc9a6c34165f93c62440a270890fbcf6f0dd2fbd447af10cb17fff900df97
                                  • Instruction ID: 0f1d6df41310df9b0943f573f79f65ad761b4d86a1193c82b81db4d0f6e0773b
                                  • Opcode Fuzzy Hash: ee2bc9a6c34165f93c62440a270890fbcf6f0dd2fbd447af10cb17fff900df97
                                  • Instruction Fuzzy Hash: 08417EEB64D165BC7142C0822B68AFB572FE6C6B30330C837F407C7192E2884E8A54B1

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 532 18549c-1854be 533 1856b1 532->533 534 1854c4-1854c6 532->534 535 1856b3-1856b7 533->535 536 1854c8-1854e7 call 174723 534->536 537 1854f2-185515 534->537 545 1854ea-1854ed 536->545 539 18551b-185521 537->539 540 185517-185519 537->540 539->536 542 185523-185534 539->542 540->539 540->542 543 185536-185544 call 17e17d 542->543 544 185547-185557 call 184fe1 542->544 543->544 550 185559-18555f 544->550 551 1855a0-1855b2 544->551 545->535 554 185588-18559e call 184bb2 550->554 555 185561-185564 550->555 552 185609-185629 WriteFile 551->552 553 1855b4-1855ba 551->553 560 18562b-185631 552->560 561 185634 552->561 556 1855bc-1855bf 553->556 557 1855f5-185607 call 18505e 553->557 571 185581-185583 554->571 558 18556f-18557e call 184f79 555->558 559 185566-185569 555->559 564 1855e1-1855f3 call 185222 556->564 565 1855c1-1855c4 556->565 583 1855dc-1855df 557->583 558->571 559->558 566 185649-18564c 559->566 560->561 563 185637-185642 561->563 572 1856ac-1856af 563->572 573 185644-185647 563->573 564->583 574 1855ca-1855d7 call 185139 565->574 575 18564f-185651 565->575 566->575 571->563 572->535 573->566 574->583 580 18567f-18568b 575->580 581 185653-185658 575->581 586 18568d-185693 580->586 587 185695-1856a7 580->587 584 18565a-18566c 581->584 585 185671-18567a call 17d208 581->585 583->571 584->545 585->545 586->533 586->587 587->545
                                  APIs
                                  • WriteFile.KERNELBASE(?,00000000,00179087,?,00000000,00000000,00000000,?,00000000,?,0009A3EB,00179087,00000000,0009A3EB,?,?), ref: 00185621
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000005.00000002.4129149941.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129247202.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129552206.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130398355.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130736549.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: FileWrite
                                  • String ID:
                                  • API String ID: 3934441357-0
                                  • Opcode ID: d2895d000c4c9040be048b26a7f1c91a3b65414baa0270893f8776d6c894eaee
                                  • Instruction ID: 64ece53ebfa2df4ea25e281fc97d2076a9a72eeded674c15a774a0462ee4d8c0
                                  • Opcode Fuzzy Hash: d2895d000c4c9040be048b26a7f1c91a3b65414baa0270893f8776d6c894eaee
                                  • Instruction Fuzzy Hash: 1061A071904519AFDF15EFA8C884EEEBFBBEF19304F640149E804A7216D772DA418FA0

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 590 5560754-5560803 596 556080f-556081a GetCurrentHwProfileW 590->596 597 5560831-55609e1 call 55609e3 596->597
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 05560813
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4136334455.0000000005560000.00000040.00001000.00020000.00000000.sdmp, Offset: 05560000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_5560000_MPGPH131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: 8e181f29355d439349f318232099a381f7e0a37a2347e417420a404f8c22c290
                                  • Instruction ID: bbbf45bad139743d79d31258665e076a573afa1149b8f18db5667c27bbee249d
                                  • Opcode Fuzzy Hash: 8e181f29355d439349f318232099a381f7e0a37a2347e417420a404f8c22c290
                                  • Instruction Fuzzy Hash: 63317CEB64D155BC7202C0412F68AFB572FE6C6B30330CC2BF407C7196E2844E8A55B1
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 05560813
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4136334455.0000000005560000.00000040.00001000.00020000.00000000.sdmp, Offset: 05560000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_5560000_MPGPH131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: 122ccfde78c0ef4a63dcce90216a3e77f8f9e477bf967f765a161a119334ff54
                                  • Instruction ID: c74f8c93a8fdb17668a7d7abec71b65ab44e6dcb2199413484beb67cbecf4fd5
                                  • Opcode Fuzzy Hash: 122ccfde78c0ef4a63dcce90216a3e77f8f9e477bf967f765a161a119334ff54
                                  • Instruction Fuzzy Hash: C3318DEB64D1A1BC7202C1522F68AFA576FF6D67303308D2BF407C7596E3894E4A11B2
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 05560813
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4136334455.0000000005560000.00000040.00001000.00020000.00000000.sdmp, Offset: 05560000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_5560000_MPGPH131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: ec2dd35f41f494fe2a057b8c77bf29116f1abd5786da18d13cd961e5fd403368
                                  • Instruction ID: 0d09de34dd460cc9d711bcb11bd34bbbdf6502c0618032685d308b53ac483442
                                  • Opcode Fuzzy Hash: ec2dd35f41f494fe2a057b8c77bf29116f1abd5786da18d13cd961e5fd403368
                                  • Instruction Fuzzy Hash: 7F312BEB64D155BC7242C1522F28AFB576FF6D57303308837F407C7596E6884E4A54B1
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 05560813
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4136334455.0000000005560000.00000040.00001000.00020000.00000000.sdmp, Offset: 05560000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_5560000_MPGPH131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: d673ebb6a98eb4f7f856c13d17c408a2e525c777c350e724dd67ce011e621e39
                                  • Instruction ID: 6e95fe06e88074389c1fd5d63ab7ddb873cee6cb01a9f326757af83746f66f5c
                                  • Opcode Fuzzy Hash: d673ebb6a98eb4f7f856c13d17c408a2e525c777c350e724dd67ce011e621e39
                                  • Instruction Fuzzy Hash: 6C319FEB64C251BDB252C1412B28AFB636FF6D6730330883BF407C7196E7844E4910B1
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000005.00000002.4129149941.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129247202.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129552206.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130398355.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130736549.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 57aee36122b921ed156cdc633340d2435ec300a39f86a74d23d8f5c99af136bc
                                  • Instruction ID: be292eba414ef51219a544f0fbbc851f1cb6c86321309a54a2a9c5b221dbc8fa
                                  • Opcode Fuzzy Hash: 57aee36122b921ed156cdc633340d2435ec300a39f86a74d23d8f5c99af136bc
                                  • Instruction Fuzzy Hash: 1351B374A40108AFDF14CF58C881AAABFB5EF59364F25C158E84E9B252D331DE81CB94
                                  APIs
                                  • Concurrency::cancel_current_task.LIBCPMT ref: 001006AE
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000005.00000002.4129149941.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129247202.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129552206.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130398355.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130736549.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: Concurrency::cancel_current_task
                                  • String ID:
                                  • API String ID: 118556049-0
                                  • Opcode ID: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
                                  • Instruction ID: 6beaaca6bb28c8514c0a32ef2d91f572dc319fd4b2748e27c46bec4b43867081
                                  • Opcode Fuzzy Hash: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
                                  • Instruction Fuzzy Hash: 0B412772A001149FCB16DF68DC806AE7BA6AF8D340F140169FC45DB382D771DE618BE1
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 05560813
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4136334455.0000000005560000.00000040.00001000.00020000.00000000.sdmp, Offset: 05560000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_5560000_MPGPH131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: a27a1d2538ced8e38d18ccf91575321ddee165f34b25b2d954e049f4eb0730c4
                                  • Instruction ID: 54da1dadf3533eb899321d67a875e9b1a362490cea3076459b5fc4cb88e8c178
                                  • Opcode Fuzzy Hash: a27a1d2538ced8e38d18ccf91575321ddee165f34b25b2d954e049f4eb0730c4
                                  • Instruction Fuzzy Hash: 5921AFEB60C291BC7642C1522B68AFA576FF6D57303308927F407C7191E7944E4950F1
                                  APIs
                                  • FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,001849F9,00000000,CF830579,001C1140,0000000C,00184AB5,00178BBD,?), ref: 00184B68
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000005.00000002.4129149941.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129247202.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129552206.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130398355.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130736549.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ChangeCloseFindNotification
                                  • String ID:
                                  • API String ID: 2591292051-0
                                  • Opcode ID: 2ea4c3ab0c5a9f01f9177402264d595e11c5ecc71c2e788e27241c6d9913ff71
                                  • Instruction ID: aa2a482bfab3cbe730339cc16e1ddd48a3db3a0d95fd27488941155fb1e5525b
                                  • Opcode Fuzzy Hash: 2ea4c3ab0c5a9f01f9177402264d595e11c5ecc71c2e788e27241c6d9913ff71
                                  • Instruction Fuzzy Hash: A8116B33A411241BD72472746845B7E678A8F92770F39024EF8188B0C2FF22DE814B99
                                  APIs
                                  • SetFilePointerEx.KERNELBASE(00000000,00000000,001C0DF8,0009A3EB,00000002,0009A3EB,00000000,?,?,?,0017E166,00000000,?,0009A3EB,00000002,001C0DF8), ref: 0017E098
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000005.00000002.4129149941.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129247202.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129552206.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130398355.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130736549.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: FilePointer
                                  • String ID:
                                  • API String ID: 973152223-0
                                  • Opcode ID: 3e42a9abdbc60188be7d6d3b63f944bf0b1af43b5afed44b99b30fb0a062f125
                                  • Instruction ID: 8ad1f1710b3d324c8c99ff9c3184e0f297095a3a01f315962c2ad28bee4d68ac
                                  • Opcode Fuzzy Hash: 3e42a9abdbc60188be7d6d3b63f944bf0b1af43b5afed44b99b30fb0a062f125
                                  • Instruction Fuzzy Hash: E901C432710155AFCF199F59CC05C9E3BAADB85320B254249F8549B291EBB2ED918BD0
                                  APIs
                                  • RtlAllocateHeap.NTDLL(00000008,001791F7,00000000,?,00185D79,00000001,00000364,00000000,00000006,000000FF,?,00000000,0017D244,001789C3,001791F7,00000000), ref: 00186435
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000005.00000002.4129149941.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129247202.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129552206.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130398355.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130736549.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: AllocateHeap
                                  • String ID:
                                  • API String ID: 1279760036-0
                                  • Opcode ID: b52e99df5ecb60a1f2d211cd90f06ddd71a664faaf368a0a3655b89d88395e57
                                  • Instruction ID: ff54bd6ec092640c0cc13af083eec191f49fcfd96b5adc9ed0e57302bc33ec93
                                  • Opcode Fuzzy Hash: b52e99df5ecb60a1f2d211cd90f06ddd71a664faaf368a0a3655b89d88395e57
                                  • Instruction Fuzzy Hash: 12F08932505624669B217B629C46B5F3B599F51764F258051BD1897181CF30DA114FF2
                                  APIs
                                  • RtlAllocateHeap.NTDLL(00000000,0018D635,4D88C033,?,0018D635,00000220,?,001857EF,4D88C033), ref: 00186E60
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000005.00000002.4129149941.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129247202.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129552206.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130398355.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130736549.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: AllocateHeap
                                  • String ID:
                                  • API String ID: 1279760036-0
                                  • Opcode ID: c033468f09ab7f72ba7add6ab105e7dce0aec344afe24537087e9c255cd3834d
                                  • Instruction ID: c4c8f579c9e1117cc838821cdcb0f87de86539b560b72abaa5219998311c77cf
                                  • Opcode Fuzzy Hash: c033468f09ab7f72ba7add6ab105e7dce0aec344afe24537087e9c255cd3834d
                                  • Instruction Fuzzy Hash: 85E0223A10062566EF30B665DC05B5B7A5DCF927B0F060120FC14960D0DF20CF018FE5
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4136375922.0000000005570000.00000040.00001000.00020000.00000000.sdmp, Offset: 05570000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_5570000_MPGPH131.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: f702d4bc910d0a288ecce8ab49e8b17ea571b3c051c654756375b185b6ca1ebe
                                  • Instruction ID: 47ce532a5aada51174d0f7c23d5a536bbdb67650b107447ac9286bc6cf790a5c
                                  • Opcode Fuzzy Hash: f702d4bc910d0a288ecce8ab49e8b17ea571b3c051c654756375b185b6ca1ebe
                                  • Instruction Fuzzy Hash: 9B11A0EB15D128BC7152D1867F189F6ABAFF1D7730B308827F407D4492E2980F5925B1
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4136375922.0000000005570000.00000040.00001000.00020000.00000000.sdmp, Offset: 05570000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_5570000_MPGPH131.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: bd0d81670d7ec3df2d1a7c3ac0bcdafcc7d60e61cd2f78e0f6daf707c848d2d6
                                  • Instruction ID: a333f4c6c0b7320406eb1835faf77966acbf2a27eac51ac600e98c7fb6ef7cb5
                                  • Opcode Fuzzy Hash: bd0d81670d7ec3df2d1a7c3ac0bcdafcc7d60e61cd2f78e0f6daf707c848d2d6
                                  • Instruction Fuzzy Hash: BA11A0EB159128BD7146D5867F189F6ABAFF1D7330B308837F407D4492E2940B5925B1
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4136375922.0000000005570000.00000040.00001000.00020000.00000000.sdmp, Offset: 05570000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_5570000_MPGPH131.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 484ca1eaf56957b6fcad93b33efdbfbb67e308f29b57ff5487ebab03f3f43741
                                  • Instruction ID: 664f876b3b4eef0d81c83a1b542f5af95cd2437e709e2fe0d0aee4bf7e7c1b69
                                  • Opcode Fuzzy Hash: 484ca1eaf56957b6fcad93b33efdbfbb67e308f29b57ff5487ebab03f3f43741
                                  • Instruction Fuzzy Hash: 7D1157EB448228BD6117C4967F5C9F67FAFF5D2230B304827F407D94A2D1850B4A59B1
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4136375922.0000000005570000.00000040.00001000.00020000.00000000.sdmp, Offset: 05570000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_5570000_MPGPH131.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: a407c12072d084c098d9c5500ba4a1538f0f6bdc608411b54357f4b2bcade6fe
                                  • Instruction ID: c122fdcbb70fc6b9b2f2b02151dc78cafa510da6b017cd7e4255a3f4351d05b3
                                  • Opcode Fuzzy Hash: a407c12072d084c098d9c5500ba4a1538f0f6bdc608411b54357f4b2bcade6fe
                                  • Instruction Fuzzy Hash: F6014CE7048228BE6102D0957F5C9F6ABAFF5E7330B308C27F807E9592C2450B4455B1
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4136375922.0000000005570000.00000040.00001000.00020000.00000000.sdmp, Offset: 05570000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_5570000_MPGPH131.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: bb8733808b484f1448df7ba66fd8c61ed42241cbb8255ec202d96c52f5ca796f
                                  • Instruction ID: 6e349ade86b11baee52951bb5c9a6b90a83ca5db51c164cb0f2bca30ad0adf45
                                  • Opcode Fuzzy Hash: bb8733808b484f1448df7ba66fd8c61ed42241cbb8255ec202d96c52f5ca796f
                                  • Instruction Fuzzy Hash: E6F0F9D709D228BC6047D0463F5CAF2ABDFB1D7730B344827F447D8596D1890B8969B2
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4136375922.0000000005570000.00000040.00001000.00020000.00000000.sdmp, Offset: 05570000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_5570000_MPGPH131.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: f5cf7a59cec9407c39f9fcfacaa2faf26c79bfbc072ba093e9d0446e985a354b
                                  • Instruction ID: 4783754aeefdf011e1cf23d75282c64ca3f7cd0d746092f4a8ad511ba6825ae7
                                  • Opcode Fuzzy Hash: f5cf7a59cec9407c39f9fcfacaa2faf26c79bfbc072ba093e9d0446e985a354b
                                  • Instruction Fuzzy Hash: 9CF0E2E7098128AD5106D156BF5CAB267DFB1AA731F308C26F047D86A2C5490B44AAE6
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4136375922.0000000005570000.00000040.00001000.00020000.00000000.sdmp, Offset: 05570000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_5570000_MPGPH131.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: ebfcc3248819378cbb97d60fe0145bad0b1dc6e2d7311228c6eda2470b98194a
                                  • Instruction ID: 0e069ac0cfa37b50955fed62ab5e3b01eece20c8909395b0b1a9780f20ce3e23
                                  • Opcode Fuzzy Hash: ebfcc3248819378cbb97d60fe0145bad0b1dc6e2d7311228c6eda2470b98194a
                                  • Instruction Fuzzy Hash: A7F027E7099024AC114AD552BE5C5F67BDFB197730B300C27F087D80A2D1490B896AF9
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4136375922.0000000005570000.00000040.00001000.00020000.00000000.sdmp, Offset: 05570000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_5570000_MPGPH131.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 8ac73881177c52faf6f37545a627bcba7143032f69e921c52196359654f04137
                                  • Instruction ID: a16301daa60ab21160c3a330611724d16f65e3f742b375ab688114816cbaa04f
                                  • Opcode Fuzzy Hash: 8ac73881177c52faf6f37545a627bcba7143032f69e921c52196359654f04137
                                  • Instruction Fuzzy Hash: C3E0E5E7058128AC5006D1967E5C6F667DF71A7331F304C27F443DC692C2880B492AF6
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000005.00000002.4129149941.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129247202.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129552206.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130398355.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130736549.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
                                  • Instruction ID: 5f47255837c40a3d706529b2864631ff549768cd2bd3c3258a366bbc38fb01fa
                                  • Opcode Fuzzy Hash: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
                                  • Instruction Fuzzy Hash: E9023C71E412199BDF14CFA9D8846AEFBF1FF48314F258269E519E7380DB31AA41CB90
                                  APIs
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 000FF833
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 000FF855
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 000FF875
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 000FF89F
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 000FF90D
                                  • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000FF959
                                  • std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 000FF973
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 000FFA08
                                  • std::_Facet_Register.LIBCPMT ref: 000FFA15
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000005.00000002.4129149941.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129247202.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129552206.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130398355.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130736549.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
                                  • String ID: bad locale name$Ps
                                  • API String ID: 3375549084-1174896957
                                  • Opcode ID: 294444fddf1b518aba4229b468bfd9701cc482618184ed3a113dd1e108a2f08c
                                  • Instruction ID: 872a0c3800515b49a2e4b2167c741a8a6c3b3d1479f064bba62044f3cf1949a5
                                  • Opcode Fuzzy Hash: 294444fddf1b518aba4229b468bfd9701cc482618184ed3a113dd1e108a2f08c
                                  • Instruction Fuzzy Hash: 6961B071E0024D9BDF10DFA4D845BAEBBF4BF14350F144068E908A7781EB75E905CBA2
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 00093E7F
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000005.00000002.4129149941.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129247202.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129552206.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130398355.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130736549.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: @3$@3$G>$G>$`!$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                  • API String ID: 2659868963-1078880228
                                  • Opcode ID: 25954e1051915b58708859f561d53b6352cb7b99ef885c255ef7892f58979086
                                  • Instruction ID: 8b9dddc28789992660394ca21fd2a173151d3090e8ac1e1f91c698e2f420ca4b
                                  • Opcode Fuzzy Hash: 25954e1051915b58708859f561d53b6352cb7b99ef885c255ef7892f58979086
                                  • Instruction Fuzzy Hash: C54182B2904204AFCB18DF58D845BAEB7F9EB49310F14852EF919D7681E770AA018FA0
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 00093E7F
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000005.00000002.4129149941.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129247202.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129552206.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130398355.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130736549.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: @3$@3$`!$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                  • API String ID: 2659868963-1863890269
                                  • Opcode ID: ff04dc713bc958787fbb90287c2c3ea8d36c4b3d3733c7c902f007e601e7c1fe
                                  • Instruction ID: 3ff57f4b4e684199225e5f663cdfcb3c3375dd473981fc117fb08346ed1b42df
                                  • Opcode Fuzzy Hash: ff04dc713bc958787fbb90287c2c3ea8d36c4b3d3733c7c902f007e601e7c1fe
                                  • Instruction Fuzzy Hash: 26210DB29043046FCB14DF58D805F96B7ECAB18310F18882EFA69DB681E770EA14DF91
                                  APIs
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 00094F72
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 00094FFF
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 000950C8
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000005.00000002.4129149941.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129247202.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129552206.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130398355.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130736549.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_destroy$___std_exception_copy
                                  • String ID: @3$`!$recursive_directory_iterator::operator++
                                  • API String ID: 1206660477-1018949397
                                  • Opcode ID: c230f281f2ffae2512521e0559c58af9494e08e4cdd77e9d53d98ef82582593e
                                  • Instruction ID: 35ba5fa24e6031213c45de8a998a8abfeeeb7ae21f409fd52b8deb71414c0a0f
                                  • Opcode Fuzzy Hash: c230f281f2ffae2512521e0559c58af9494e08e4cdd77e9d53d98ef82582593e
                                  • Instruction Fuzzy Hash: 9AE1F4B19002049FDB28DF68D845FAEB7F9FF48300F108A2DE45693B82D774A945CBA1
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 0009799A
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 00097B75
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000005.00000002.4129149941.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129247202.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129552206.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130398355.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130736549.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: `!$`!$out_of_range$type_error
                                  • API String ID: 2659868963-2269780633
                                  • Opcode ID: 733c27003c7f875e01bd4801a8a3718b1903ee323306203927a1521cd24ef531
                                  • Instruction ID: b9e720447f402c97917352a52612a17419401bf12c91cb9d739ef621f70299f3
                                  • Opcode Fuzzy Hash: 733c27003c7f875e01bd4801a8a3718b1903ee323306203927a1521cd24ef531
                                  • Instruction Fuzzy Hash: BAC169B19002089FDB18CFA8D984B9DFBF1FF49300F148669E419EB791E7749981CB50
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 000932C6
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 00093350
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000005.00000002.4129149941.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129247202.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129552206.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130398355.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130736549.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy___std_exception_destroy
                                  • String ID: +4$@3$`!$`!
                                  • API String ID: 2970364248-4089177709
                                  • Opcode ID: 4496339217beb850e6db5146a6d2fbfbd0a1742a65d17a99c7ba2944d2bdab1b
                                  • Instruction ID: 54c561783155b2cffa16f25d4bb89f76594856376a9943c45fafe2ae11632ede
                                  • Opcode Fuzzy Hash: 4496339217beb850e6db5146a6d2fbfbd0a1742a65d17a99c7ba2944d2bdab1b
                                  • Instruction Fuzzy Hash: CF516A71A002189FDF08CF98D885BEEBBF5FF59300F14812AE819A7391D774AA418B91
                                  APIs
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 00093A58
                                  • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00093AA4
                                  • __Getctype.LIBCPMT ref: 00093ABA
                                  • std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00093AE6
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 00093B7B
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000005.00000002.4129149941.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129247202.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129552206.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130398355.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130736549.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
                                  • String ID: bad locale name
                                  • API String ID: 1840309910-1405518554
                                  • Opcode ID: 7679ddfe8991f5d297dd776b22a35a1d7859a826e5fbb26496ad6609ff0b8892
                                  • Instruction ID: 91eca405778df0a83e7d4c16968b4ebcffff89055093b975e21f38152bd44019
                                  • Opcode Fuzzy Hash: 7679ddfe8991f5d297dd776b22a35a1d7859a826e5fbb26496ad6609ff0b8892
                                  • Instruction Fuzzy Hash: F55160B5D002089BEF10DFA4DD45B9EBBF8BF14314F148069E909AB341E775DA04CB62
                                  APIs
                                  • _ValidateLocalCookies.LIBCMT ref: 00172E47
                                  • ___except_validate_context_record.LIBVCRUNTIME ref: 00172E4F
                                  • _ValidateLocalCookies.LIBCMT ref: 00172ED8
                                  • __IsNonwritableInCurrentImage.LIBCMT ref: 00172F03
                                  • _ValidateLocalCookies.LIBCMT ref: 00172F58
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000005.00000002.4129149941.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129247202.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129552206.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130398355.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130736549.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                  • String ID: csm
                                  • API String ID: 1170836740-1018135373
                                  • Opcode ID: fbe51d52304a8b2cc70b096818ab0fb3221cf4bd7f4df3deb4a69f609919d696
                                  • Instruction ID: 40328a8ca2c6ae0524abcdb6a60f687b175440dd8f2eefc36b683b32615fc71c
                                  • Opcode Fuzzy Hash: fbe51d52304a8b2cc70b096818ab0fb3221cf4bd7f4df3deb4a69f609919d696
                                  • Instruction Fuzzy Hash: 14418235A00209ABCF14DF68C885A9EBBB5FF55324F14C055E81C9B352DB31EE56CB91
                                  APIs
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 000FDE93
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 000FDEB6
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 000FDED6
                                  • std::_Facet_Register.LIBCPMT ref: 000FDF4B
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 000FDF63
                                  • Concurrency::cancel_current_task.LIBCPMT ref: 000FDF7B
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000005.00000002.4129149941.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129247202.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129552206.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130398355.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130736549.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
                                  • String ID:
                                  • API String ID: 2081738530-0
                                  • Opcode ID: 92eb7d8c78ae2d44e0a67f0223c843228965a96f6511fc4d0edd75950442899b
                                  • Instruction ID: f19d82cbcdd3a5d085039941d63a4f45359b5a8ac17fe51eb4009737f344e909
                                  • Opcode Fuzzy Hash: 92eb7d8c78ae2d44e0a67f0223c843228965a96f6511fc4d0edd75950442899b
                                  • Instruction Fuzzy Hash: AF41FE71A002199BCB10EF54D884EAEBBB5FB10320F10426AE9059BB52D731ED44CBD1
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 00097340
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000005.00000002.4129149941.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129247202.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129552206.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130398355.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130736549.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: `!$`!$parse error$parse_error
                                  • API String ID: 2659868963-929550935
                                  • Opcode ID: 4ea84be766665424ba6e648cc1001b051c29b5649763ad31d51918cbd9caafbe
                                  • Instruction ID: 3a877a7c4a7b9bb6ca1a76da8f8292a2d58292a953724f22a7b570b1b71fe6eb
                                  • Opcode Fuzzy Hash: 4ea84be766665424ba6e648cc1001b051c29b5649763ad31d51918cbd9caafbe
                                  • Instruction Fuzzy Hash: 79E16D719142088FDB18CF68C884B9DBBB1FF48300F24826DE419EB792D7749A85DF51
                                  APIs
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 000975BE
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 000975CD
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000005.00000002.4129149941.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129247202.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129552206.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130398355.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130736549.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_destroy
                                  • String ID: at line $, column $`!
                                  • API String ID: 4194217158-2977949356
                                  • Opcode ID: ccefab20a4e256d7e752f95bcb3527a6a11ff6698df24c53d15fe9fb8e955e0f
                                  • Instruction ID: abd381724ff7639ace0674070c801a536b2c520404b57c99aaa03f225627d84a
                                  • Opcode Fuzzy Hash: ccefab20a4e256d7e752f95bcb3527a6a11ff6698df24c53d15fe9fb8e955e0f
                                  • Instruction Fuzzy Hash: 9B61E671A046049FDF08DF68DC84B9DBBB6FF48300F24862CE419A7782D774AA45DB91
                                  APIs
                                    • Part of subcall function 00093190: ___std_exception_copy.LIBVCRUNTIME ref: 000932C6
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 0009345F
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000005.00000002.4129149941.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129247202.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129552206.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130398355.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130736549.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: +4$@3$@3$`!
                                  • API String ID: 2659868963-1914207329
                                  • Opcode ID: 18422242c34727452c111046a90dab25468ecf9a9569e3188b5def4d947f3fb7
                                  • Instruction ID: ebb52e20d4dad782f6203f8f2b0a6965170c1db1052a9511771e10c1dc61c845
                                  • Opcode Fuzzy Hash: 18422242c34727452c111046a90dab25468ecf9a9569e3188b5def4d947f3fb7
                                  • Instruction Fuzzy Hash: E13183B1900209AFCB18DFA8D941ADEFBF9FB08310F10852AF519E7651E770AA51CB90
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 0009345F
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000005.00000002.4129149941.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129247202.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129552206.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130398355.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130736549.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: +4$@3$@3$`!
                                  • API String ID: 2659868963-1914207329
                                  • Opcode ID: d69241f37684ee938f35d50bf9a6ba92661c1cb34b16b7a4aa5e3c14b2a9ce8e
                                  • Instruction ID: ec154226cbb1ff71b85ee3d87c401b52546654fc404efdbc0a21c2b66ca277f8
                                  • Opcode Fuzzy Hash: d69241f37684ee938f35d50bf9a6ba92661c1cb34b16b7a4aa5e3c14b2a9ce8e
                                  • Instruction Fuzzy Hash: 7F01FFB6500309AF8B04DFA9D545C96FBFDAF58310700C42AE519D7611EBB0E555CB90
                                  APIs
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 00096F11
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 00096F20
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000005.00000002.4129149941.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129247202.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129552206.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130398355.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130736549.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_destroy
                                  • String ID: [json.exception.$`!
                                  • API String ID: 4194217158-3048014091
                                  • Opcode ID: 93fe263e7740c341080adc509677843c5347fd3be96d9cc4557db85ec4720a15
                                  • Instruction ID: f0a463a16eeb7814293c8d33aba0083093226477beeb8d2eb0bb960d42ad4e9e
                                  • Opcode Fuzzy Hash: 93fe263e7740c341080adc509677843c5347fd3be96d9cc4557db85ec4720a15
                                  • Instruction Fuzzy Hash: 9891C470A002089FDF18CF68D984B9EBBF6FF59300F20866DE459AB792D775A941CB50
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 000977B4
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000005.00000002.4129149941.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129247202.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129552206.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130398355.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130736549.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: `!$`!$invalid_iterator
                                  • API String ID: 2659868963-3421541259
                                  • Opcode ID: 2cc77f91e07c8fd82a595194a78378f539f05fb00e072f7e0a0daf14b777d1b7
                                  • Instruction ID: 39f9d503a07cc501bb7851f81c66d33b561f70119edf335cff06732c741a4e83
                                  • Opcode Fuzzy Hash: 2cc77f91e07c8fd82a595194a78378f539f05fb00e072f7e0a0daf14b777d1b7
                                  • Instruction Fuzzy Hash: 63514AB19042089FDB18CFA8E99479DFBF1FB48300F14866DE419EB792E7749985CB90
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 00097D67
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000005.00000002.4129149941.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129247202.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129552206.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130398355.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130736549.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: `!$`!$other_error
                                  • API String ID: 2659868963-1899045556
                                  • Opcode ID: 21c77acb1f801fbd0beec41b8bab33980a15a57dd3a4f88ed2fe794bd8aad469
                                  • Instruction ID: 9279ae0ee39fd7ae06709a1591ce4f8b18d561a1318a597e4864116e1776381d
                                  • Opcode Fuzzy Hash: 21c77acb1f801fbd0beec41b8bab33980a15a57dd3a4f88ed2fe794bd8aad469
                                  • Instruction Fuzzy Hash: 0B5179B19012488FDB18CFA8D9847ADBBF1FF48300F148669E459EB782E774A985CB50
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 000FD06F
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 000FD096
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000005.00000002.4129149941.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129247202.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129552206.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130398355.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130736549.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: `!$`!
                                  • API String ID: 2659868963-1174305143
                                  • Opcode ID: d495d650bdd2eff5b5051cf6fce93e0b70afad023eb72b12187ea9384c3ac176
                                  • Instruction ID: 0dfc8d177f3cc2819fde84c338c0114c1c3b096db9facd992e1ca7700f39e03d
                                  • Opcode Fuzzy Hash: d495d650bdd2eff5b5051cf6fce93e0b70afad023eb72b12187ea9384c3ac176
                                  • Instruction Fuzzy Hash: 5D01F6B6500706AF8709CF58D504882FBF8FB48310311852FE529CBB00E7B0E529CFA0
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 0010B3DF
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 0010B406
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000005.00000002.4129149941.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129247202.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129552206.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130398355.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130736549.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: `!$`!
                                  • API String ID: 2659868963-1174305143
                                  • Opcode ID: 79f45bbaf531533b79d92ec0e5f7610964a74ec276e040c93bbc8e3dae03d6ed
                                  • Instruction ID: def7398e37b161bcdc926fe28cba8fff3afa6048e92668531c086ac312207693
                                  • Opcode Fuzzy Hash: 79f45bbaf531533b79d92ec0e5f7610964a74ec276e040c93bbc8e3dae03d6ed
                                  • Instruction Fuzzy Hash: 4AF0C4B6500706AF8709DF58D515886BBF8FA48710311852FE52ADBB11E7B0E529CBA0
                                  APIs
                                  • Concurrency::cancel_current_task.LIBCPMT ref: 0010E491
                                  Strings
                                  • type must be boolean, but is , xrefs: 0010E582
                                  • type must be string, but is , xrefs: 0010E4F8
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000005.00000002.4129149941.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129247202.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129552206.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130398355.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130736549.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: Concurrency::cancel_current_task
                                  • String ID: type must be boolean, but is $type must be string, but is
                                  • API String ID: 118556049-436076039
                                  • Opcode ID: 1da79b95eb64faa4f3999f22417817f74ba354fd4c3d8cdbce15bb513158af50
                                  • Instruction ID: 05a260621de4a06789b2a8414e7c775e246362e6797df2d79a539509ed80c81e
                                  • Opcode Fuzzy Hash: 1da79b95eb64faa4f3999f22417817f74ba354fd4c3d8cdbce15bb513158af50
                                  • Instruction Fuzzy Hash: B6416BB1900248AFDB14EBA4D902BEE77A8DB10310F044978F459D7AC3EB75EA10C791
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 00093078
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000005.00000002.4129247202.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000005.00000002.4129149941.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129247202.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129552206.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4129615582.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130398355.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000005.00000002.4130736549.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_5_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: `!$`!
                                  • API String ID: 2659868963-1174305143
                                  • Opcode ID: cdec5676e0b264cfc482e88fc2191b3951f3e2dd796ff4a25c83423a5ed27983
                                  • Instruction ID: a90d06c2f6cd3aab028f27cf62c2f2a915659e65671221f9119a2f2049bf97e6
                                  • Opcode Fuzzy Hash: cdec5676e0b264cfc482e88fc2191b3951f3e2dd796ff4a25c83423a5ed27983
                                  • Instruction Fuzzy Hash: 4BE0EDB2901308ABC711DFA8990598AFBF8AB19701F1186AAE948D7300F7B195558BD1

                                  Execution Graph

                                  Execution Coverage:2.9%
                                  Dynamic/Decrypted Code Coverage:2.1%
                                  Signature Coverage:0%
                                  Total number of Nodes:663
                                  Total number of Limit Nodes:68
                                  execution_graph 19980 f3a40 19983 f3a55 19980->19983 19981 f3b28 GetPEB 19981->19983 19982 f3a73 GetPEB 19982->19983 19983->19981 19983->19982 19984 f3b9d Sleep 19983->19984 19985 f3ae8 Sleep 19983->19985 19986 f3bc7 19983->19986 19984->19983 19985->19983 20178 4be06a8 20179 4be06f2 20178->20179 20184 4be0828 20179->20184 20185 4be083b 20184->20185 20188 4be09d9 20185->20188 20189 4be09f8 GetCurrentHwProfileW 20188->20189 20191 4be0afa 20189->20191 19249 9a210 19282 16f290 19249->19282 19251 9a248 19287 92ae0 19251->19287 19253 9a28b 19303 175362 19253->19303 19256 9a377 19259 9a34e 19259->19256 19332 1747b0 19259->19332 19263 179136 4 API calls 19264 9a2fc 19263->19264 19269 9a318 19264->19269 19318 fcf60 19264->19318 19323 17dbdf 19269->19323 19284 921d0 Concurrency::cancel_current_task ___std_exception_copy std::_Facet_Register 19282->19284 19283 16f2af 19283->19251 19284->19283 19335 170651 19284->19335 19288 92ba5 19287->19288 19294 92af6 19287->19294 19553 92270 19288->19553 19289 92b02 std::_Locinfo::_Locinfo_ctor 19289->19253 19291 92b2a 19295 16f290 std::_Facet_Register RtlAllocateHeap 19291->19295 19292 92baa 19563 921d0 19292->19563 19294->19289 19294->19291 19297 92b6e 19294->19297 19298 92b65 19294->19298 19296 92b3d 19295->19296 19299 1747b0 RtlAllocateHeap 19296->19299 19302 92b46 std::_Locinfo::_Locinfo_ctor 19296->19302 19300 16f290 std::_Facet_Register RtlAllocateHeap 19297->19300 19297->19302 19298->19291 19298->19292 19301 92bb4 19299->19301 19300->19302 19302->19253 19576 1752a0 19303->19576 19305 9a2d7 19305->19259 19306 179136 19305->19306 19307 179149 __fread_nolock 19306->19307 19600 178e8d 19307->19600 19309 17915e 19310 1744dc __fread_nolock RtlAllocateHeap 19309->19310 19311 9a2ea 19310->19311 19312 174eeb 19311->19312 19313 174efe __fread_nolock 19312->19313 19733 174801 19313->19733 19315 174f0a 19316 1744dc __fread_nolock RtlAllocateHeap 19315->19316 19317 9a2f0 19316->19317 19317->19263 19319 fcfa7 19318->19319 19322 fcf78 __fread_nolock 19318->19322 19781 100560 19319->19781 19321 fcfba 19321->19269 19322->19269 19796 17dbfc 19323->19796 19325 9a348 19326 178be8 19325->19326 19327 178bfb __fread_nolock 19326->19327 19920 178ac3 19327->19920 19329 178c07 19330 1744dc __fread_nolock RtlAllocateHeap 19329->19330 19331 178c13 19330->19331 19331->19259 19333 1746ec __fread_nolock RtlAllocateHeap 19332->19333 19334 1747bf __Getctype 19333->19334 19336 92213 19335->19336 19337 17065e ___std_exception_copy 19335->19337 19336->19251 19337->19336 19338 17068b 19337->19338 19341 1856b8 19337->19341 19350 17d7d6 19338->19350 19342 1856c6 19341->19342 19343 1856d4 19341->19343 19342->19343 19348 1856ec 19342->19348 19353 17d23f 19343->19353 19345 1856dc 19356 1747a0 19345->19356 19347 1856e6 19347->19338 19348->19347 19349 17d23f __dosmaperr RtlAllocateHeap 19348->19349 19349->19345 19351 186db3 ___std_exception_destroy RtlAllocateHeap 19350->19351 19352 17d7ee 19351->19352 19352->19336 19359 185d2c 19353->19359 19464 1746ec 19356->19464 19360 185d35 __dosmaperr 19359->19360 19367 17d244 19360->19367 19370 1863f3 19360->19370 19362 185d79 __dosmaperr 19363 185db9 19362->19363 19364 185d81 __dosmaperr 19362->19364 19378 185a09 19363->19378 19374 186db3 19364->19374 19367->19345 19369 186db3 ___std_exception_destroy RtlAllocateHeap 19369->19367 19373 186400 __dosmaperr std::_Facet_Register 19370->19373 19371 18642b RtlAllocateHeap 19372 18643e __dosmaperr 19371->19372 19371->19373 19372->19362 19373->19371 19373->19372 19375 186dbe __dosmaperr 19374->19375 19377 186de8 19374->19377 19376 17d23f __dosmaperr RtlAllocateHeap 19375->19376 19375->19377 19376->19377 19377->19367 19379 185a77 __dosmaperr 19378->19379 19382 1859af 19379->19382 19381 185aa0 19381->19369 19383 1859bb __fread_nolock std::_Lockit::_Lockit 19382->19383 19386 185b90 19383->19386 19385 1859dd __dosmaperr 19385->19381 19387 185bc6 __Getctype 19386->19387 19388 185b9f __Getctype 19386->19388 19387->19385 19388->19387 19390 18f2a7 19388->19390 19391 18f327 19390->19391 19394 18f2bd 19390->19394 19393 186db3 ___std_exception_destroy RtlAllocateHeap 19391->19393 19416 18f375 19391->19416 19395 18f349 19393->19395 19394->19391 19396 18f2f0 19394->19396 19398 186db3 ___std_exception_destroy RtlAllocateHeap 19394->19398 19397 186db3 ___std_exception_destroy RtlAllocateHeap 19395->19397 19405 186db3 ___std_exception_destroy RtlAllocateHeap 19396->19405 19417 18f312 19396->19417 19399 18f35c 19397->19399 19403 18f2e5 19398->19403 19404 186db3 ___std_exception_destroy RtlAllocateHeap 19399->19404 19400 186db3 ___std_exception_destroy RtlAllocateHeap 19406 18f31c 19400->19406 19401 18f3e3 19407 186db3 ___std_exception_destroy RtlAllocateHeap 19401->19407 19402 18f383 19402->19401 19415 186db3 RtlAllocateHeap ___std_exception_destroy 19402->19415 19418 18e5ab 19403->19418 19409 18f36a 19404->19409 19410 18f307 19405->19410 19411 186db3 ___std_exception_destroy RtlAllocateHeap 19406->19411 19412 18f3e9 19407->19412 19413 186db3 ___std_exception_destroy RtlAllocateHeap 19409->19413 19446 18ea0a 19410->19446 19411->19391 19412->19387 19413->19416 19415->19402 19458 18f418 19416->19458 19417->19400 19419 18e5bc 19418->19419 19420 18e6a5 19418->19420 19421 18e5cd 19419->19421 19422 186db3 ___std_exception_destroy RtlAllocateHeap 19419->19422 19420->19396 19423 18e5df 19421->19423 19424 186db3 ___std_exception_destroy RtlAllocateHeap 19421->19424 19422->19421 19425 18e5f1 19423->19425 19427 186db3 ___std_exception_destroy RtlAllocateHeap 19423->19427 19424->19423 19426 18e603 19425->19426 19428 186db3 ___std_exception_destroy RtlAllocateHeap 19425->19428 19429 18e615 19426->19429 19430 186db3 ___std_exception_destroy RtlAllocateHeap 19426->19430 19427->19425 19428->19426 19431 18e627 19429->19431 19432 186db3 ___std_exception_destroy RtlAllocateHeap 19429->19432 19430->19429 19433 18e639 19431->19433 19435 186db3 ___std_exception_destroy RtlAllocateHeap 19431->19435 19432->19431 19434 18e64b 19433->19434 19436 186db3 ___std_exception_destroy RtlAllocateHeap 19433->19436 19437 18e65d 19434->19437 19438 186db3 ___std_exception_destroy RtlAllocateHeap 19434->19438 19435->19433 19436->19434 19439 18e66f 19437->19439 19440 186db3 ___std_exception_destroy RtlAllocateHeap 19437->19440 19438->19437 19441 18e681 19439->19441 19443 186db3 ___std_exception_destroy RtlAllocateHeap 19439->19443 19440->19439 19442 18e693 19441->19442 19444 186db3 ___std_exception_destroy RtlAllocateHeap 19441->19444 19442->19420 19445 186db3 ___std_exception_destroy RtlAllocateHeap 19442->19445 19443->19441 19444->19442 19445->19420 19447 18ea17 19446->19447 19457 18ea6f 19446->19457 19448 18ea27 19447->19448 19449 186db3 ___std_exception_destroy RtlAllocateHeap 19447->19449 19450 18ea39 19448->19450 19451 186db3 ___std_exception_destroy RtlAllocateHeap 19448->19451 19449->19448 19452 18ea4b 19450->19452 19453 186db3 ___std_exception_destroy RtlAllocateHeap 19450->19453 19451->19450 19454 18ea5d 19452->19454 19455 186db3 ___std_exception_destroy RtlAllocateHeap 19452->19455 19453->19452 19456 186db3 ___std_exception_destroy RtlAllocateHeap 19454->19456 19454->19457 19455->19454 19456->19457 19457->19417 19459 18f425 19458->19459 19460 18f444 19458->19460 19459->19460 19461 18ef31 __Getctype RtlAllocateHeap 19459->19461 19460->19402 19462 18f43e 19461->19462 19463 186db3 ___std_exception_destroy RtlAllocateHeap 19462->19463 19463->19460 19465 1746fe __fread_nolock 19464->19465 19470 174723 19465->19470 19467 174716 19477 1744dc 19467->19477 19471 174733 19470->19471 19473 17473a __fread_nolock __Getctype 19470->19473 19483 174541 19471->19483 19474 174748 19473->19474 19475 1746ec __fread_nolock RtlAllocateHeap 19473->19475 19474->19467 19476 1747ac 19475->19476 19476->19467 19478 1744e8 19477->19478 19479 1744ff 19478->19479 19498 174587 19478->19498 19481 174512 19479->19481 19482 174587 __fread_nolock RtlAllocateHeap 19479->19482 19481->19347 19482->19481 19484 174550 19483->19484 19487 185ddd 19484->19487 19488 185df0 __dosmaperr 19487->19488 19489 174572 19488->19489 19490 1863f3 __dosmaperr RtlAllocateHeap 19488->19490 19489->19473 19491 185e20 __dosmaperr 19490->19491 19492 185e5c 19491->19492 19493 185e28 __dosmaperr 19491->19493 19494 185a09 __dosmaperr RtlAllocateHeap 19492->19494 19495 186db3 ___std_exception_destroy RtlAllocateHeap 19493->19495 19496 185e67 19494->19496 19495->19489 19497 186db3 ___std_exception_destroy RtlAllocateHeap 19496->19497 19497->19489 19499 174591 19498->19499 19500 17459a 19498->19500 19501 174541 __fread_nolock RtlAllocateHeap 19499->19501 19500->19479 19502 174596 19501->19502 19502->19500 19505 180259 19502->19505 19506 18025e std::locale::_Setgloballocale 19505->19506 19509 180269 std::locale::_Setgloballocale 19506->19509 19511 18c7c6 19506->19511 19532 17f224 19509->19532 19517 18c7d2 __fread_nolock 19511->19517 19512 18c834 std::_Lockit::_Lockit std::locale::_Setgloballocale 19520 18c9a4 std::_Lockit::~_Lockit 19512->19520 19521 18c8a7 19512->19521 19523 18c8d5 std::locale::_Setgloballocale 19512->19523 19513 185d2c __dosmaperr RtlAllocateHeap 19515 18c803 std::locale::_Setgloballocale 19513->19515 19514 18c822 19516 17d23f __dosmaperr RtlAllocateHeap 19514->19516 19515->19512 19515->19514 19524 18c80c 19515->19524 19518 18c827 19516->19518 19517->19512 19517->19513 19517->19514 19517->19515 19519 1747a0 __fread_nolock RtlAllocateHeap 19518->19519 19519->19524 19522 17f224 std::locale::_Setgloballocale RtlAllocateHeap 19520->19522 19521->19523 19535 185bdb 19521->19535 19525 18c9b7 19522->19525 19523->19524 19527 185bdb __Getctype RtlAllocateHeap 19523->19527 19530 18c92a 19523->19530 19524->19509 19527->19530 19529 185bdb __Getctype RtlAllocateHeap 19529->19523 19530->19524 19531 185bdb __Getctype RtlAllocateHeap 19530->19531 19531->19524 19549 17f094 19532->19549 19534 17f235 19536 185be4 __dosmaperr 19535->19536 19537 1863f3 __dosmaperr RtlAllocateHeap 19536->19537 19539 185bfb 19536->19539 19540 185c28 __dosmaperr 19537->19540 19538 185c8b 19538->19529 19539->19538 19541 180259 __Getctype RtlAllocateHeap 19539->19541 19542 185c68 19540->19542 19544 185c30 __dosmaperr 19540->19544 19543 185c95 19541->19543 19546 185a09 __dosmaperr RtlAllocateHeap 19542->19546 19545 186db3 ___std_exception_destroy RtlAllocateHeap 19544->19545 19545->19539 19547 185c73 19546->19547 19548 186db3 ___std_exception_destroy RtlAllocateHeap 19547->19548 19548->19539 19550 17f0c1 std::locale::_Setgloballocale 19549->19550 19551 17ef23 std::locale::_Setgloballocale RtlAllocateHeap 19550->19551 19552 17f10a std::locale::_Setgloballocale 19551->19552 19552->19534 19567 16d6e9 19553->19567 19564 921de Concurrency::cancel_current_task 19563->19564 19565 170651 ___std_exception_copy RtlAllocateHeap 19564->19565 19566 92213 19565->19566 19566->19296 19570 16d4af 19567->19570 19569 16d6fa Concurrency::cancel_current_task 19573 93010 19570->19573 19574 170651 ___std_exception_copy RtlAllocateHeap 19573->19574 19575 9303d 19574->19575 19575->19569 19578 1752ac __fread_nolock 19576->19578 19577 1752b3 19579 17d23f __dosmaperr RtlAllocateHeap 19577->19579 19578->19577 19580 1752d3 19578->19580 19581 1752b8 19579->19581 19582 1752e5 19580->19582 19583 1752d8 19580->19583 19584 1747a0 __fread_nolock RtlAllocateHeap 19581->19584 19590 186688 19582->19590 19585 17d23f __dosmaperr RtlAllocateHeap 19583->19585 19589 1752c3 19584->19589 19585->19589 19587 1752ee 19588 17d23f __dosmaperr RtlAllocateHeap 19587->19588 19587->19589 19588->19589 19589->19305 19591 186694 __fread_nolock std::_Lockit::_Lockit 19590->19591 19594 18672c 19591->19594 19593 1866af 19593->19587 19597 18674f __fread_nolock 19594->19597 19595 186795 __fread_nolock 19595->19593 19596 1863f3 __dosmaperr RtlAllocateHeap 19598 1867b0 19596->19598 19597->19595 19597->19596 19599 186db3 ___std_exception_destroy RtlAllocateHeap 19598->19599 19599->19595 19601 178e99 __fread_nolock 19600->19601 19602 178e9f 19601->19602 19604 178ee2 __fread_nolock 19601->19604 19603 174723 __fread_nolock RtlAllocateHeap 19602->19603 19606 178eba 19603->19606 19607 179010 19604->19607 19606->19309 19608 179036 19607->19608 19609 179023 19607->19609 19616 178f37 19608->19616 19609->19606 19611 179059 19615 1790e7 19611->19615 19620 1755d3 19611->19620 19615->19606 19617 178fa0 19616->19617 19618 178f48 19616->19618 19617->19611 19618->19617 19629 17e13d 19618->19629 19621 1755ec 19620->19621 19625 175613 19620->19625 19621->19625 19656 185f82 19621->19656 19623 175608 19663 18538b 19623->19663 19626 17e17d 19625->19626 19627 17e05c __fread_nolock 2 API calls 19626->19627 19628 17e196 19627->19628 19628->19615 19630 17e151 __fread_nolock 19629->19630 19635 17e05c 19630->19635 19632 17e166 19633 1744dc __fread_nolock RtlAllocateHeap 19632->19633 19634 17e175 19633->19634 19634->19617 19640 18a6de 19635->19640 19637 17e06e 19638 17e08a SetFilePointerEx 19637->19638 19639 17e076 __fread_nolock 19637->19639 19638->19639 19639->19632 19641 18a6eb 19640->19641 19642 18a700 19640->19642 19653 17d22c 19641->19653 19645 17d22c __dosmaperr RtlAllocateHeap 19642->19645 19647 18a725 19642->19647 19648 18a730 19645->19648 19646 17d23f __dosmaperr RtlAllocateHeap 19649 18a6f8 19646->19649 19647->19637 19650 17d23f __dosmaperr RtlAllocateHeap 19648->19650 19649->19637 19651 18a738 19650->19651 19652 1747a0 __fread_nolock RtlAllocateHeap 19651->19652 19652->19649 19654 185d2c __dosmaperr RtlAllocateHeap 19653->19654 19655 17d231 19654->19655 19655->19646 19657 185f8e 19656->19657 19658 185fa3 19656->19658 19659 17d23f __dosmaperr RtlAllocateHeap 19657->19659 19658->19623 19660 185f93 19659->19660 19661 1747a0 __fread_nolock RtlAllocateHeap 19660->19661 19662 185f9e 19661->19662 19662->19623 19664 185397 __fread_nolock 19663->19664 19665 1853d8 19664->19665 19667 18541e 19664->19667 19669 18539f 19664->19669 19666 174723 __fread_nolock RtlAllocateHeap 19665->19666 19666->19669 19667->19669 19670 18549c 19667->19670 19669->19625 19671 1854c4 19670->19671 19683 1854e7 __fread_nolock 19670->19683 19672 1854c8 19671->19672 19674 185523 19671->19674 19673 174723 __fread_nolock RtlAllocateHeap 19672->19673 19673->19683 19675 185541 19674->19675 19676 17e17d 2 API calls 19674->19676 19684 184fe1 19675->19684 19676->19675 19679 185559 19679->19683 19689 184bb2 19679->19689 19680 1855a0 19681 185609 WriteFile 19680->19681 19680->19683 19681->19683 19683->19669 19695 190d44 19684->19695 19686 185021 19686->19679 19686->19680 19687 184ff3 19687->19686 19704 179d10 19687->19704 19690 184c1a 19689->19690 19691 179d10 std::_Locinfo::_Locinfo_ctor 2 API calls 19690->19691 19693 184c2b std::_Locinfo::_Locinfo_ctor 19690->19693 19691->19693 19692 184ee1 _ValidateLocalCookies 19692->19683 19693->19692 19694 1884be RtlAllocateHeap RtlAllocateHeap 19693->19694 19694->19693 19696 190d5e 19695->19696 19697 190d51 19695->19697 19700 190d6a 19696->19700 19701 17d23f __dosmaperr RtlAllocateHeap 19696->19701 19698 17d23f __dosmaperr RtlAllocateHeap 19697->19698 19699 190d56 19698->19699 19699->19687 19700->19687 19702 190d8b 19701->19702 19703 1747a0 __fread_nolock RtlAllocateHeap 19702->19703 19703->19699 19705 174587 __fread_nolock RtlAllocateHeap 19704->19705 19706 179d20 19705->19706 19711 185ef3 19706->19711 19712 185f0a 19711->19712 19713 179d3d 19711->19713 19712->19713 19719 18f4f3 19712->19719 19715 185f51 19713->19715 19716 185f68 19715->19716 19717 179d4a 19715->19717 19716->19717 19728 18d81e 19716->19728 19717->19686 19720 18f4ff __fread_nolock 19719->19720 19721 185bdb __Getctype RtlAllocateHeap 19720->19721 19723 18f508 std::_Lockit::_Lockit 19721->19723 19722 18f54e 19722->19713 19723->19722 19724 18f574 __Getctype RtlAllocateHeap 19723->19724 19725 18f537 __Getctype 19724->19725 19725->19722 19726 180259 __Getctype RtlAllocateHeap 19725->19726 19727 18f573 19726->19727 19729 185bdb __Getctype RtlAllocateHeap 19728->19729 19730 18d823 19729->19730 19731 18d736 std::_Locinfo::_Locinfo_ctor RtlAllocateHeap RtlAllocateHeap 19730->19731 19732 18d82e 19731->19732 19732->19717 19734 17480d __fread_nolock 19733->19734 19735 174835 __fread_nolock 19734->19735 19736 174814 19734->19736 19740 174910 19735->19740 19737 174723 __fread_nolock RtlAllocateHeap 19736->19737 19739 17482d 19737->19739 19739->19315 19743 174942 19740->19743 19742 174922 19742->19739 19744 174951 19743->19744 19745 174979 19743->19745 19746 174723 __fread_nolock RtlAllocateHeap 19744->19746 19747 185f82 __fread_nolock RtlAllocateHeap 19745->19747 19748 17496c __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 19746->19748 19749 174982 19747->19749 19748->19742 19756 17e11f 19749->19756 19752 174a2c 19759 174cae 19752->19759 19754 174a43 19754->19748 19767 174ae3 19754->19767 19774 17df37 19756->19774 19758 1749a0 19758->19748 19758->19752 19758->19754 19760 174cbd 19759->19760 19761 185f82 __fread_nolock RtlAllocateHeap 19760->19761 19762 174cd9 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 19761->19762 19763 17e11f 2 API calls 19762->19763 19766 174ce5 _ValidateLocalCookies 19762->19766 19764 174d39 19763->19764 19765 17e11f 2 API calls 19764->19765 19764->19766 19765->19766 19766->19748 19768 185f82 __fread_nolock RtlAllocateHeap 19767->19768 19769 174af6 19768->19769 19770 174b40 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 19769->19770 19771 17e11f 2 API calls 19769->19771 19770->19748 19772 174b9d 19771->19772 19772->19770 19773 17e11f 2 API calls 19772->19773 19773->19770 19776 17df43 __fread_nolock 19774->19776 19775 17df86 19777 174723 __fread_nolock RtlAllocateHeap 19775->19777 19776->19775 19778 17dfcc 19776->19778 19780 17df4b 19776->19780 19777->19780 19779 17e05c __fread_nolock 2 API calls 19778->19779 19778->19780 19779->19780 19780->19758 19782 1006a9 19781->19782 19787 100585 19781->19787 19783 92270 RtlAllocateHeap 19782->19783 19785 1006ae 19783->19785 19784 10059a 19788 16f290 std::_Facet_Register RtlAllocateHeap 19784->19788 19786 921d0 Concurrency::cancel_current_task RtlAllocateHeap 19785->19786 19794 1005aa __fread_nolock std::_Locinfo::_Locinfo_ctor 19786->19794 19787->19784 19789 1005f0 19787->19789 19790 1005e3 19787->19790 19788->19794 19793 16f290 std::_Facet_Register RtlAllocateHeap 19789->19793 19789->19794 19790->19784 19790->19785 19791 1747b0 RtlAllocateHeap 19792 1006b8 19791->19792 19793->19794 19794->19791 19795 100667 __fread_nolock std::_Locinfo::_Locinfo_ctor 19794->19795 19795->19321 19797 17dc08 __fread_nolock 19796->19797 19798 17dc52 __fread_nolock 19797->19798 19799 17dc1b __fread_nolock 19797->19799 19803 17dc40 __fread_nolock 19797->19803 19805 17da06 19798->19805 19800 17d23f __dosmaperr RtlAllocateHeap 19799->19800 19801 17dc35 19800->19801 19804 1747a0 __fread_nolock RtlAllocateHeap 19801->19804 19803->19325 19804->19803 19809 17da18 __fread_nolock 19805->19809 19811 17da35 19805->19811 19806 17da25 19807 17d23f __dosmaperr RtlAllocateHeap 19806->19807 19808 17da2a 19807->19808 19810 1747a0 __fread_nolock RtlAllocateHeap 19808->19810 19809->19806 19809->19811 19813 17da76 __fread_nolock 19809->19813 19810->19811 19811->19803 19812 17dba1 __fread_nolock 19816 17d23f __dosmaperr RtlAllocateHeap 19812->19816 19813->19811 19813->19812 19815 185f82 __fread_nolock RtlAllocateHeap 19813->19815 19818 184623 19813->19818 19877 178a2b 19813->19877 19815->19813 19816->19808 19819 184635 19818->19819 19822 18464d 19818->19822 19820 17d22c __dosmaperr RtlAllocateHeap 19819->19820 19824 18463a 19820->19824 19821 18498f 19823 17d22c __dosmaperr RtlAllocateHeap 19821->19823 19822->19821 19825 184690 19822->19825 19826 184994 19823->19826 19827 17d23f __dosmaperr RtlAllocateHeap 19824->19827 19828 18469b 19825->19828 19832 184642 19825->19832 19836 1846cb 19825->19836 19829 17d23f __dosmaperr RtlAllocateHeap 19826->19829 19827->19832 19830 17d22c __dosmaperr RtlAllocateHeap 19828->19830 19831 1846a8 19829->19831 19833 1846a0 19830->19833 19835 1747a0 __fread_nolock RtlAllocateHeap 19831->19835 19832->19813 19834 17d23f __dosmaperr RtlAllocateHeap 19833->19834 19834->19831 19835->19832 19837 1846e4 19836->19837 19838 18471f 19836->19838 19839 1846f1 19836->19839 19837->19839 19844 18470d 19837->19844 19891 186e2d 19838->19891 19840 17d22c __dosmaperr RtlAllocateHeap 19839->19840 19842 1846f6 19840->19842 19846 17d23f __dosmaperr RtlAllocateHeap 19842->19846 19843 190d44 __fread_nolock RtlAllocateHeap 19861 18486b 19843->19861 19844->19843 19847 1846fd 19846->19847 19849 1747a0 __fread_nolock RtlAllocateHeap 19847->19849 19848 186db3 ___std_exception_destroy RtlAllocateHeap 19850 184739 19848->19850 19876 184708 __fread_nolock 19849->19876 19852 186db3 ___std_exception_destroy RtlAllocateHeap 19850->19852 19851 1848e3 ReadFile 19853 1848fb 19851->19853 19854 184957 19851->19854 19855 184740 19852->19855 19853->19854 19856 1848d4 19853->19856 19865 184964 19854->19865 19874 1848b5 19854->19874 19857 18474a 19855->19857 19858 184765 19855->19858 19868 184920 19856->19868 19869 184937 19856->19869 19856->19876 19862 17d23f __dosmaperr RtlAllocateHeap 19857->19862 19860 17e13d __fread_nolock 2 API calls 19858->19860 19859 186db3 ___std_exception_destroy RtlAllocateHeap 19859->19832 19860->19844 19861->19851 19864 18489b 19861->19864 19863 18474f 19862->19863 19866 17d22c __dosmaperr RtlAllocateHeap 19863->19866 19864->19856 19864->19874 19867 17d23f __dosmaperr RtlAllocateHeap 19865->19867 19866->19876 19870 184969 19867->19870 19902 184335 19868->19902 19869->19876 19912 18417b 19869->19912 19875 17d22c __dosmaperr RtlAllocateHeap 19870->19875 19874->19876 19897 17d1e5 19874->19897 19875->19876 19876->19859 19878 178a3c 19877->19878 19882 178a38 std::_Locinfo::_Locinfo_ctor 19877->19882 19879 178a43 19878->19879 19884 178a56 __fread_nolock 19878->19884 19880 17d23f __dosmaperr RtlAllocateHeap 19879->19880 19881 178a48 19880->19881 19883 1747a0 __fread_nolock RtlAllocateHeap 19881->19883 19882->19813 19883->19882 19884->19882 19885 178a84 19884->19885 19886 178a8d 19884->19886 19887 17d23f __dosmaperr RtlAllocateHeap 19885->19887 19886->19882 19889 17d23f __dosmaperr RtlAllocateHeap 19886->19889 19888 178a89 19887->19888 19890 1747a0 __fread_nolock RtlAllocateHeap 19888->19890 19889->19888 19890->19882 19892 186e6b 19891->19892 19893 186e3b __dosmaperr std::_Facet_Register 19891->19893 19894 17d23f __dosmaperr RtlAllocateHeap 19892->19894 19893->19892 19895 186e56 RtlAllocateHeap 19893->19895 19896 184730 19894->19896 19895->19893 19895->19896 19896->19848 19898 17d22c __dosmaperr RtlAllocateHeap 19897->19898 19899 17d1f0 __dosmaperr 19898->19899 19900 17d23f __dosmaperr RtlAllocateHeap 19899->19900 19901 17d203 19900->19901 19901->19876 19916 18402e 19902->19916 19905 1843d7 19909 184391 __fread_nolock 19905->19909 19910 17e13d __fread_nolock 2 API calls 19905->19910 19906 1843c7 19907 17d23f __dosmaperr RtlAllocateHeap 19906->19907 19908 18437d 19907->19908 19908->19876 19909->19908 19911 17d1e5 __dosmaperr RtlAllocateHeap 19909->19911 19910->19909 19911->19908 19913 1841b5 19912->19913 19914 184246 19913->19914 19915 17e13d __fread_nolock 2 API calls 19913->19915 19914->19876 19915->19914 19917 184062 19916->19917 19918 1840ce 19917->19918 19919 17e13d __fread_nolock 2 API calls 19917->19919 19918->19905 19918->19906 19918->19908 19918->19909 19919->19918 19921 178acf __fread_nolock 19920->19921 19922 178ad9 19921->19922 19924 178afc __fread_nolock 19921->19924 19923 174723 __fread_nolock RtlAllocateHeap 19922->19923 19925 178af4 19923->19925 19924->19925 19927 178b5a 19924->19927 19925->19329 19928 178b67 19927->19928 19929 178b8a 19927->19929 19930 174723 __fread_nolock RtlAllocateHeap 19928->19930 19931 1755d3 4 API calls 19929->19931 19932 178b82 19929->19932 19930->19932 19933 178ba2 19931->19933 19932->19925 19941 186ded 19933->19941 19936 185f82 __fread_nolock RtlAllocateHeap 19937 178bb6 19936->19937 19945 184a3f 19937->19945 19940 186db3 ___std_exception_destroy RtlAllocateHeap 19940->19932 19942 186e04 19941->19942 19944 178baa 19941->19944 19943 186db3 ___std_exception_destroy RtlAllocateHeap 19942->19943 19942->19944 19943->19944 19944->19936 19946 178bbd 19945->19946 19947 184a68 19945->19947 19946->19932 19946->19940 19948 184ab7 19947->19948 19950 184a8f 19947->19950 19949 174723 __fread_nolock RtlAllocateHeap 19948->19949 19949->19946 19952 1849ae 19950->19952 19953 1849ba __fread_nolock 19952->19953 19955 1849f9 19953->19955 19956 184b12 19953->19956 19955->19946 19957 18a6de __fread_nolock RtlAllocateHeap 19956->19957 19958 184b22 19957->19958 19960 184b5a 19958->19960 19962 18a6de __fread_nolock RtlAllocateHeap 19958->19962 19966 184b28 19958->19966 19961 18a6de __fread_nolock RtlAllocateHeap 19960->19961 19960->19966 19964 184b66 FindCloseChangeNotification 19961->19964 19963 184b51 19962->19963 19965 18a6de __fread_nolock RtlAllocateHeap 19963->19965 19964->19966 19965->19960 19968 18a64d 19966->19968 19967 184b80 __fread_nolock 19967->19955 19969 18a65c 19968->19969 19970 17d23f __dosmaperr RtlAllocateHeap 19969->19970 19973 18a686 19969->19973 19971 18a6c8 19970->19971 19972 17d22c __dosmaperr RtlAllocateHeap 19971->19972 19972->19973 19973->19967 21207 4be0997 21208 4be0a0f GetCurrentHwProfileW 21207->21208 21210 4be0afa 21208->21210 19974 ae0a0 WSAStartup 19975 ae0d8 19974->19975 19979 ae1a7 19974->19979 19976 ae175 socket 19975->19976 19975->19979 19977 ae18b connect 19976->19977 19976->19979 19978 ae19d closesocket 19977->19978 19977->19979 19978->19976 19978->19979 19987 17d168 19988 17d17b __fread_nolock 19987->19988 19993 17cf4a 19988->19993 19990 17d190 19991 1744dc __fread_nolock RtlAllocateHeap 19990->19991 19992 17d19d 19991->19992 19994 17cf80 19993->19994 19995 17cf58 19993->19995 19994->19990 19995->19994 19996 17cf87 19995->19996 19997 17cf65 19995->19997 20001 17cea3 19996->20001 19998 174723 __fread_nolock RtlAllocateHeap 19997->19998 19998->19994 20000 17cfbf 20000->19990 20002 17ceaf __fread_nolock 20001->20002 20005 17cefe 20002->20005 20004 17ceca 20004->20000 20012 188644 20005->20012 20032 188606 20012->20032 20014 188655 20015 186e2d std::_Locinfo::_Locinfo_ctor 2 API calls 20014->20015 20018 17cf16 20014->20018 20016 1886ae 20015->20016 20017 186db3 ___std_exception_destroy RtlAllocateHeap 20016->20017 20017->20018 20019 17cfc1 20018->20019 20021 17cfd3 20019->20021 20023 17cf34 20019->20023 20020 17cfe1 20022 174723 __fread_nolock RtlAllocateHeap 20020->20022 20021->20020 20021->20023 20026 17d017 std::_Locinfo::_Locinfo_ctor 20021->20026 20022->20023 20028 1886ef 20023->20028 20024 1755d3 4 API calls 20024->20026 20025 185f82 __fread_nolock RtlAllocateHeap 20025->20026 20026->20023 20026->20024 20026->20025 20027 18538b 4 API calls 20026->20027 20027->20026 20029 1886fa 20028->20029 20030 17cf40 20028->20030 20029->20030 20031 1755d3 4 API calls 20029->20031 20030->20004 20031->20030 20033 188612 20032->20033 20034 18863c 20033->20034 20035 185f82 __fread_nolock RtlAllocateHeap 20033->20035 20034->20014 20036 18862d 20035->20036 20037 190d44 __fread_nolock RtlAllocateHeap 20036->20037 20038 188633 20037->20038 20038->20014 20039 4be0b01 20040 4be0aa1 20039->20040 20041 4be0afa 20040->20041 20042 4be0ad0 GetCurrentHwProfileW 20040->20042 20042->20041

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 150 f3a40-f3a52 151 f3a55-f3a61 150->151 153 f3b28-f3b31 GetPEB 151->153 154 f3a67-f3a6d 151->154 155 f3b34-f3b48 153->155 154->153 156 f3a73-f3a7f GetPEB 154->156 157 f3b4a-f3b4f 155->157 158 f3b99-f3b9b 155->158 159 f3a80-f3a94 156->159 157->158 160 f3b51-f3b59 157->160 158->155 161 f3a96-f3a9b 159->161 162 f3ae4-f3ae6 159->162 163 f3b60-f3b73 160->163 161->162 164 f3a9d-f3aa3 161->164 162->159 165 f3b75-f3b88 163->165 166 f3b92-f3b97 163->166 167 f3aa5-f3ab8 164->167 165->165 168 f3b8a-f3b90 165->168 166->158 166->163 169 f3add-f3ae2 167->169 170 f3aba 167->170 168->166 171 f3b9d-f3bc2 Sleep 168->171 169->162 169->167 172 f3ac0-f3ad3 170->172 171->151 172->172 173 f3ad5-f3adb 172->173 173->169 174 f3ae8-f3b0d Sleep 173->174 175 f3b13-f3b1a 174->175 175->153 176 f3b1c-f3b22 175->176 176->153 177 f3bc7-f3bd8 call 96bd0 176->177 180 f3bde 177->180 181 f3bda-f3bdc 177->181 182 f3be0-f3bfd call 96bd0 180->182 181->182
                                  APIs
                                  • Sleep.KERNELBASE(000003E9,?,00000001,00000000,?,?,?,?,?,?,?,?,000F3DB6), ref: 000F3B08
                                  • Sleep.KERNELBASE(00000001,?,00000001,00000000,?,?,?,?,?,?,?,?,000F3DB6), ref: 000F3BBA
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000006.00000002.4129151147.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129248250.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129557648.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130326696.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130608914.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: Sleep
                                  • String ID:
                                  • API String ID: 3472027048-0
                                  • Opcode ID: 4b506305717294d5d74707611b31c074e13bf6740377d5a265901e1ef9e6ad7a
                                  • Instruction ID: a811a4e20886ff2e81cdb47d13103c210d01b0db4cd875ba52cfbb524817a802
                                  • Opcode Fuzzy Hash: 4b506305717294d5d74707611b31c074e13bf6740377d5a265901e1ef9e6ad7a
                                  • Instruction Fuzzy Hash: CD51C835A042199FCB24CF48C8E0EBAB3F1FF45724B28449AD645ABB52D731EE45DB80

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 0 ae0a0-ae0d2 WSAStartup 1 ae0d8-ae102 call 96bd0 * 2 0->1 2 ae1b7-ae1c0 0->2 7 ae10e-ae165 1->7 8 ae104-ae108 1->8 10 ae1b1 7->10 11 ae167-ae16d 7->11 8->2 8->7 10->2 12 ae16f 11->12 13 ae1c5-ae1cf 11->13 14 ae175-ae189 socket 12->14 13->10 17 ae1d1-ae1d9 13->17 14->10 16 ae18b-ae19b connect 14->16 18 ae19d-ae1a5 closesocket 16->18 19 ae1c1 16->19 18->14 20 ae1a7-ae1ab 18->20 19->13 20->10
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000006.00000002.4129151147.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129248250.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129557648.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130326696.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130608914.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: Startupclosesocketconnectsocket
                                  • String ID:
                                  • API String ID: 3098855095-0
                                  • Opcode ID: 56894a1bf25705064c3c42edf62e3a6fb81caf869352bfc3c41a3c814b193780
                                  • Instruction ID: a7314e1be920b2b0e8859c0e3859d522dcdcdbc7e662d47eb4d703cc1ab089fd
                                  • Opcode Fuzzy Hash: 56894a1bf25705064c3c42edf62e3a6fb81caf869352bfc3c41a3c814b193780
                                  • Instruction Fuzzy Hash: BE31C171605310ABE7209F65C848B6BB7E4EBC6774F104F1DF9A8A72D0D37599048BA2

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 21 16f290-16f293 22 16f2a2-16f2a5 call 17df2c 21->22 24 16f2aa-16f2ad 22->24 25 16f295-16f2a0 call 1817d8 24->25 26 16f2af-16f2b0 24->26 25->22 29 16f2b1-16f2b5 25->29 30 921d0-92220 call 921b0 call 170efb call 170651 29->30 31 16f2bb 29->31 31->31
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 0009220E
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000006.00000002.4129151147.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129248250.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129557648.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130326696.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130608914.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: `!$`!
                                  • API String ID: 2659868963-1174305143
                                  • Opcode ID: 8aed841b473b68f9eb65007730c7a68ac4ce50a3379f920c45c457fb712e03d7
                                  • Instruction ID: f63029ce59ff315aed0f986e4315aafc3869fedc89a889a500b891b6c5183d56
                                  • Opcode Fuzzy Hash: 8aed841b473b68f9eb65007730c7a68ac4ce50a3379f920c45c457fb712e03d7
                                  • Instruction Fuzzy Hash: F601F27650030DBBCB18AFA9EC0299977AC9B10320B50843DFA18DB691EB30E9658B91

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 38 184623-184633 39 18464d-18464f 38->39 40 184635-184648 call 17d22c call 17d23f 38->40 42 18498f-18499c call 17d22c call 17d23f 39->42 43 184655-18465b 39->43 58 1849a7 40->58 61 1849a2 call 1747a0 42->61 43->42 46 184661-18468a 43->46 46->42 47 184690-184699 46->47 50 18469b-1846ae call 17d22c call 17d23f 47->50 51 1846b3-1846b5 47->51 50->61 56 18498b-18498d 51->56 57 1846bb-1846bf 51->57 59 1849aa-1849ad 56->59 57->56 62 1846c5-1846c9 57->62 58->59 61->58 62->50 65 1846cb-1846e2 62->65 67 1846e4-1846e7 65->67 68 184717-18471d 65->68 71 1846e9-1846ef 67->71 72 18470d-184715 67->72 69 18471f-184726 68->69 70 1846f1-184708 call 17d22c call 17d23f call 1747a0 68->70 74 184728 69->74 75 18472a-184748 call 186e2d call 186db3 * 2 69->75 99 1848c2 70->99 71->70 71->72 73 18478a-1847a9 72->73 77 1847af-1847bb 73->77 78 184865-18486e call 190d44 73->78 74->75 108 18474a-184760 call 17d23f call 17d22c 75->108 109 184765-184788 call 17e13d 75->109 77->78 82 1847c1-1847c3 77->82 90 1848df 78->90 91 184870-184882 78->91 82->78 87 1847c9-1847ea 82->87 87->78 92 1847ec-184802 87->92 96 1848e3-1848f9 ReadFile 90->96 91->90 95 184884-184893 91->95 92->78 97 184804-184806 92->97 95->90 112 184895-184899 95->112 100 1848fb-184901 96->100 101 184957-184962 96->101 97->78 102 184808-18482b 97->102 104 1848c5-1848cf call 186db3 99->104 100->101 106 184903 100->106 121 18497b-18497e 101->121 122 184964-184976 call 17d23f call 17d22c 101->122 102->78 107 18482d-184843 102->107 104->59 114 184906-184918 106->114 107->78 115 184845-184847 107->115 108->99 109->73 112->96 120 18489b-1848b3 112->120 114->104 123 18491a-18491e 114->123 115->78 124 184849-184860 115->124 141 1848d4-1848dd 120->141 142 1848b5-1848ba 120->142 125 1848bb-1848c1 call 17d1e5 121->125 126 184984-184986 121->126 122->99 129 184920-184930 call 184335 123->129 130 184937-184944 123->130 124->78 125->99 126->104 148 184933-184935 129->148 131 184950-184955 call 18417b 130->131 132 184946 call 18448c 130->132 145 18494b-18494e 131->145 132->145 141->114 142->125 145->148 148->104
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000006.00000002.4129151147.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129248250.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129557648.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130326696.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130608914.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 305f1b2d47df6fd9b12cb76c45af53217479b53f9cd0033e42cf83b8cac2613d
                                  • Instruction ID: 6667b5fec2b65cd0e9c004ef7ae312de3ab06573d82955ada8f8498b32bb38a3
                                  • Opcode Fuzzy Hash: 305f1b2d47df6fd9b12cb76c45af53217479b53f9cd0033e42cf83b8cac2613d
                                  • Instruction Fuzzy Hash: CEB1E670E0424AAFDF15EFA8D841BAEBBB1AF5A314F154158E444A7292CF719E42CF50

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 185 9a210-9a2ab call 16f290 call 92ae0 190 9a2b0-9a2bb 185->190 190->190 191 9a2bd-9a2c8 190->191 192 9a2ca 191->192 193 9a2cd-9a2de call 175362 191->193 192->193 196 9a351-9a357 193->196 197 9a2e0-9a305 call 179136 call 174eeb call 179136 193->197 198 9a359-9a365 196->198 199 9a381-9a393 196->199 214 9a30c-9a316 197->214 215 9a307 197->215 201 9a377-9a37e call 16f511 198->201 202 9a367-9a375 198->202 201->199 202->201 204 9a394-9a3ae call 1747b0 202->204 213 9a3b0-9a3bb 204->213 213->213 216 9a3bd-9a3c8 213->216 217 9a328-9a32f call fcf60 214->217 218 9a318-9a31c 214->218 215->214 219 9a3ca 216->219 220 9a3cd-9a3df call 175362 216->220 226 9a334-9a33a 217->226 221 9a31e 218->221 222 9a320-9a326 218->222 219->220 227 9a3fc-9a403 220->227 228 9a3e1-9a3f9 call 179136 call 174eeb call 178be8 220->228 221->222 222->226 229 9a33c 226->229 230 9a33e-9a349 call 17dbdf call 178be8 226->230 232 9a42d-9a433 227->232 233 9a405-9a411 227->233 228->227 229->230 244 9a34e 230->244 236 9a423-9a42a call 16f511 233->236 237 9a413-9a421 233->237 236->232 237->236 240 9a434-9a45e call 1747b0 237->240 252 9a46f-9a474 240->252 253 9a460-9a464 240->253 244->196 253->252 254 9a466-9a46e 253->254
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000006.00000002.4129151147.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129248250.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129557648.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130326696.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130608914.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: __fread_nolock
                                  • String ID:
                                  • API String ID: 2638373210-0
                                  • Opcode ID: 6d9c4e1c2decaf45e6a333ef326f95fbe75f0b5137f048da65c1568678bdcaf2
                                  • Instruction ID: aa6586639a07bcd2b59d07f0790d510f118a2ce192ce12dbfc05b561e2f15205
                                  • Opcode Fuzzy Hash: 6d9c4e1c2decaf45e6a333ef326f95fbe75f0b5137f048da65c1568678bdcaf2
                                  • Instruction Fuzzy Hash: CE710770A00204ABDF14DF68DC49BAEBBF8EF42710F10856DF8199B682D7B59A45C7D2

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 255 18549c-1854be 256 1856b1 255->256 257 1854c4-1854c6 255->257 258 1856b3-1856b7 256->258 259 1854c8-1854e7 call 174723 257->259 260 1854f2-185515 257->260 268 1854ea-1854ed 259->268 262 18551b-185521 260->262 263 185517-185519 260->263 262->259 264 185523-185534 262->264 263->262 263->264 266 185536-185544 call 17e17d 264->266 267 185547-185557 call 184fe1 264->267 266->267 273 185559-18555f 267->273 274 1855a0-1855b2 267->274 268->258 277 185588-18559e call 184bb2 273->277 278 185561-185564 273->278 275 185609-185629 WriteFile 274->275 276 1855b4-1855ba 274->276 279 18562b-185631 275->279 280 185634 275->280 282 1855bc-1855bf 276->282 283 1855f5-185607 call 18505e 276->283 294 185581-185583 277->294 284 18556f-18557e call 184f79 278->284 285 185566-185569 278->285 279->280 287 185637-185642 280->287 288 1855e1-1855f3 call 185222 282->288 289 1855c1-1855c4 282->289 306 1855dc-1855df 283->306 284->294 285->284 290 185649-18564c 285->290 295 1856ac-1856af 287->295 296 185644-185647 287->296 288->306 297 1855ca-1855d7 call 185139 289->297 298 18564f-185651 289->298 290->298 294->287 295->258 296->290 297->306 303 18567f-18568b 298->303 304 185653-185658 298->304 309 18568d-185693 303->309 310 185695-1856a7 303->310 307 18565a-18566c 304->307 308 185671-18567a call 17d208 304->308 306->294 307->268 308->268 309->256 309->310 310->268
                                  APIs
                                  • WriteFile.KERNELBASE(?,00000000,00179087,?,00000000,00000000,00000000,?,00000000,?,0009A3EB,00179087,00000000,0009A3EB,?,?), ref: 00185621
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000006.00000002.4129151147.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129248250.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129557648.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130326696.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130608914.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: FileWrite
                                  • String ID:
                                  • API String ID: 3934441357-0
                                  • Opcode ID: a7b56c64c21f87c19ae2313eaf58e96a9766fa7d5e43f1dbc863f83f96711a88
                                  • Instruction ID: ecda4757367def6a151651b4e0dc054654501e7d954c5a14f76f46f9e1e4e5d2
                                  • Opcode Fuzzy Hash: a7b56c64c21f87c19ae2313eaf58e96a9766fa7d5e43f1dbc863f83f96711a88
                                  • Instruction Fuzzy Hash: C861A071904519AFDF15EFA8C884EEEBFBBEF19304F640149E804A7216D772DA418FA0

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 313 4be09d9-4be0ac5 325 4be0ad0-4be0aec GetCurrentHwProfileW 313->325 326 4be0afa-4be0bf8 call 4be0bf9 325->326
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04BE0AE7
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4135970016.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_4be0000_MPGPH131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: bb735063fe9e20643e0d862e1602375d229eeba9df5034e393b26f1f9d0d20d3
                                  • Instruction ID: f401bf31d61bc8c285a4c392b2591589d9495052aa80c3776e17f68e65079f05
                                  • Opcode Fuzzy Hash: bb735063fe9e20643e0d862e1602375d229eeba9df5034e393b26f1f9d0d20d3
                                  • Instruction Fuzzy Hash: FC3162E770C1397CB211A1962B14EFB56ADE6D5734B3194B7B807D2106F3D45A4A7031

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 338 4be09f4-4be0ac5 348 4be0ad0-4be0aec GetCurrentHwProfileW 338->348 349 4be0afa-4be0bf8 call 4be0bf9 348->349
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04BE0AE7
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4135970016.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_4be0000_MPGPH131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: 32fd6b93a02fb6320eaba3427a6285abb445b027f4800a2efa5265f714bef749
                                  • Instruction ID: 775d54b6589ad224ae01ad1c231470e935e8496f80ece11fb8a1e8519e636c8c
                                  • Opcode Fuzzy Hash: 32fd6b93a02fb6320eaba3427a6285abb445b027f4800a2efa5265f714bef749
                                  • Instruction Fuzzy Hash: 14318EE760C2797DB212A1922B10AFB67AEE6D673473194B7F807D2106E3C45A8A7131

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 361 174942-17494f 362 174951-174974 call 174723 361->362 363 174979-17498d call 185f82 361->363 368 174ae0-174ae2 362->368 369 174992-17499b call 17e11f 363->369 370 17498f 363->370 372 1749a0-1749af 369->372 370->369 373 1749b1 372->373 374 1749bf-1749c8 372->374 375 1749b7-1749b9 373->375 376 174a89-174a8e 373->376 377 1749dc-174a10 374->377 378 1749ca-1749d7 374->378 375->374 375->376 379 174ade-174adf 376->379 381 174a12-174a1c 377->381 382 174a6d-174a79 377->382 380 174adc 378->380 379->368 380->379 385 174a43-174a4f 381->385 386 174a1e-174a2a 381->386 383 174a90-174a93 382->383 384 174a7b-174a82 382->384 389 174a96-174a9e 383->389 384->376 385->383 388 174a51-174a6b call 174e59 385->388 386->385 387 174a2c-174a3e call 174cae 386->387 387->379 388->389 392 174aa0-174aa6 389->392 393 174ada 389->393 396 174abe-174ac2 392->396 397 174aa8-174abc call 174ae3 392->397 393->380 398 174ad5-174ad7 396->398 399 174ac4-174ad2 call 194a10 396->399 397->379 398->393 399->398
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000006.00000002.4129151147.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129248250.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129557648.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130326696.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130608914.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 57aee36122b921ed156cdc633340d2435ec300a39f86a74d23d8f5c99af136bc
                                  • Instruction ID: be292eba414ef51219a544f0fbbc851f1cb6c86321309a54a2a9c5b221dbc8fa
                                  • Opcode Fuzzy Hash: 57aee36122b921ed156cdc633340d2435ec300a39f86a74d23d8f5c99af136bc
                                  • Instruction Fuzzy Hash: 1351B374A40108AFDF14CF58C881AAABFB5EF59364F25C158E84E9B252D331DE81CB94

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 404 4be0997-4be0ac5 414 4be0ad0-4be0aec GetCurrentHwProfileW 404->414 415 4be0afa-4be0bf8 call 4be0bf9 414->415
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04BE0AE7
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4135970016.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_4be0000_MPGPH131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: e763638447417b52d097242a1e0d0d82c2db14ec2ebe1fa8f4451f04d660f851
                                  • Instruction ID: d4288b6074fe00b8c875b8b8539cb4a1b85c944066a57f8e1fc1d8d1edacdfd4
                                  • Opcode Fuzzy Hash: e763638447417b52d097242a1e0d0d82c2db14ec2ebe1fa8f4451f04d660f851
                                  • Instruction Fuzzy Hash: 97317EA760C2297CB212E5966B50AFB67AEE6D633473194B7F803D2106F3D45A8A7031

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 427 4be0a18-4be0ac5 435 4be0ad0-4be0aec GetCurrentHwProfileW 427->435 436 4be0afa-4be0bf8 call 4be0bf9 435->436
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04BE0AE7
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4135970016.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_4be0000_MPGPH131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: a369725acf6037104ed15888e0b4d0214f3c562201a412c95dfaac9aaecf24f1
                                  • Instruction ID: 6662bd379dd4b78fc8fbdda45aa2e7ce1b39d88b5f7c7986182f89e24582b278
                                  • Opcode Fuzzy Hash: a369725acf6037104ed15888e0b4d0214f3c562201a412c95dfaac9aaecf24f1
                                  • Instruction Fuzzy Hash: 1821D1E770C2357CB212A1962B50EFB67AEE6D673473094B7B803D2106F3C45A8A7131

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 448 100560-10057f 449 100585-100598 448->449 450 1006a9 call 92270 448->450 452 1005c0-1005c8 449->452 453 10059a 449->453 454 1006ae call 921d0 450->454 455 1005d1-1005d5 452->455 456 1005ca-1005cf 452->456 457 10059c-1005a1 453->457 463 1006b3-1006b8 call 1747b0 454->463 460 1005d7 455->460 461 1005d9-1005e1 455->461 456->457 458 1005a4-1005a5 call 16f290 457->458 466 1005aa-1005af 458->466 460->461 464 1005f0-1005f2 461->464 465 1005e3-1005e8 461->465 469 100601 464->469 470 1005f4-1005ff call 16f290 464->470 465->454 468 1005ee 465->468 466->463 472 1005b5-1005be 466->472 468->458 471 100603-100629 469->471 470->471 475 100680-1006a6 call 170f70 call 1714f0 471->475 476 10062b-100655 call 170f70 call 1714f0 471->476 472->471 486 100657-100665 476->486 487 100669-10067d call 16f511 476->487 486->463 488 100667 486->488 488->487
                                  APIs
                                  • Concurrency::cancel_current_task.LIBCPMT ref: 001006AE
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000006.00000002.4129151147.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129248250.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129557648.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130326696.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130608914.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: Concurrency::cancel_current_task
                                  • String ID:
                                  • API String ID: 118556049-0
                                  • Opcode ID: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
                                  • Instruction ID: 6beaaca6bb28c8514c0a32ef2d91f572dc319fd4b2748e27c46bec4b43867081
                                  • Opcode Fuzzy Hash: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
                                  • Instruction Fuzzy Hash: 0B412772A001149FCB16DF68DC806AE7BA6AF8D340F140169FC45DB382D771DE618BE1

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 491 4be0a44-4be0ac5 497 4be0ad0-4be0aec GetCurrentHwProfileW 491->497 498 4be0afa-4be0bf8 call 4be0bf9 497->498
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04BE0AE7
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4135970016.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_4be0000_MPGPH131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: 672293f14d8a0a0eaf3ad8df0529b48df24d07214f357c6a9074c3ae5983ee1d
                                  • Instruction ID: f967253135f33ccc41053e064ae1b18575d2e5b371c4cf4020be3fde59028066
                                  • Opcode Fuzzy Hash: 672293f14d8a0a0eaf3ad8df0529b48df24d07214f357c6a9074c3ae5983ee1d
                                  • Instruction Fuzzy Hash: 5121B1E770C2257CB211A1962B14EFB66AEF6D6734B3084B6F803D2106F3C45A4A3031

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 510 4be0a57-4be0ac5 515 4be0ad0-4be0aec GetCurrentHwProfileW 510->515 516 4be0afa-4be0bf8 call 4be0bf9 515->516
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04BE0AE7
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4135970016.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_4be0000_MPGPH131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: 0de182615a52a06b3d6b2a6b2a12eeb823aef191a58413b0104f105ca756eb53
                                  • Instruction ID: 6f66a4ba79a0255995ff403eae5fc85cb9ba333a4b2ea61c24ca37a84099ad15
                                  • Opcode Fuzzy Hash: 0de182615a52a06b3d6b2a6b2a12eeb823aef191a58413b0104f105ca756eb53
                                  • Instruction Fuzzy Hash: A6217CE760C2297DB212A5962F50EFBA7AEE5D673073184BAF803D2106F3C45A4A2131

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 528 4be0a73-4be0ac5 533 4be0ad0-4be0aec GetCurrentHwProfileW 528->533 534 4be0afa-4be0bf8 call 4be0bf9 533->534
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04BE0AE7
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4135970016.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_4be0000_MPGPH131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: decb8bc7f6353365c7942d8cab2c8d16f9865c24a0f418c79e9a74d2ae927e52
                                  • Instruction ID: 136a44b052bf41194d7353c1ccfc2773e39adbc1eb2b17e6ed72d77443cb67d6
                                  • Opcode Fuzzy Hash: decb8bc7f6353365c7942d8cab2c8d16f9865c24a0f418c79e9a74d2ae927e52
                                  • Instruction Fuzzy Hash: 37216DE760C2257CB212A1962F54EFBA7AEE5D673473184B7F803D2106F3C45A4A2031
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04BE0AE7
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4135970016.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_4be0000_MPGPH131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: bdbda248f36e808bae8f204e9ec4fec09f930039d7267ff4d413a11fe10852a5
                                  • Instruction ID: 0936958588c45848fdd31e03052474eef5f089a5cc112349911e94dbb7c4303f
                                  • Opcode Fuzzy Hash: bdbda248f36e808bae8f204e9ec4fec09f930039d7267ff4d413a11fe10852a5
                                  • Instruction Fuzzy Hash: FF218EF760C2257CB212A1962F10EFBA7AEE6D673473188B7F803D2106F3C45A4A2031
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04BE0AE7
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4135970016.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_4be0000_MPGPH131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: 35367ac84892877ff61bafc6148222534830dba727c7fb1a54a73fc0eb6a9818
                                  • Instruction ID: 4c24d99255e1196df04fb67bebe40310805ffc4ebeb19333f0d678c4d990dd88
                                  • Opcode Fuzzy Hash: 35367ac84892877ff61bafc6148222534830dba727c7fb1a54a73fc0eb6a9818
                                  • Instruction Fuzzy Hash: 79216DE770C2257CB212A1962B50AFBA6AEE6D673473188B6F803D6106F3C45A4A3071
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04BE0AE7
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4135970016.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_4be0000_MPGPH131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: 433cc9494d19aef21058ab493755ae48e8f1f8c19f321c5f4365d683c24ea48e
                                  • Instruction ID: 7680e41aafce3385b6da4c4947b3492aada6f3f7b6bf9d5ede8b13e3de70638d
                                  • Opcode Fuzzy Hash: 433cc9494d19aef21058ab493755ae48e8f1f8c19f321c5f4365d683c24ea48e
                                  • Instruction Fuzzy Hash: A521A1E760C1257DB212A1922F10EF7A7BEF6D673473084BAF803D6106F3D45A496131
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04BE0AE7
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4135970016.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_4be0000_MPGPH131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: c50fb17d866f45d90b5547b9430bdcb4ade90bdcafca7e2b0107abd756343b6b
                                  • Instruction ID: e5280e93bdaaf8a526bd6c6d75cc984699bc167bd56dc638d7f4dc372a3504d2
                                  • Opcode Fuzzy Hash: c50fb17d866f45d90b5547b9430bdcb4ade90bdcafca7e2b0107abd756343b6b
                                  • Instruction Fuzzy Hash: 611190E760C2257DB212A2926F14AF7A6AEF6D673473188BAF803D2106F3D45A496131
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04BE0AE7
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4135970016.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_4be0000_MPGPH131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: 56f66508da9269ed7ee5063e27d2fb611840fe5f6f27049f8681900d890f00c0
                                  • Instruction ID: b0fccd263491a6fb3628c78d4ee14c59bc38a8b0a07142fdc662ae708063553c
                                  • Opcode Fuzzy Hash: 56f66508da9269ed7ee5063e27d2fb611840fe5f6f27049f8681900d890f00c0
                                  • Instruction Fuzzy Hash: 86115EE760C2257DB212A2A22F54AFB67BEF5D673473184B6F803D6106F3C45A4A6131
                                  APIs
                                  • FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,001849F9,00000000,CF830579,001C1140,0000000C,00184AB5,00178BBD,?), ref: 00184B68
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000006.00000002.4129151147.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129248250.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129557648.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130326696.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130608914.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ChangeCloseFindNotification
                                  • String ID:
                                  • API String ID: 2591292051-0
                                  • Opcode ID: c32b50201dd9f89adaaafa23109c41b409feb64185c00069089ccb365cfa1dbc
                                  • Instruction ID: 73d3d34e3de03ffaf564354971dea81f9225f5ac7fca61646874092725ba489a
                                  • Opcode Fuzzy Hash: c32b50201dd9f89adaaafa23109c41b409feb64185c00069089ccb365cfa1dbc
                                  • Instruction Fuzzy Hash: 4B116B33A4122517E72472346841F7E678A8F92774F39024AF8089B1C2FF22DE814B99
                                  APIs
                                  • SetFilePointerEx.KERNELBASE(00000000,00000000,001C0DF8,0009A3EB,00000002,0009A3EB,00000000,?,?,?,0017E166,00000000,?,0009A3EB,00000002,001C0DF8), ref: 0017E098
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000006.00000002.4129151147.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129248250.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129557648.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130326696.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130608914.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: FilePointer
                                  • String ID:
                                  • API String ID: 973152223-0
                                  • Opcode ID: c67fa6529d8dedb37b61504b01e24b8cd7123e1d0cd9907e069b2f71aa65c841
                                  • Instruction ID: 7277388b4852e3dd2045fbde643beef6402a85615539b4668d9a4d7154798ee7
                                  • Opcode Fuzzy Hash: c67fa6529d8dedb37b61504b01e24b8cd7123e1d0cd9907e069b2f71aa65c841
                                  • Instruction Fuzzy Hash: B9010432610149AFCF099F58CC01C9E3BBADB85324B244288F8509B291EBB2ED918BD0
                                  APIs
                                  • RtlAllocateHeap.NTDLL(00000008,001791F7,00000000,?,00185D79,00000001,00000364,00000000,00000006,000000FF,?,00000000,0017D244,001789C3,001791F7,00000000), ref: 00186434
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000006.00000002.4129151147.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129248250.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129557648.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130326696.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130608914.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: AllocateHeap
                                  • String ID:
                                  • API String ID: 1279760036-0
                                  • Opcode ID: 66dea444254da7f7aeb2c0becc002235a8622622ebf3a4975bf0306049238b2f
                                  • Instruction ID: 0827c58f10c4c73ecd8524fd2c643e0fcecf3a052e6ca9641065fc009517761d
                                  • Opcode Fuzzy Hash: 66dea444254da7f7aeb2c0becc002235a8622622ebf3a4975bf0306049238b2f
                                  • Instruction Fuzzy Hash: E4F0E93250612466DB217B629C42B5F3B599F41B60F258021BC04A7181CF30DE114FF2
                                  APIs
                                  • RtlAllocateHeap.NTDLL(00000000,0018D635,4D88C033,?,0018D635,00000220,?,001857EF,4D88C033), ref: 00186E60
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000006.00000002.4129151147.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129248250.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129557648.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130326696.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130608914.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: AllocateHeap
                                  • String ID:
                                  • API String ID: 1279760036-0
                                  • Opcode ID: 55e2ffd965edd1e3d95fdcaa6a57d854565e586ee26a4c92a5ce2f03e884d97d
                                  • Instruction ID: c4c8f579c9e1117cc838821cdcb0f87de86539b560b72abaa5219998311c77cf
                                  • Opcode Fuzzy Hash: 55e2ffd965edd1e3d95fdcaa6a57d854565e586ee26a4c92a5ce2f03e884d97d
                                  • Instruction Fuzzy Hash: 85E0223A10062566EF30B665DC05B5B7A5DCF927B0F060120FC14960D0DF20CF018FE5
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4136048248.0000000004BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BF0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_4bf0000_MPGPH131.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 4f91aa9620fca5262902e3b472f4a24e62109e182d3af21189fb852012e848de
                                  • Instruction ID: e5b5310b47aa7f85023545b5ee4b61bb91aa8275f03cbce2576e805c53eb588d
                                  • Opcode Fuzzy Hash: 4f91aa9620fca5262902e3b472f4a24e62109e182d3af21189fb852012e848de
                                  • Instruction Fuzzy Hash: 26113BEB24C110BDA842B6D16E547FA7B2EF6D673073084A6F60F92523B2D92B4D7031
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4136048248.0000000004BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BF0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_4bf0000_MPGPH131.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 4618580ea2b804709b7e29658f0cd97f4e1b3574c4cb5845a18fe25495e6b436
                                  • Instruction ID: c8e57bc358119b15a00630a66aabd45fcc9073abbefd03bba5f2138b5b4f50c1
                                  • Opcode Fuzzy Hash: 4618580ea2b804709b7e29658f0cd97f4e1b3574c4cb5845a18fe25495e6b436
                                  • Instruction Fuzzy Hash: F11129EB24C110BDA84261D56F547FAAB2DE6D673073085A6F60FC2553F2D8274D7031
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4136048248.0000000004BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BF0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_4bf0000_MPGPH131.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: e7aa726637ba7d6bf55e3e9259d75111ee141d2da34b94acac8168c041f15856
                                  • Instruction ID: dd7e10f01ab32903bb0f018fef8a1c026d605fa7424b9410d346a8a4a567d730
                                  • Opcode Fuzzy Hash: e7aa726637ba7d6bf55e3e9259d75111ee141d2da34b94acac8168c041f15856
                                  • Instruction Fuzzy Hash: 6E1129DB24C120ADDC82A2E56D447F56F2AB69B6307304497E64F96563B1486A4EA130
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4136048248.0000000004BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BF0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_4bf0000_MPGPH131.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 77c89405f0a798d7422b57b3e6181b4e102fa5c2e7d3b88a05e66328dec13745
                                  • Instruction ID: a67385afe42c04607809715e39bffe32eceabb870ca4a5e7e3afec4a8d94471d
                                  • Opcode Fuzzy Hash: 77c89405f0a798d7422b57b3e6181b4e102fa5c2e7d3b88a05e66328dec13745
                                  • Instruction Fuzzy Hash: F9F0D69B34C121AD9881A1C52F446FAAA6EF5EB73073080A7B60FD1563B288674D7031
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4136048248.0000000004BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BF0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_4bf0000_MPGPH131.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: ef844a111be671a81818d91412711476d65616f42fe7288b34622e3bfa68b3c4
                                  • Instruction ID: 104d50c1f743c9eaedab93719f046f0a2eb3932aaec402d0fdbc74102f6cf1c7
                                  • Opcode Fuzzy Hash: ef844a111be671a81818d91412711476d65616f42fe7288b34622e3bfa68b3c4
                                  • Instruction Fuzzy Hash: 1CF0BB9B34C110ED9441B1C52F449BAAA6EF4EB73077081A7B60FD1563B298674D7131
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4136048248.0000000004BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BF0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_4bf0000_MPGPH131.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 95b1b3723fa6445a26f44c13d7659940922adb18a8bbadb6609fe062cdbfc599
                                  • Instruction ID: 6407c8e939e578776a28007cf9347325933043306549989574a31e2aeb09bdc6
                                  • Opcode Fuzzy Hash: 95b1b3723fa6445a26f44c13d7659940922adb18a8bbadb6609fe062cdbfc599
                                  • Instruction Fuzzy Hash: 40F0A0AB34C120ED9442B2DA6E459B9BF6AF59F33033041A7A20B829A37294275C7131
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4136048248.0000000004BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BF0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_4bf0000_MPGPH131.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: bed4e25b0a0935c3a9d98af3c429b97fde97a15bac9fd27a1c4b3a65bf49e3f7
                                  • Instruction ID: 648ddec31cc30d523d311cbb4d8c3d3f8e653a4736602b9f039fc3b35bda0733
                                  • Opcode Fuzzy Hash: bed4e25b0a0935c3a9d98af3c429b97fde97a15bac9fd27a1c4b3a65bf49e3f7
                                  • Instruction Fuzzy Hash: 28E022AB34C120AD9042B2DA2E455B97F5EE49F73233041A3E24FC4AA3B184261D7231
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000006.00000002.4129151147.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129248250.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129557648.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130326696.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130608914.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
                                  • Instruction ID: 5f47255837c40a3d706529b2864631ff549768cd2bd3c3258a366bbc38fb01fa
                                  • Opcode Fuzzy Hash: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
                                  • Instruction Fuzzy Hash: E9023C71E412199BDF14CFA9D8846AEFBF1FF48314F258269E519E7380DB31AA41CB90
                                  APIs
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 000FF833
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 000FF855
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 000FF875
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 000FF89F
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 000FF90D
                                  • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000FF959
                                  • std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 000FF973
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 000FFA08
                                  • std::_Facet_Register.LIBCPMT ref: 000FFA15
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000006.00000002.4129151147.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129248250.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129557648.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130326696.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130608914.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
                                  • String ID: bad locale name$Ps
                                  • API String ID: 3375549084-1174896957
                                  • Opcode ID: 294444fddf1b518aba4229b468bfd9701cc482618184ed3a113dd1e108a2f08c
                                  • Instruction ID: 872a0c3800515b49a2e4b2167c741a8a6c3b3d1479f064bba62044f3cf1949a5
                                  • Opcode Fuzzy Hash: 294444fddf1b518aba4229b468bfd9701cc482618184ed3a113dd1e108a2f08c
                                  • Instruction Fuzzy Hash: 6961B071E0024D9BDF10DFA4D845BAEBBF4BF14350F144068E908A7781EB75E905CBA2
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 00093E7F
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000006.00000002.4129151147.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129248250.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129557648.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130326696.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130608914.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: @3$@3$G>$G>$`!$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                  • API String ID: 2659868963-1078880228
                                  • Opcode ID: 25954e1051915b58708859f561d53b6352cb7b99ef885c255ef7892f58979086
                                  • Instruction ID: 8b9dddc28789992660394ca21fd2a173151d3090e8ac1e1f91c698e2f420ca4b
                                  • Opcode Fuzzy Hash: 25954e1051915b58708859f561d53b6352cb7b99ef885c255ef7892f58979086
                                  • Instruction Fuzzy Hash: C54182B2904204AFCB18DF58D845BAEB7F9EB49310F14852EF919D7681E770AA018FA0
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 00093E7F
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000006.00000002.4129151147.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129248250.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129557648.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130326696.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130608914.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: @3$@3$`!$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                  • API String ID: 2659868963-1863890269
                                  • Opcode ID: ff04dc713bc958787fbb90287c2c3ea8d36c4b3d3733c7c902f007e601e7c1fe
                                  • Instruction ID: 3ff57f4b4e684199225e5f663cdfcb3c3375dd473981fc117fb08346ed1b42df
                                  • Opcode Fuzzy Hash: ff04dc713bc958787fbb90287c2c3ea8d36c4b3d3733c7c902f007e601e7c1fe
                                  • Instruction Fuzzy Hash: 26210DB29043046FCB14DF58D805F96B7ECAB18310F18882EFA69DB681E770EA14DF91
                                  APIs
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 00094F72
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 00094FFF
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 000950C8
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000006.00000002.4129151147.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129248250.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129557648.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130326696.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130608914.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_destroy$___std_exception_copy
                                  • String ID: @3$`!$recursive_directory_iterator::operator++
                                  • API String ID: 1206660477-1018949397
                                  • Opcode ID: c230f281f2ffae2512521e0559c58af9494e08e4cdd77e9d53d98ef82582593e
                                  • Instruction ID: 35ba5fa24e6031213c45de8a998a8abfeeeb7ae21f409fd52b8deb71414c0a0f
                                  • Opcode Fuzzy Hash: c230f281f2ffae2512521e0559c58af9494e08e4cdd77e9d53d98ef82582593e
                                  • Instruction Fuzzy Hash: 9AE1F4B19002049FDB28DF68D845FAEB7F9FF48300F108A2DE45693B82D774A945CBA1
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 0009799A
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 00097B75
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000006.00000002.4129151147.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129248250.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129557648.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130326696.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130608914.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: `!$`!$out_of_range$type_error
                                  • API String ID: 2659868963-2269780633
                                  • Opcode ID: 733c27003c7f875e01bd4801a8a3718b1903ee323306203927a1521cd24ef531
                                  • Instruction ID: b9e720447f402c97917352a52612a17419401bf12c91cb9d739ef621f70299f3
                                  • Opcode Fuzzy Hash: 733c27003c7f875e01bd4801a8a3718b1903ee323306203927a1521cd24ef531
                                  • Instruction Fuzzy Hash: BAC169B19002089FDB18CFA8D984B9DFBF1FF49300F148669E419EB791E7749981CB50
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 000932C6
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 00093350
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000006.00000002.4129151147.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129248250.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129557648.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130326696.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130608914.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy___std_exception_destroy
                                  • String ID: +4$@3$`!$`!
                                  • API String ID: 2970364248-4089177709
                                  • Opcode ID: 4496339217beb850e6db5146a6d2fbfbd0a1742a65d17a99c7ba2944d2bdab1b
                                  • Instruction ID: 54c561783155b2cffa16f25d4bb89f76594856376a9943c45fafe2ae11632ede
                                  • Opcode Fuzzy Hash: 4496339217beb850e6db5146a6d2fbfbd0a1742a65d17a99c7ba2944d2bdab1b
                                  • Instruction Fuzzy Hash: CF516A71A002189FDF08CF98D885BEEBBF5FF59300F14812AE819A7391D774AA418B91
                                  APIs
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 00093A58
                                  • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00093AA4
                                  • __Getctype.LIBCPMT ref: 00093ABA
                                  • std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00093AE6
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 00093B7B
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000006.00000002.4129151147.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129248250.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129557648.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130326696.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130608914.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
                                  • String ID: bad locale name
                                  • API String ID: 1840309910-1405518554
                                  • Opcode ID: 7679ddfe8991f5d297dd776b22a35a1d7859a826e5fbb26496ad6609ff0b8892
                                  • Instruction ID: 91eca405778df0a83e7d4c16968b4ebcffff89055093b975e21f38152bd44019
                                  • Opcode Fuzzy Hash: 7679ddfe8991f5d297dd776b22a35a1d7859a826e5fbb26496ad6609ff0b8892
                                  • Instruction Fuzzy Hash: F55160B5D002089BEF10DFA4DD45B9EBBF8BF14314F148069E909AB341E775DA04CB62
                                  APIs
                                  • _ValidateLocalCookies.LIBCMT ref: 00172E47
                                  • ___except_validate_context_record.LIBVCRUNTIME ref: 00172E4F
                                  • _ValidateLocalCookies.LIBCMT ref: 00172ED8
                                  • __IsNonwritableInCurrentImage.LIBCMT ref: 00172F03
                                  • _ValidateLocalCookies.LIBCMT ref: 00172F58
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000006.00000002.4129151147.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129248250.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129557648.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130326696.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130608914.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                  • String ID: csm
                                  • API String ID: 1170836740-1018135373
                                  • Opcode ID: fbe51d52304a8b2cc70b096818ab0fb3221cf4bd7f4df3deb4a69f609919d696
                                  • Instruction ID: 40328a8ca2c6ae0524abcdb6a60f687b175440dd8f2eefc36b683b32615fc71c
                                  • Opcode Fuzzy Hash: fbe51d52304a8b2cc70b096818ab0fb3221cf4bd7f4df3deb4a69f609919d696
                                  • Instruction Fuzzy Hash: 14418235A00209ABCF14DF68C885A9EBBB5FF55324F14C055E81C9B352DB31EE56CB91
                                  APIs
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 000FDE93
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 000FDEB6
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 000FDED6
                                  • std::_Facet_Register.LIBCPMT ref: 000FDF4B
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 000FDF63
                                  • Concurrency::cancel_current_task.LIBCPMT ref: 000FDF7B
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000006.00000002.4129151147.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129248250.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129557648.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130326696.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130608914.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
                                  • String ID:
                                  • API String ID: 2081738530-0
                                  • Opcode ID: 92eb7d8c78ae2d44e0a67f0223c843228965a96f6511fc4d0edd75950442899b
                                  • Instruction ID: f19d82cbcdd3a5d085039941d63a4f45359b5a8ac17fe51eb4009737f344e909
                                  • Opcode Fuzzy Hash: 92eb7d8c78ae2d44e0a67f0223c843228965a96f6511fc4d0edd75950442899b
                                  • Instruction Fuzzy Hash: AF41FE71A002199BCB10EF54D884EAEBBB5FB10320F10426AE9059BB52D731ED44CBD1
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 00097340
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000006.00000002.4129151147.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129248250.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129557648.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130326696.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130608914.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: `!$`!$parse error$parse_error
                                  • API String ID: 2659868963-929550935
                                  • Opcode ID: 4ea84be766665424ba6e648cc1001b051c29b5649763ad31d51918cbd9caafbe
                                  • Instruction ID: 3a877a7c4a7b9bb6ca1a76da8f8292a2d58292a953724f22a7b570b1b71fe6eb
                                  • Opcode Fuzzy Hash: 4ea84be766665424ba6e648cc1001b051c29b5649763ad31d51918cbd9caafbe
                                  • Instruction Fuzzy Hash: 79E16D719142088FDB18CF68C884B9DBBB1FF48300F24826DE419EB792D7749A85DF51
                                  APIs
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 000975BE
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 000975CD
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000006.00000002.4129151147.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129248250.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129557648.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130326696.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130608914.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_destroy
                                  • String ID: at line $, column $`!
                                  • API String ID: 4194217158-2977949356
                                  • Opcode ID: ccefab20a4e256d7e752f95bcb3527a6a11ff6698df24c53d15fe9fb8e955e0f
                                  • Instruction ID: abd381724ff7639ace0674070c801a536b2c520404b57c99aaa03f225627d84a
                                  • Opcode Fuzzy Hash: ccefab20a4e256d7e752f95bcb3527a6a11ff6698df24c53d15fe9fb8e955e0f
                                  • Instruction Fuzzy Hash: 9B61E671A046049FDF08DF68DC84B9DBBB6FF48300F24862CE419A7782D774AA45DB91
                                  APIs
                                    • Part of subcall function 00093190: ___std_exception_copy.LIBVCRUNTIME ref: 000932C6
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 0009345F
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000006.00000002.4129151147.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129248250.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129557648.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130326696.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130608914.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: +4$@3$@3$`!
                                  • API String ID: 2659868963-1914207329
                                  • Opcode ID: 18422242c34727452c111046a90dab25468ecf9a9569e3188b5def4d947f3fb7
                                  • Instruction ID: ebb52e20d4dad782f6203f8f2b0a6965170c1db1052a9511771e10c1dc61c845
                                  • Opcode Fuzzy Hash: 18422242c34727452c111046a90dab25468ecf9a9569e3188b5def4d947f3fb7
                                  • Instruction Fuzzy Hash: E13183B1900209AFCB18DFA8D941ADEFBF9FB08310F10852AF519E7651E770AA51CB90
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 0009345F
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000006.00000002.4129151147.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129248250.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129557648.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130326696.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130608914.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: +4$@3$@3$`!
                                  • API String ID: 2659868963-1914207329
                                  • Opcode ID: d69241f37684ee938f35d50bf9a6ba92661c1cb34b16b7a4aa5e3c14b2a9ce8e
                                  • Instruction ID: ec154226cbb1ff71b85ee3d87c401b52546654fc404efdbc0a21c2b66ca277f8
                                  • Opcode Fuzzy Hash: d69241f37684ee938f35d50bf9a6ba92661c1cb34b16b7a4aa5e3c14b2a9ce8e
                                  • Instruction Fuzzy Hash: 7F01FFB6500309AF8B04DFA9D545C96FBFDAF58310700C42AE519D7611EBB0E555CB90
                                  APIs
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 00096F11
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 00096F20
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000006.00000002.4129151147.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129248250.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129557648.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130326696.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130608914.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_destroy
                                  • String ID: [json.exception.$`!
                                  • API String ID: 4194217158-3048014091
                                  • Opcode ID: 93fe263e7740c341080adc509677843c5347fd3be96d9cc4557db85ec4720a15
                                  • Instruction ID: f0a463a16eeb7814293c8d33aba0083093226477beeb8d2eb0bb960d42ad4e9e
                                  • Opcode Fuzzy Hash: 93fe263e7740c341080adc509677843c5347fd3be96d9cc4557db85ec4720a15
                                  • Instruction Fuzzy Hash: 9891C470A002089FDF18CF68D984B9EBBF6FF59300F20866DE459AB792D775A941CB50
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 000977B4
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000006.00000002.4129151147.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129248250.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129557648.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130326696.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130608914.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: `!$`!$invalid_iterator
                                  • API String ID: 2659868963-3421541259
                                  • Opcode ID: 2cc77f91e07c8fd82a595194a78378f539f05fb00e072f7e0a0daf14b777d1b7
                                  • Instruction ID: 39f9d503a07cc501bb7851f81c66d33b561f70119edf335cff06732c741a4e83
                                  • Opcode Fuzzy Hash: 2cc77f91e07c8fd82a595194a78378f539f05fb00e072f7e0a0daf14b777d1b7
                                  • Instruction Fuzzy Hash: 63514AB19042089FDB18CFA8E99479DFBF1FB48300F14866DE419EB792E7749985CB90
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 00097D67
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000006.00000002.4129151147.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129248250.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129557648.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130326696.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130608914.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: `!$`!$other_error
                                  • API String ID: 2659868963-1899045556
                                  • Opcode ID: 21c77acb1f801fbd0beec41b8bab33980a15a57dd3a4f88ed2fe794bd8aad469
                                  • Instruction ID: 9279ae0ee39fd7ae06709a1591ce4f8b18d561a1318a597e4864116e1776381d
                                  • Opcode Fuzzy Hash: 21c77acb1f801fbd0beec41b8bab33980a15a57dd3a4f88ed2fe794bd8aad469
                                  • Instruction Fuzzy Hash: 0B5179B19012488FDB18CFA8D9847ADBBF1FF48300F148669E459EB782E774A985CB50
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 000FD06F
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 000FD096
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000006.00000002.4129151147.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129248250.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129557648.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130326696.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130608914.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: `!$`!
                                  • API String ID: 2659868963-1174305143
                                  • Opcode ID: d495d650bdd2eff5b5051cf6fce93e0b70afad023eb72b12187ea9384c3ac176
                                  • Instruction ID: 0dfc8d177f3cc2819fde84c338c0114c1c3b096db9facd992e1ca7700f39e03d
                                  • Opcode Fuzzy Hash: d495d650bdd2eff5b5051cf6fce93e0b70afad023eb72b12187ea9384c3ac176
                                  • Instruction Fuzzy Hash: 5D01F6B6500706AF8709CF58D504882FBF8FB48310311852FE529CBB00E7B0E529CFA0
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 0010B3DF
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 0010B406
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000006.00000002.4129151147.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129248250.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129557648.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130326696.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130608914.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: `!$`!
                                  • API String ID: 2659868963-1174305143
                                  • Opcode ID: 79f45bbaf531533b79d92ec0e5f7610964a74ec276e040c93bbc8e3dae03d6ed
                                  • Instruction ID: def7398e37b161bcdc926fe28cba8fff3afa6048e92668531c086ac312207693
                                  • Opcode Fuzzy Hash: 79f45bbaf531533b79d92ec0e5f7610964a74ec276e040c93bbc8e3dae03d6ed
                                  • Instruction Fuzzy Hash: 4AF0C4B6500706AF8709DF58D515886BBF8FA48710311852FE52ADBB11E7B0E529CBA0
                                  APIs
                                  • Concurrency::cancel_current_task.LIBCPMT ref: 0010E491
                                  Strings
                                  • type must be string, but is , xrefs: 0010E4F8
                                  • type must be boolean, but is , xrefs: 0010E582
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000006.00000002.4129151147.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129248250.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129557648.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130326696.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130608914.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: Concurrency::cancel_current_task
                                  • String ID: type must be boolean, but is $type must be string, but is
                                  • API String ID: 118556049-436076039
                                  • Opcode ID: 1da79b95eb64faa4f3999f22417817f74ba354fd4c3d8cdbce15bb513158af50
                                  • Instruction ID: 05a260621de4a06789b2a8414e7c775e246362e6797df2d79a539509ed80c81e
                                  • Opcode Fuzzy Hash: 1da79b95eb64faa4f3999f22417817f74ba354fd4c3d8cdbce15bb513158af50
                                  • Instruction Fuzzy Hash: B6416BB1900248AFDB14EBA4D902BEE77A8DB10310F044978F459D7AC3EB75EA10C791
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 00093078
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000006.00000002.4129248250.0000000000091000.00000040.00000001.01000000.00000005.sdmp, Offset: 00090000, based on PE: true
                                  • Associated: 00000006.00000002.4129151147.0000000000090000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129248250.00000000001C3000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129557648.00000000001C8000.00000004.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.00000000001CC000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000348000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000436000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.000000000046D000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000476000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4129613958.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130326696.0000000000485000.00000080.00000001.01000000.00000005.sdmpDownload File
                                  • Associated: 00000006.00000002.4130608914.000000000062C000.00000040.00000001.01000000.00000005.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_6_2_90000_MPGPH131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: `!$`!
                                  • API String ID: 2659868963-1174305143
                                  • Opcode ID: cdec5676e0b264cfc482e88fc2191b3951f3e2dd796ff4a25c83423a5ed27983
                                  • Instruction ID: a90d06c2f6cd3aab028f27cf62c2f2a915659e65671221f9119a2f2049bf97e6
                                  • Opcode Fuzzy Hash: cdec5676e0b264cfc482e88fc2191b3951f3e2dd796ff4a25c83423a5ed27983
                                  • Instruction Fuzzy Hash: 4BE0EDB2901308ABC711DFA8990598AFBF8AB19701F1186AAE948D7300F7B195558BD1

                                  Execution Graph

                                  Execution Coverage:3%
                                  Dynamic/Decrypted Code Coverage:3.6%
                                  Signature Coverage:0%
                                  Total number of Nodes:548
                                  Total number of Limit Nodes:65
                                  execution_graph 19114 1aa210 19147 27f290 19114->19147 19116 1aa248 19152 1a2ae0 19116->19152 19118 1aa28b 19168 285362 19118->19168 19121 1aa377 19124 1aa34e 19124->19121 19197 2847b0 19124->19197 19128 289136 4 API calls 19129 1aa2fc 19128->19129 19134 1aa318 19129->19134 19183 20cf60 19129->19183 19188 28dbdf 19134->19188 19149 1a21d0 Concurrency::cancel_current_task ___std_exception_copy std::_Facet_Register 19147->19149 19148 27f2af 19148->19116 19149->19148 19200 280651 19149->19200 19153 1a2ba5 19152->19153 19159 1a2af6 19152->19159 19218 1a2270 19153->19218 19155 1a2b02 std::locale::_Locimp::_Locimp 19155->19118 19156 1a2b2a 19160 27f290 std::_Facet_Register RtlAllocateHeap 19156->19160 19157 1a2baa 19228 1a21d0 19157->19228 19159->19155 19159->19156 19162 1a2b6e 19159->19162 19163 1a2b65 19159->19163 19161 1a2b3d 19160->19161 19164 2847b0 RtlAllocateHeap 19161->19164 19167 1a2b46 std::locale::_Locimp::_Locimp 19161->19167 19166 27f290 std::_Facet_Register RtlAllocateHeap 19162->19166 19162->19167 19163->19156 19163->19157 19165 1a2bb4 19164->19165 19166->19167 19167->19118 19241 2852a0 19168->19241 19170 1aa2d7 19170->19124 19171 289136 19170->19171 19172 289149 ___std_exception_copy 19171->19172 19265 288e8d 19172->19265 19174 28915e 19175 2844dc ___std_exception_copy RtlAllocateHeap 19174->19175 19176 1aa2ea 19175->19176 19177 284eeb 19176->19177 19178 284efe ___std_exception_copy 19177->19178 19291 284801 19178->19291 19180 284f0a 19181 2844dc ___std_exception_copy RtlAllocateHeap 19180->19181 19182 1aa2f0 19181->19182 19182->19128 19184 20cfa7 19183->19184 19187 20cf78 __fread_nolock 19183->19187 19339 210560 19184->19339 19186 20cfba 19186->19134 19187->19134 19354 28dbfc 19188->19354 19190 1aa348 19191 288be8 19190->19191 19192 288bfb ___std_exception_copy 19191->19192 19472 288ac3 19192->19472 19194 288c07 19195 2844dc ___std_exception_copy RtlAllocateHeap 19194->19195 19196 288c13 19195->19196 19196->19124 19198 2846ec ___std_exception_copy RtlAllocateHeap 19197->19198 19199 2847bf __Getctype 19198->19199 19201 1a2213 19200->19201 19202 28065e ___std_exception_copy 19200->19202 19201->19116 19202->19201 19203 28068b 19202->19203 19206 2956b8 19202->19206 19215 28d7d6 19203->19215 19207 2956d4 19206->19207 19208 2956c6 19206->19208 19209 28d23f __dosmaperr RtlAllocateHeap 19207->19209 19208->19207 19213 2956ec 19208->19213 19210 2956dc 19209->19210 19211 2847a0 ___std_exception_copy RtlAllocateHeap 19210->19211 19212 2956e6 19211->19212 19212->19203 19213->19212 19214 28d23f __dosmaperr RtlAllocateHeap 19213->19214 19214->19210 19216 296db3 __freea RtlAllocateHeap 19215->19216 19217 28d7ee 19216->19217 19217->19201 19232 27d6e9 19218->19232 19229 1a21de Concurrency::cancel_current_task 19228->19229 19230 280651 ___std_exception_copy RtlAllocateHeap 19229->19230 19231 1a2213 19230->19231 19231->19161 19235 27d4af 19232->19235 19234 27d6fa Concurrency::cancel_current_task 19238 1a3010 19235->19238 19239 280651 ___std_exception_copy RtlAllocateHeap 19238->19239 19240 1a303d 19239->19240 19240->19234 19243 2852ac __fread_nolock 19241->19243 19242 2852b3 19244 28d23f __dosmaperr RtlAllocateHeap 19242->19244 19243->19242 19245 2852d3 19243->19245 19246 2852b8 19244->19246 19247 2852d8 19245->19247 19248 2852e5 19245->19248 19249 2847a0 ___std_exception_copy RtlAllocateHeap 19246->19249 19250 28d23f __dosmaperr RtlAllocateHeap 19247->19250 19255 296688 19248->19255 19254 2852c3 19249->19254 19250->19254 19252 2852ee 19253 28d23f __dosmaperr RtlAllocateHeap 19252->19253 19252->19254 19253->19254 19254->19170 19256 296694 __fread_nolock std::_Lockit::_Lockit 19255->19256 19259 29672c 19256->19259 19258 2966af 19258->19252 19262 29674f __fread_nolock 19259->19262 19260 296795 __fread_nolock 19260->19258 19261 2963f3 __Getctype RtlAllocateHeap 19263 2967b0 19261->19263 19262->19260 19262->19261 19264 296db3 __freea RtlAllocateHeap 19263->19264 19264->19260 19268 288e99 __fread_nolock 19265->19268 19266 288e9f 19267 284723 ___std_exception_copy RtlAllocateHeap 19266->19267 19271 288eba 19267->19271 19268->19266 19269 288ee2 __fread_nolock 19268->19269 19272 289010 19269->19272 19271->19174 19273 289023 19272->19273 19274 289036 19272->19274 19273->19271 19281 288f37 19274->19281 19276 289059 19277 2890e7 19276->19277 19278 2855d3 4 API calls 19276->19278 19277->19271 19279 289087 19278->19279 19280 28e17d 2 API calls 19279->19280 19280->19277 19282 288f48 19281->19282 19284 288fa0 19281->19284 19282->19284 19285 28e13d 19282->19285 19284->19276 19286 28e151 ___std_exception_copy 19285->19286 19287 28e05c __fread_nolock 2 API calls 19286->19287 19288 28e166 19287->19288 19289 2844dc ___std_exception_copy RtlAllocateHeap 19288->19289 19290 28e175 19289->19290 19290->19284 19292 28480d __fread_nolock 19291->19292 19293 284814 19292->19293 19294 284835 __fread_nolock 19292->19294 19295 284723 ___std_exception_copy RtlAllocateHeap 19293->19295 19298 284910 19294->19298 19297 28482d 19295->19297 19297->19180 19301 284942 19298->19301 19300 284922 19300->19297 19302 284979 19301->19302 19303 284951 19301->19303 19305 295f82 __fread_nolock RtlAllocateHeap 19302->19305 19304 284723 ___std_exception_copy RtlAllocateHeap 19303->19304 19306 28496c __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 19304->19306 19307 284982 19305->19307 19306->19300 19314 28e11f 19307->19314 19310 284a2c 19317 284cae 19310->19317 19312 284a43 19312->19306 19325 284ae3 19312->19325 19332 28df37 19314->19332 19316 2849a0 19316->19306 19316->19310 19316->19312 19318 284cbd 19317->19318 19319 295f82 __fread_nolock RtlAllocateHeap 19318->19319 19320 284cd9 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 19319->19320 19321 284ce5 _ValidateLocalCookies 19320->19321 19322 28e11f 2 API calls 19320->19322 19321->19306 19323 284d39 19322->19323 19323->19321 19324 28e11f 2 API calls 19323->19324 19324->19321 19326 295f82 __fread_nolock RtlAllocateHeap 19325->19326 19327 284af6 19326->19327 19328 28e11f 2 API calls 19327->19328 19331 284b40 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 19327->19331 19329 284b9d 19328->19329 19330 28e11f 2 API calls 19329->19330 19329->19331 19330->19331 19331->19306 19333 28df43 __fread_nolock 19332->19333 19334 28df86 19333->19334 19336 28dfcc 19333->19336 19338 28df4b 19333->19338 19335 284723 ___std_exception_copy RtlAllocateHeap 19334->19335 19335->19338 19337 28e05c __fread_nolock 2 API calls 19336->19337 19336->19338 19337->19338 19338->19316 19340 2106a9 19339->19340 19343 210585 19339->19343 19341 1a2270 RtlAllocateHeap 19340->19341 19342 2106ae 19341->19342 19344 1a21d0 Concurrency::cancel_current_task RtlAllocateHeap 19342->19344 19345 2105e3 19343->19345 19347 21059a 19343->19347 19348 2105f0 19343->19348 19352 2105aa __fread_nolock std::locale::_Locimp::_Locimp 19344->19352 19345->19342 19345->19347 19346 27f290 std::_Facet_Register RtlAllocateHeap 19346->19352 19347->19346 19350 27f290 std::_Facet_Register RtlAllocateHeap 19348->19350 19348->19352 19349 2847b0 RtlAllocateHeap 19351 2106b8 19349->19351 19350->19352 19352->19349 19353 210667 __fread_nolock std::locale::_Locimp::_Locimp 19352->19353 19353->19186 19355 28dc08 __fread_nolock 19354->19355 19356 28dc1b __fread_nolock 19355->19356 19357 28dc52 __fread_nolock 19355->19357 19362 28dc40 __fread_nolock 19355->19362 19358 28d23f __dosmaperr RtlAllocateHeap 19356->19358 19363 28da06 19357->19363 19359 28dc35 19358->19359 19361 2847a0 ___std_exception_copy RtlAllocateHeap 19359->19361 19361->19362 19362->19190 19365 28da18 __fread_nolock 19363->19365 19369 28da35 19363->19369 19364 28da25 19366 28d23f __dosmaperr RtlAllocateHeap 19364->19366 19365->19364 19365->19369 19371 28da76 __fread_nolock 19365->19371 19367 28da2a 19366->19367 19368 2847a0 ___std_exception_copy RtlAllocateHeap 19367->19368 19368->19369 19369->19362 19370 28dba1 __fread_nolock 19374 28d23f __dosmaperr RtlAllocateHeap 19370->19374 19371->19369 19371->19370 19373 295f82 __fread_nolock RtlAllocateHeap 19371->19373 19376 294623 19371->19376 19435 288a2b 19371->19435 19373->19371 19374->19367 19377 29464d 19376->19377 19378 294635 19376->19378 19379 29498f 19377->19379 19384 294690 19377->19384 19380 28d22c __dosmaperr RtlAllocateHeap 19378->19380 19381 28d22c __dosmaperr RtlAllocateHeap 19379->19381 19382 29463a 19380->19382 19385 294994 19381->19385 19383 28d23f __dosmaperr RtlAllocateHeap 19382->19383 19390 294642 19383->19390 19386 29469b 19384->19386 19384->19390 19394 2946cb 19384->19394 19387 28d23f __dosmaperr RtlAllocateHeap 19385->19387 19388 28d22c __dosmaperr RtlAllocateHeap 19386->19388 19389 2946a8 19387->19389 19391 2946a0 19388->19391 19393 2847a0 ___std_exception_copy RtlAllocateHeap 19389->19393 19390->19371 19392 28d23f __dosmaperr RtlAllocateHeap 19391->19392 19392->19389 19393->19390 19395 2946e4 19394->19395 19396 29471f 19394->19396 19397 2946f1 19394->19397 19395->19397 19403 29470d 19395->19403 19400 296e2d std::_Locinfo::_Locinfo_dtor 2 API calls 19396->19400 19398 28d22c __dosmaperr RtlAllocateHeap 19397->19398 19399 2946f6 19398->19399 19401 28d23f __dosmaperr RtlAllocateHeap 19399->19401 19404 294730 19400->19404 19405 2946fd 19401->19405 19402 2a0d44 __fread_nolock RtlAllocateHeap 19419 29486b 19402->19419 19403->19402 19406 296db3 __freea RtlAllocateHeap 19404->19406 19408 2847a0 ___std_exception_copy RtlAllocateHeap 19405->19408 19407 294739 19406->19407 19409 296db3 __freea RtlAllocateHeap 19407->19409 19433 294708 __fread_nolock 19408->19433 19411 294740 19409->19411 19410 2948e3 ReadFile 19412 2948fb 19410->19412 19413 294957 19410->19413 19414 29474a 19411->19414 19415 294765 19411->19415 19412->19413 19431 2948d4 19412->19431 19421 2948b5 19413->19421 19422 294964 19413->19422 19416 28d23f __dosmaperr RtlAllocateHeap 19414->19416 19418 28e13d __fread_nolock 2 API calls 19415->19418 19420 29474f 19416->19420 19417 296db3 __freea RtlAllocateHeap 19417->19390 19418->19403 19419->19410 19430 29489b 19419->19430 19426 28d22c __dosmaperr RtlAllocateHeap 19420->19426 19421->19433 19449 28d1e5 19421->19449 19423 28d23f __dosmaperr RtlAllocateHeap 19422->19423 19427 294969 19423->19427 19424 294920 19454 294335 19424->19454 19425 294937 19425->19433 19464 29417b 19425->19464 19426->19433 19432 28d22c __dosmaperr RtlAllocateHeap 19427->19432 19430->19421 19430->19431 19431->19424 19431->19425 19431->19433 19432->19433 19433->19417 19436 288a3c 19435->19436 19440 288a38 std::locale::_Locimp::_Locimp 19435->19440 19437 288a43 19436->19437 19442 288a56 __fread_nolock 19436->19442 19438 28d23f __dosmaperr RtlAllocateHeap 19437->19438 19439 288a48 19438->19439 19441 2847a0 ___std_exception_copy RtlAllocateHeap 19439->19441 19440->19371 19441->19440 19442->19440 19443 288a8d 19442->19443 19444 288a84 19442->19444 19443->19440 19446 28d23f __dosmaperr RtlAllocateHeap 19443->19446 19445 28d23f __dosmaperr RtlAllocateHeap 19444->19445 19447 288a89 19445->19447 19446->19447 19448 2847a0 ___std_exception_copy RtlAllocateHeap 19447->19448 19448->19440 19450 28d22c __dosmaperr RtlAllocateHeap 19449->19450 19451 28d1f0 __dosmaperr 19450->19451 19452 28d23f __dosmaperr RtlAllocateHeap 19451->19452 19453 28d203 19452->19453 19453->19433 19468 29402e 19454->19468 19457 2943d7 19461 294391 __fread_nolock 19457->19461 19462 28e13d __fread_nolock 2 API calls 19457->19462 19458 2943c7 19460 28d23f __dosmaperr RtlAllocateHeap 19458->19460 19459 29437d 19459->19433 19460->19459 19461->19459 19463 28d1e5 __dosmaperr RtlAllocateHeap 19461->19463 19462->19461 19463->19459 19465 2941b5 19464->19465 19466 294246 19465->19466 19467 28e13d __fread_nolock 2 API calls 19465->19467 19466->19433 19467->19466 19469 294062 19468->19469 19470 2940ce 19469->19470 19471 28e13d __fread_nolock 2 API calls 19469->19471 19470->19457 19470->19458 19470->19459 19470->19461 19471->19470 19473 288acf __fread_nolock 19472->19473 19474 288ad9 19473->19474 19477 288afc __fread_nolock 19473->19477 19475 284723 ___std_exception_copy RtlAllocateHeap 19474->19475 19476 288af4 19475->19476 19476->19194 19477->19476 19479 288b5a 19477->19479 19480 288b8a 19479->19480 19481 288b67 19479->19481 19483 288b82 19480->19483 19484 2855d3 4 API calls 19480->19484 19482 284723 ___std_exception_copy RtlAllocateHeap 19481->19482 19482->19483 19483->19476 19485 288ba2 19484->19485 19493 296ded 19485->19493 19488 295f82 __fread_nolock RtlAllocateHeap 19489 288bb6 19488->19489 19497 294a3f 19489->19497 19492 296db3 __freea RtlAllocateHeap 19492->19483 19494 296e04 19493->19494 19496 288baa 19493->19496 19495 296db3 __freea RtlAllocateHeap 19494->19495 19494->19496 19495->19496 19496->19488 19498 294a68 19497->19498 19503 288bbd 19497->19503 19499 294ab7 19498->19499 19501 294a8f 19498->19501 19500 284723 ___std_exception_copy RtlAllocateHeap 19499->19500 19500->19503 19504 2949ae 19501->19504 19503->19483 19503->19492 19505 2949ba __fread_nolock 19504->19505 19506 2949f9 19505->19506 19508 294b12 19505->19508 19506->19503 19509 29a6de __fread_nolock RtlAllocateHeap 19508->19509 19510 294b22 19509->19510 19512 29a6de __fread_nolock RtlAllocateHeap 19510->19512 19517 294b28 19510->19517 19519 294b5a 19510->19519 19514 294b51 19512->19514 19513 29a6de __fread_nolock RtlAllocateHeap 19515 294b66 FindCloseChangeNotification 19513->19515 19516 29a6de __fread_nolock RtlAllocateHeap 19514->19516 19515->19517 19516->19519 19520 29a64d 19517->19520 19518 294b80 __fread_nolock 19518->19506 19519->19513 19519->19517 19521 29a65c 19520->19521 19522 28d23f __dosmaperr RtlAllocateHeap 19521->19522 19525 29a686 19521->19525 19523 29a6c8 19522->19523 19524 28d22c __dosmaperr RtlAllocateHeap 19523->19524 19524->19525 19525->19518 20709 4e409eb 20710 4e40a18 GetCurrentHwProfileW 20709->20710 20712 4e40c6b 20710->20712 20623 4e40c5d 20624 4e40c06 GetCurrentHwProfileW 20623->20624 20625 4e40c69 20623->20625 20624->20625 19526 1be0a0 WSAStartup 19527 1be0d8 19526->19527 19528 1be1a7 19526->19528 19527->19528 19529 1be175 socket 19527->19529 19529->19528 19530 1be18b connect 19529->19530 19530->19528 19531 1be19d closesocket 19530->19531 19531->19528 19531->19529 18880 28d168 18881 28d17b ___std_exception_copy 18880->18881 18886 28cf4a 18881->18886 18883 28d190 18894 2844dc 18883->18894 18887 28cf58 18886->18887 18892 28cf80 18886->18892 18888 28cf65 18887->18888 18889 28cf87 18887->18889 18887->18892 18904 284723 18888->18904 18900 28cea3 18889->18900 18892->18883 18893 28cfbf 18893->18883 18895 2844e8 18894->18895 18896 2844ff 18895->18896 18898 284587 ___std_exception_copy RtlAllocateHeap 18895->18898 18897 284512 18896->18897 18899 284587 ___std_exception_copy RtlAllocateHeap 18896->18899 18898->18896 18899->18897 18901 28ceaf __fread_nolock 18900->18901 18911 28cefe 18901->18911 18903 28ceca 18903->18893 18905 284733 18904->18905 18907 28473a ___std_exception_copy __Getctype 18904->18907 18906 284541 ___std_exception_copy RtlAllocateHeap 18905->18906 18906->18907 18908 284748 18907->18908 18909 2846ec ___std_exception_copy RtlAllocateHeap 18907->18909 18908->18892 18910 2847ac 18909->18910 18910->18892 18918 298644 18911->18918 18938 298606 18918->18938 18920 298655 18921 28cf16 18920->18921 18945 296e2d 18920->18945 18925 28cfc1 18921->18925 18926 28cf34 18925->18926 18929 28cfd3 18925->18929 18934 2986ef 18926->18934 18927 28cfe1 18928 284723 ___std_exception_copy RtlAllocateHeap 18927->18928 18928->18926 18929->18926 18929->18927 18930 28d017 std::locale::_Locimp::_Locimp 18929->18930 18930->18926 18932 295f82 __fread_nolock RtlAllocateHeap 18930->18932 19006 2855d3 18930->19006 19012 29538b 18930->19012 18932->18930 18935 28cf40 18934->18935 18936 2986fa 18934->18936 18935->18903 18936->18935 18937 2855d3 4 API calls 18936->18937 18937->18935 18939 298612 18938->18939 18940 29863c 18939->18940 18955 295f82 18939->18955 18940->18920 18942 29862d 18962 2a0d44 18942->18962 18944 298633 18944->18920 18946 296e6b 18945->18946 18950 296e3b __Getctype std::_Facet_Register 18945->18950 18947 28d23f __dosmaperr RtlAllocateHeap 18946->18947 18949 296e69 18947->18949 18948 296e56 RtlAllocateHeap 18948->18949 18948->18950 18951 296db3 18949->18951 18950->18946 18950->18948 18952 296dbe __dosmaperr 18951->18952 18954 296de8 18951->18954 18953 28d23f __dosmaperr RtlAllocateHeap 18952->18953 18952->18954 18953->18954 18954->18921 18956 295f8e 18955->18956 18957 295fa3 18955->18957 18971 28d23f 18956->18971 18957->18942 18963 2a0d51 18962->18963 18965 2a0d5e 18962->18965 18964 28d23f __dosmaperr RtlAllocateHeap 18963->18964 18966 2a0d56 18964->18966 18967 2a0d6a 18965->18967 18968 28d23f __dosmaperr RtlAllocateHeap 18965->18968 18966->18944 18967->18944 18969 2a0d8b 18968->18969 18970 2847a0 ___std_exception_copy RtlAllocateHeap 18969->18970 18970->18966 18977 295d2c 18971->18977 18974 2847a0 19000 2846ec 18974->19000 18978 295d35 __Getctype 18977->18978 18985 28d244 18978->18985 18988 2963f3 18978->18988 18980 295d79 __Getctype 18981 295db9 18980->18981 18982 295d81 __Getctype 18980->18982 18992 295a09 18981->18992 18983 296db3 __freea RtlAllocateHeap 18982->18983 18983->18985 18985->18974 18987 296db3 __freea RtlAllocateHeap 18987->18985 18991 296400 __Getctype std::_Facet_Register 18988->18991 18989 29642b RtlAllocateHeap 18990 29643e __dosmaperr 18989->18990 18989->18991 18990->18980 18991->18989 18991->18990 18993 295a77 __Getctype 18992->18993 18996 2959af 18993->18996 18995 295aa0 18995->18987 18997 2959bb __fread_nolock std::_Lockit::_Lockit 18996->18997 18998 295b90 __Getctype RtlAllocateHeap 18997->18998 18999 2959dd __Getctype 18998->18999 18999->18995 19001 2846fe ___std_exception_copy 19000->19001 19002 284723 ___std_exception_copy RtlAllocateHeap 19001->19002 19003 284716 19002->19003 19004 2844dc ___std_exception_copy RtlAllocateHeap 19003->19004 19005 284721 19004->19005 19005->18942 19007 2855ec 19006->19007 19011 285613 19006->19011 19008 295f82 __fread_nolock RtlAllocateHeap 19007->19008 19007->19011 19009 285608 19008->19009 19010 29538b 4 API calls 19009->19010 19010->19011 19011->18930 19014 295397 __fread_nolock 19012->19014 19013 2953d8 19015 284723 ___std_exception_copy RtlAllocateHeap 19013->19015 19014->19013 19016 29541e 19014->19016 19018 29539f 19014->19018 19015->19018 19016->19018 19019 29549c 19016->19019 19018->18930 19020 2954c4 19019->19020 19032 2954e7 __fread_nolock 19019->19032 19021 2954c8 19020->19021 19023 295523 19020->19023 19022 284723 ___std_exception_copy RtlAllocateHeap 19021->19022 19022->19032 19024 295541 19023->19024 19038 28e17d 19023->19038 19033 294fe1 19024->19033 19028 295559 19028->19032 19041 294bb2 19028->19041 19029 2955a0 19030 295609 WriteFile 19029->19030 19029->19032 19030->19032 19032->19018 19034 2a0d44 __fread_nolock RtlAllocateHeap 19033->19034 19035 294ff3 19034->19035 19037 295021 19035->19037 19047 289d10 19035->19047 19037->19028 19037->19029 19093 28e05c 19038->19093 19040 28e196 19040->19024 19042 294c1a 19041->19042 19043 289d10 std::_Locinfo::_Locinfo_dtor 2 API calls 19042->19043 19045 294c2b std::_Locinfo::_Locinfo_dtor std::locale::_Locimp::_Locimp 19042->19045 19043->19045 19044 294ee1 _ValidateLocalCookies 19044->19032 19045->19044 19046 2984be RtlAllocateHeap RtlAllocateHeap 19045->19046 19046->19045 19054 284587 19047->19054 19055 28459a 19054->19055 19056 284591 19054->19056 19061 295ef3 19055->19061 19069 284541 19056->19069 19062 295f0a 19061->19062 19063 289d3d 19061->19063 19062->19063 19079 29f4f3 19062->19079 19065 295f51 19063->19065 19066 295f68 19065->19066 19068 289d4a 19065->19068 19066->19068 19088 29d81e 19066->19088 19068->19037 19070 284550 19069->19070 19071 295ddd ___std_exception_copy RtlAllocateHeap 19070->19071 19072 284572 19071->19072 19072->19055 19073 290259 19072->19073 19074 29025e std::locale::_Setgloballocale 19073->19074 19075 29c7c6 std::locale::_Setgloballocale RtlAllocateHeap 19074->19075 19078 290269 std::locale::_Setgloballocale 19074->19078 19075->19078 19076 28f224 std::locale::_Setgloballocale RtlAllocateHeap 19077 29029c 19076->19077 19078->19076 19080 29f4ff __fread_nolock 19079->19080 19081 295bdb __Getctype RtlAllocateHeap 19080->19081 19082 29f508 std::_Lockit::_Lockit 19081->19082 19083 29f574 __Getctype RtlAllocateHeap 19082->19083 19085 29f54e 19082->19085 19084 29f537 __Getctype 19083->19084 19084->19085 19086 290259 __Getctype RtlAllocateHeap 19084->19086 19085->19063 19087 29f573 19086->19087 19089 295bdb __Getctype RtlAllocateHeap 19088->19089 19090 29d823 19089->19090 19091 29d736 std::_Locinfo::_Locinfo_dtor RtlAllocateHeap RtlAllocateHeap 19090->19091 19092 29d82e 19091->19092 19092->19068 19098 29a6de 19093->19098 19095 28e06e 19096 28e08a SetFilePointerEx 19095->19096 19097 28e076 __fread_nolock 19095->19097 19096->19097 19097->19040 19099 29a6eb 19098->19099 19100 29a700 19098->19100 19111 28d22c 19099->19111 19103 28d22c __dosmaperr RtlAllocateHeap 19100->19103 19105 29a725 19100->19105 19106 29a730 19103->19106 19104 28d23f __dosmaperr RtlAllocateHeap 19107 29a6f8 19104->19107 19105->19095 19108 28d23f __dosmaperr RtlAllocateHeap 19106->19108 19107->19095 19109 29a738 19108->19109 19110 2847a0 ___std_exception_copy RtlAllocateHeap 19109->19110 19110->19107 19112 295d2c __dosmaperr RtlAllocateHeap 19111->19112 19113 28d231 19112->19113 19113->19104 20819 4e409a6 20820 4e409c6 20819->20820 20823 4e409d9 20820->20823 20824 4e409e5 GetCurrentHwProfileW 20823->20824 20826 4e40c6b 20824->20826 20635 4e40c39 20636 4e40bea 20635->20636 20637 4e40bec 20636->20637 20638 4e40c53 GetCurrentHwProfileW 20636->20638 20639 4e40c6b 20638->20639 18873 203a40 18876 203a55 18873->18876 18874 203b28 GetPEB 18874->18876 18875 203a73 GetPEB 18875->18876 18876->18874 18876->18875 18877 203b9d Sleep 18876->18877 18878 203ae8 Sleep 18876->18878 18879 203bc7 18876->18879 18877->18876 18878->18876 19532 4e40c89 19533 4e40c51 19532->19533 19534 4e40c53 GetCurrentHwProfileW 19532->19534 19533->19534 19535 4e40c6b 19533->19535 19534->19535

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 176 203a40-203a52 177 203a55-203a61 176->177 179 203a67-203a6d 177->179 180 203b28-203b31 GetPEB 177->180 179->180 182 203a73-203a7f GetPEB 179->182 181 203b34-203b48 180->181 183 203b99-203b9b 181->183 184 203b4a-203b4f 181->184 185 203a80-203a94 182->185 183->181 184->183 186 203b51-203b59 184->186 187 203ae4-203ae6 185->187 188 203a96-203a9b 185->188 189 203b60-203b73 186->189 187->185 188->187 190 203a9d-203aa3 188->190 191 203b92-203b97 189->191 192 203b75-203b88 189->192 193 203aa5-203ab8 190->193 191->183 191->189 192->192 194 203b8a-203b90 192->194 195 203aba 193->195 196 203add-203ae2 193->196 194->191 197 203b9d-203bc2 Sleep 194->197 198 203ac0-203ad3 195->198 196->187 196->193 197->177 198->198 199 203ad5-203adb 198->199 199->196 200 203ae8-203b0d Sleep 199->200 201 203b13-203b1a 200->201 201->180 202 203b1c-203b22 201->202 202->180 203 203bc7-203bd8 call 1a6bd0 202->203 206 203bda-203bdc 203->206 207 203bde 203->207 208 203be0-203bfd call 1a6bd0 206->208 207->208
                                  APIs
                                  • Sleep.KERNELBASE(000003E9,?,00000001,00000000,?,?,?,?,?,?,?,?,00203DB6), ref: 00203B08
                                  • Sleep.KERNELBASE(00000001,?,00000001,00000000,?,?,?,?,?,?,?,?,00203DB6), ref: 00203BBA
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000007.00000002.4129166018.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129278379.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129579639.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130178335.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130462840.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: Sleep
                                  • String ID:
                                  • API String ID: 3472027048-0
                                  • Opcode ID: 08746c17b49043d6b0427710afc2ded3d397faa28ce77ed6911be22268f038fc
                                  • Instruction ID: 689e0a05f7175626304ea922439172732abf8639b299bf3a107af8264350ce8c
                                  • Opcode Fuzzy Hash: 08746c17b49043d6b0427710afc2ded3d397faa28ce77ed6911be22268f038fc
                                  • Instruction Fuzzy Hash: 6951BB35A14216CFCB24CF58C8D0EAAB3B9FF49708B29459AD445AF392D731EE15CB80

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 0 1be0a0-1be0d2 WSAStartup 1 1be0d8-1be102 call 1a6bd0 * 2 0->1 2 1be1b7-1be1c0 0->2 7 1be10e-1be165 1->7 8 1be104-1be108 1->8 10 1be1b1 7->10 11 1be167-1be16d 7->11 8->2 8->7 10->2 12 1be16f 11->12 13 1be1c5-1be1cf 11->13 14 1be175-1be189 socket 12->14 13->10 19 1be1d1-1be1d9 13->19 14->10 15 1be18b-1be19b connect 14->15 17 1be19d-1be1a5 closesocket 15->17 18 1be1c1 15->18 17->14 20 1be1a7-1be1ab 17->20 18->13 20->10
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000007.00000002.4129166018.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129278379.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129579639.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130178335.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130462840.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: Startupclosesocketconnectsocket
                                  • String ID:
                                  • API String ID: 3098855095-0
                                  • Opcode ID: 443327ca00a20d343898c7d88f547ec996e3049b2fff4439273980c82c42b959
                                  • Instruction ID: 84366b7b12188b8188ad669b8931a057a8fa2555998bc31a13e9ec5a42fe3d6f
                                  • Opcode Fuzzy Hash: 443327ca00a20d343898c7d88f547ec996e3049b2fff4439273980c82c42b959
                                  • Instruction Fuzzy Hash: D031C471605310ABD7209F69C8487ABB7E4EF86734F104F1DF9A8A72D0D33599148BA3

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 21 284942-28494f 22 284979-28498d call 295f82 21->22 23 284951-284974 call 284723 21->23 28 28498f 22->28 29 284992-28499b call 28e11f 22->29 30 284ae0-284ae2 23->30 28->29 32 2849a0-2849af 29->32 33 2849bf-2849c8 32->33 34 2849b1 32->34 37 2849ca-2849d7 33->37 38 2849dc-284a10 33->38 35 284a89-284a8e 34->35 36 2849b7-2849b9 34->36 39 284ade-284adf 35->39 36->33 36->35 40 284adc 37->40 41 284a6d-284a79 38->41 42 284a12-284a1c 38->42 39->30 40->39 43 284a7b-284a82 41->43 44 284a90-284a93 41->44 45 284a1e-284a2a 42->45 46 284a43-284a4f 42->46 43->35 47 284a96-284a9e 44->47 45->46 48 284a2c-284a3e call 284cae 45->48 46->44 49 284a51-284a6b call 284e59 46->49 51 284ada 47->51 52 284aa0-284aa6 47->52 48->39 49->47 51->40 55 284aa8-284abc call 284ae3 52->55 56 284abe-284ac2 52->56 55->39 59 284ac4-284ad2 call 2a4a10 56->59 60 284ad5-284ad7 56->60 59->60 60->51
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000007.00000002.4129166018.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129278379.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129579639.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130178335.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130462840.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID:
                                  • String ID: O(
                                  • API String ID: 0-2961352692
                                  • Opcode ID: de2682b5db8e2563b81c24c700635fd82509e6c6ca500bcdbd72a5da6d0bf684
                                  • Instruction ID: f4a823e26f3e85ead8dcb2b2093d541122f88a2ac611247369fe9a0f2a563f87
                                  • Opcode Fuzzy Hash: de2682b5db8e2563b81c24c700635fd82509e6c6ca500bcdbd72a5da6d0bf684
                                  • Instruction Fuzzy Hash: E2511738A11109AFCF14FF58C895AAABFB1EF45314F248159F8499F292D371EE61CB90

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 64 294623-294633 65 29464d-29464f 64->65 66 294635-294648 call 28d22c call 28d23f 64->66 67 29498f-29499c call 28d22c call 28d23f 65->67 68 294655-29465b 65->68 80 2949a7 66->80 87 2949a2 call 2847a0 67->87 68->67 70 294661-29468a 68->70 70->67 74 294690-294699 70->74 77 29469b-2946ae call 28d22c call 28d23f 74->77 78 2946b3-2946b5 74->78 77->87 83 29498b-29498d 78->83 84 2946bb-2946bf 78->84 85 2949aa-2949ad 80->85 83->85 84->83 88 2946c5-2946c9 84->88 87->80 88->77 91 2946cb-2946e2 88->91 93 2946e4-2946e7 91->93 94 294717-29471d 91->94 95 2946e9-2946ef 93->95 96 29470d-294715 93->96 97 29471f-294726 94->97 98 2946f1-294708 call 28d22c call 28d23f call 2847a0 94->98 95->96 95->98 100 29478a-2947a9 96->100 101 294728 97->101 102 29472a-294748 call 296e2d call 296db3 * 2 97->102 127 2948c2 98->127 104 2947af-2947bb 100->104 105 294865-29486e call 2a0d44 100->105 101->102 131 29474a-294760 call 28d23f call 28d22c 102->131 132 294765-294788 call 28e13d 102->132 104->105 109 2947c1-2947c3 104->109 117 2948df 105->117 118 294870-294882 105->118 109->105 113 2947c9-2947ea 109->113 113->105 119 2947ec-294802 113->119 124 2948e3-2948f9 ReadFile 117->124 118->117 123 294884-294893 118->123 119->105 120 294804-294806 119->120 120->105 125 294808-29482b 120->125 123->117 140 294895-294899 123->140 128 2948fb-294901 124->128 129 294957-294962 124->129 125->105 130 29482d-294843 125->130 133 2948c5-2948cf call 296db3 127->133 128->129 135 294903 128->135 149 29497b-29497e 129->149 150 294964-294976 call 28d23f call 28d22c 129->150 130->105 136 294845-294847 130->136 131->127 132->100 133->85 142 294906-294918 135->142 136->105 144 294849-294860 136->144 140->124 148 29489b-2948b3 140->148 142->133 143 29491a-29491e 142->143 152 294920-294930 call 294335 143->152 153 294937-294944 143->153 144->105 164 2948b5-2948ba 148->164 165 2948d4-2948dd 148->165 154 2948bb-2948c1 call 28d1e5 149->154 155 294984-294986 149->155 150->127 172 294933-294935 152->172 160 294950-294955 call 29417b 153->160 161 294946 call 29448c 153->161 154->127 155->133 173 29494b-29494e 160->173 161->173 164->154 165->142 172->133 173->172
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000007.00000002.4129166018.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129278379.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129579639.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130178335.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130462840.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: a2367333640a12192248dcd0450e903a78b54d8e9eb241040163adb42adef406
                                  • Instruction ID: 3e61b27ff225493ffe0ce53af21ec4153478c37cee5d4c6a6ece48193f12d6e4
                                  • Opcode Fuzzy Hash: a2367333640a12192248dcd0450e903a78b54d8e9eb241040163adb42adef406
                                  • Instruction Fuzzy Hash: F8B1E174A2424AAFEF15FFA8D844FAEBBB5BF45304F14415AE84097292C7709D62CF60

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 211 4e40a20-4e40a22 212 4e40a24-4e40a25 211->212 213 4e409e7-4e40a06 211->213 215 4e409e5-4e40a06 212->215 216 4e40a27-4e40a29 212->216 217 4e40a18-4e40a1b 213->217 215->217 218 4e40a2c-4e40c50 216->218 217->218 245 4e40c51-4e40c58 GetCurrentHwProfileW 218->245 247 4e40c6b-4e40e67 call 4e40e69 245->247
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4135966249.0000000004E40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_4e40000_RageMP131.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: b6374a1c70fc023cd01210a1dd204bfde4253bf880992304bf9d2711de9ece24
                                  • Instruction ID: 96a1a17f8cf6eb7c0a44b7b9b5c5aa2198869a05c436c03c4930f3c9a3560983
                                  • Opcode Fuzzy Hash: b6374a1c70fc023cd01210a1dd204bfde4253bf880992304bf9d2711de9ece24
                                  • Instruction Fuzzy Hash: DC51C0EB34C115BDF542C5867B50AF7676EE7C6730730A876FA47C6602F2942A893071

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 270 4e409d9-4e40c50 300 4e40c51-4e40c58 GetCurrentHwProfileW 270->300 302 4e40c6b-4e40e67 call 4e40e69 300->302
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04E40C53
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4135966249.0000000004E40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_4e40000_RageMP131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: bc08cec4a65c76c7fd7503c058fc0fee0d47eff9dcf7b6e0709f6fddb0cfc7ea
                                  • Instruction ID: 93ef740f98ce596efbbf3ebfdecc32d185f7a74a585a553335efff803eaeca32
                                  • Opcode Fuzzy Hash: bc08cec4a65c76c7fd7503c058fc0fee0d47eff9dcf7b6e0709f6fddb0cfc7ea
                                  • Instruction Fuzzy Hash: DA51ADEB34C111BDE142C5467B50AF767AEE7CA730730A476BA0BC6602F2942A893032

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 325 4e409eb-4e40c50 353 4e40c51-4e40c58 GetCurrentHwProfileW 325->353 355 4e40c6b-4e40e67 call 4e40e69 353->355
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04E40C53
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4135966249.0000000004E40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_4e40000_RageMP131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: 8bc30502bc1b4e66730ddaaf8e79b8ab98f7161817fa93e255f50431a7da1cdd
                                  • Instruction ID: a68f1264f82d355182f861f2c6f89cc14cda8ab2d58ca612680b398bbda22bdd
                                  • Opcode Fuzzy Hash: 8bc30502bc1b4e66730ddaaf8e79b8ab98f7161817fa93e255f50431a7da1cdd
                                  • Instruction Fuzzy Hash: 5151BFEB34C115BDF142C5467B50AFB67AEE7C6730730A876FA4BC6606F2942A893071

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 378 4e40a0c-4e40c50 406 4e40c51-4e40c58 GetCurrentHwProfileW 378->406 408 4e40c6b-4e40e67 call 4e40e69 406->408
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04E40C53
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4135966249.0000000004E40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_4e40000_RageMP131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: eb40271e89f61e11ce44d9d34f4796eaa46efbe5164cd217993a01cfcf433814
                                  • Instruction ID: c0103dce82c2eba70033677a26b9be6795845de000dc24bb0f493468fce19af5
                                  • Opcode Fuzzy Hash: eb40271e89f61e11ce44d9d34f4796eaa46efbe5164cd217993a01cfcf433814
                                  • Instruction Fuzzy Hash: 4051AEEB34C115BDE142C5467B50AF767AEE7CA730730A476BA4BC6606F3942A893031

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 431 4e40a4e-4e40c50 455 4e40c51-4e40c58 GetCurrentHwProfileW 431->455 457 4e40c6b-4e40e67 call 4e40e69 455->457
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04E40C53
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4135966249.0000000004E40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_4e40000_RageMP131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: 18631339fbb7fd05e2e6dea9a4993ccc5379003c72f2906cda7eb6dc25eb12b2
                                  • Instruction ID: 1bb1610c83c6bb75964f1f90a302020d18f240910329f12da94c08b7b6fd6c89
                                  • Opcode Fuzzy Hash: 18631339fbb7fd05e2e6dea9a4993ccc5379003c72f2906cda7eb6dc25eb12b2
                                  • Instruction Fuzzy Hash: E051D0EB30C125BDE25281567B50BFB676EE7C6730730A476BA07C6606F3942A893032

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 480 4e40a77-4e40c50 503 4e40c51-4e40c58 GetCurrentHwProfileW 480->503 505 4e40c6b-4e40e67 call 4e40e69 503->505
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04E40C53
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4135966249.0000000004E40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_4e40000_RageMP131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: 71c6ee1efd5ac648ab91364b368cc11b8ac340cd8496ed1fce5922eba96dd74e
                                  • Instruction ID: e614c69c217b4218c927e950e1b471525b0a85427028463d59cc15f0514999b6
                                  • Opcode Fuzzy Hash: 71c6ee1efd5ac648ab91364b368cc11b8ac340cd8496ed1fce5922eba96dd74e
                                  • Instruction Fuzzy Hash: 8341BDEB34C125BDF14285467B50AFB676EE7C6730730A476BA0BC6606F3942B893031

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 528 1aa210-1aa2ab call 27f290 call 1a2ae0 533 1aa2b0-1aa2bb 528->533 533->533 534 1aa2bd-1aa2c8 533->534 535 1aa2ca 534->535 536 1aa2cd-1aa2de call 285362 534->536 535->536 539 1aa2e0-1aa305 call 289136 call 284eeb call 289136 536->539 540 1aa351-1aa357 536->540 557 1aa30c-1aa316 539->557 558 1aa307 539->558 541 1aa359-1aa365 540->541 542 1aa381-1aa393 540->542 544 1aa377-1aa37e call 27f511 541->544 545 1aa367-1aa375 541->545 544->542 545->544 547 1aa394-1aa3ae call 2847b0 545->547 556 1aa3b0-1aa3bb 547->556 556->556 559 1aa3bd-1aa3c8 556->559 560 1aa328-1aa32f call 20cf60 557->560 561 1aa318-1aa31c 557->561 558->557 562 1aa3ca 559->562 563 1aa3cd-1aa3df call 285362 559->563 568 1aa334-1aa33a 560->568 564 1aa31e 561->564 565 1aa320-1aa326 561->565 562->563 570 1aa3fc-1aa403 563->570 571 1aa3e1-1aa3f9 call 289136 call 284eeb call 288be8 563->571 564->565 565->568 572 1aa33e-1aa349 call 28dbdf call 288be8 568->572 573 1aa33c 568->573 575 1aa42d-1aa433 570->575 576 1aa405-1aa411 570->576 571->570 589 1aa34e 572->589 573->572 579 1aa423-1aa42a call 27f511 576->579 580 1aa413-1aa421 576->580 579->575 580->579 583 1aa434-1aa45e call 2847b0 580->583 595 1aa46f-1aa474 583->595 596 1aa460-1aa464 583->596 589->540 596->595 597 1aa466-1aa46e 596->597
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000007.00000002.4129166018.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129278379.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129579639.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130178335.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130462840.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: __fread_nolock
                                  • String ID:
                                  • API String ID: 2638373210-0
                                  • Opcode ID: 66b7bb8d054d144cdaa87eb0f397ac72cf9d1dc95c696f6370b8bbe1c370954f
                                  • Instruction ID: 72d8d495fbeb681758ca1621ade7621968dd818cc9bf6a821d57661f4f7f20cb
                                  • Opcode Fuzzy Hash: 66b7bb8d054d144cdaa87eb0f397ac72cf9d1dc95c696f6370b8bbe1c370954f
                                  • Instruction Fuzzy Hash: 7F717C74901204AFDF14EF68CC49BAEBBE8EF42700F54856DF8089B282D7B5D944CB92

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 598 4e40a90-4e40c50 620 4e40c51-4e40c58 GetCurrentHwProfileW 598->620 622 4e40c6b-4e40e67 call 4e40e69 620->622
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04E40C53
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4135966249.0000000004E40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_4e40000_RageMP131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: 5eee76e3fa954a651c517ee801e59b243a75a40864ed0dd369c7a31e4a40f274
                                  • Instruction ID: 1fe8cf7481363d417852e3239d1c7ee2848d7ef26c5d8e3f0f672b82669a7c3f
                                  • Opcode Fuzzy Hash: 5eee76e3fa954a651c517ee801e59b243a75a40864ed0dd369c7a31e4a40f274
                                  • Instruction Fuzzy Hash: 1641CCEB34C124BDF14285427B50AFB676EE7D6730730A476BA07C2A02F7942B893432

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 645 4e40aba-4e40c50 664 4e40c51-4e40c58 GetCurrentHwProfileW 645->664 666 4e40c6b-4e40e67 call 4e40e69 664->666
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04E40C53
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4135966249.0000000004E40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_4e40000_RageMP131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: 2a149f1796d11f1696cf875b2cd682e0b8807302071c6334c25b880698d4c681
                                  • Instruction ID: 4a5fffbd18faf6da0d55027e86dd7e2d7ca8daf52629d02bdc64b38d32280286
                                  • Opcode Fuzzy Hash: 2a149f1796d11f1696cf875b2cd682e0b8807302071c6334c25b880698d4c681
                                  • Instruction Fuzzy Hash: 6841F0EB34D115BEE24281467B50BF7676EE7C6330730A476BA07C6642F3942B883072

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 689 4e40b26-4e40b34 690 4e40b36 689->690 691 4e40ad3-4e40b21 689->691 692 4e40b38-4e40c50 690->692 691->692 709 4e40c51-4e40c58 GetCurrentHwProfileW 692->709 711 4e40c6b-4e40e67 call 4e40e69 709->711
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04E40C53
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4135966249.0000000004E40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_4e40000_RageMP131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: c3a0a6926944d0d34efb82ca4a203415d598c895a79cdccad680fa5cec78189a
                                  • Instruction ID: 0b475772f924f7cf240a801f5d45862d4e97b58c901a75d4d143b45366487789
                                  • Opcode Fuzzy Hash: c3a0a6926944d0d34efb82ca4a203415d598c895a79cdccad680fa5cec78189a
                                  • Instruction Fuzzy Hash: 984111EB34C014FDE15281427B50BF6276EE7D6730730A476BA0BD2602F2942B893471

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 734 29549c-2954be 735 2956b1 734->735 736 2954c4-2954c6 734->736 737 2956b3-2956b7 735->737 738 2954c8-2954e7 call 284723 736->738 739 2954f2-295515 736->739 747 2954ea-2954ed 738->747 740 29551b-295521 739->740 741 295517-295519 739->741 740->738 743 295523-295534 740->743 741->740 741->743 745 295547-295557 call 294fe1 743->745 746 295536-295544 call 28e17d 743->746 752 295559-29555f 745->752 753 2955a0-2955b2 745->753 746->745 747->737 756 295588-29559e call 294bb2 752->756 757 295561-295564 752->757 754 295609-295629 WriteFile 753->754 755 2955b4-2955ba 753->755 758 29562b-295631 754->758 759 295634 754->759 761 2955bc-2955bf 755->761 762 2955f5-295607 call 29505e 755->762 774 295581-295583 756->774 763 29556f-29557e call 294f79 757->763 764 295566-295569 757->764 758->759 766 295637-295642 759->766 767 2955e1-2955f3 call 295222 761->767 768 2955c1-2955c4 761->768 781 2955dc-2955df 762->781 763->774 764->763 769 295649-29564c 764->769 775 2956ac-2956af 766->775 776 295644-295647 766->776 767->781 777 2955ca-2955d7 call 295139 768->777 778 29564f-295651 768->778 769->778 774->766 775->737 776->769 777->781 783 29567f-29568b 778->783 784 295653-295658 778->784 781->774 786 29568d-295693 783->786 787 295695-2956a7 783->787 788 29565a-29566c 784->788 789 295671-29567a call 28d208 784->789 786->735 786->787 787->747 788->747 789->747
                                  APIs
                                  • WriteFile.KERNELBASE(?,00000000,00289087,?,00000000,00000000,00000000,?,00000000,?,001AA3EB,00289087,00000000,001AA3EB,?,?), ref: 00295621
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000007.00000002.4129166018.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129278379.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129579639.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130178335.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130462840.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: FileWrite
                                  • String ID:
                                  • API String ID: 3934441357-0
                                  • Opcode ID: f1659aa925a06e1981b53b961422bc8d8631ef64c115cc4ed93256358a87e252
                                  • Instruction ID: 66450b62b2fa6b85c586b7019e2ab8ce0a8122591fa5f82939445b82d3c56ea5
                                  • Opcode Fuzzy Hash: f1659aa925a06e1981b53b961422bc8d8631ef64c115cc4ed93256358a87e252
                                  • Instruction Fuzzy Hash: 7561C871E2452AAFDF12DFA8C844EEEBBB9EF05304F550149E904A7256D371DD21CBA0
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04E40C53
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4135966249.0000000004E40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_4e40000_RageMP131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: 1386a0218fa4b3b31f98609221a246cbbe4e4f2a76d66653c106986268885097
                                  • Instruction ID: 36f11265e34da5f54de3ad57ba1079d3f339c03327b65cf9e23c2b19ab7af11b
                                  • Opcode Fuzzy Hash: 1386a0218fa4b3b31f98609221a246cbbe4e4f2a76d66653c106986268885097
                                  • Instruction Fuzzy Hash: 0941D0EB34C115FDE25285453B50BF6676EE7D6334730A476BA0BC6A02F7942B893431
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04E40C53
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4135966249.0000000004E40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_4e40000_RageMP131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: d0ff2f9d0025db7f22c00e20f99be360217bccc465104dd576204cae65b3291b
                                  • Instruction ID: 2e4979223a5de410190a36e99d499664b8269513e7e9a7c72b3bd6fa8d337960
                                  • Opcode Fuzzy Hash: d0ff2f9d0025db7f22c00e20f99be360217bccc465104dd576204cae65b3291b
                                  • Instruction Fuzzy Hash: 9241D2EB34C115FDE65281427B50BF6676EE7D6330730A476BA07C6A06F7942B893431
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04E40C53
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4135966249.0000000004E40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_4e40000_RageMP131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: 75902401805f755dad1d71e36825b42c1e96c53fe264c7a1ef6897409def5a9b
                                  • Instruction ID: 14a3a47d1a7bb5b8f315a2b793b1bfca1c7244ae0f1b6b3be505d59b05fdc2d8
                                  • Opcode Fuzzy Hash: 75902401805f755dad1d71e36825b42c1e96c53fe264c7a1ef6897409def5a9b
                                  • Instruction Fuzzy Hash: C5311FEB34C014FEE25285413B40AF7676EE7DA330730A472BA07C6A02F3942B883471
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04E40C53
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4135966249.0000000004E40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_4e40000_RageMP131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: 27bb88cddb624ac2f541dadad051b21cfc2ffa0842e810ff3d691cea2f327de7
                                  • Instruction ID: b370fd2c064662f54b9b7b3cdba7fcebc926f08df89c4317129f90c1549902dc
                                  • Opcode Fuzzy Hash: 27bb88cddb624ac2f541dadad051b21cfc2ffa0842e810ff3d691cea2f327de7
                                  • Instruction Fuzzy Hash: A531E0EB34C115FDE69285453B40AF6676EF7CA330730A476BA0BC6A02F7942B893471
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04E40C53
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4135966249.0000000004E40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_4e40000_RageMP131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: 902c1291ff64605a5695bff9afbd89eddda8acffd91bfda6f67a97f3827d8ed0
                                  • Instruction ID: b1f44cf6b0cd2141df95b9bda27e2ce339803752a53d59819d60a4b64476f683
                                  • Opcode Fuzzy Hash: 902c1291ff64605a5695bff9afbd89eddda8acffd91bfda6f67a97f3827d8ed0
                                  • Instruction Fuzzy Hash: D74114EB30D114EEE25295557B40AF66B6EBBC623073094B6F607C6A06F7942B493431
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04E40C53
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4135966249.0000000004E40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_4e40000_RageMP131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: 736ec75d3280796bdeef9101c84d1ba9bc922b916280a986879ff3d9820e09bc
                                  • Instruction ID: fde1af04f327d6695d25a4fa5800f42263264e287728b683c640dd832ccc137b
                                  • Opcode Fuzzy Hash: 736ec75d3280796bdeef9101c84d1ba9bc922b916280a986879ff3d9820e09bc
                                  • Instruction Fuzzy Hash: CD3112E734C114FEE25281417B80AF6676EF7D6330730A4B6BA0BC6A06F7942B893571
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04E40C53
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4135966249.0000000004E40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_4e40000_RageMP131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: abbc3c1a2df6a95081bb3bcf735bd12ba36801e2ba0d04291e7b2e95ad8eca5f
                                  • Instruction ID: 59518962fa399193cbb6df96746c71ad7ebe63d03d07cf5bfcf17cd09b8e6b11
                                  • Opcode Fuzzy Hash: abbc3c1a2df6a95081bb3bcf735bd12ba36801e2ba0d04291e7b2e95ad8eca5f
                                  • Instruction Fuzzy Hash: DE31E1EB34D114FDE65285453B40AF6676EE7CA330730A476BA0BC6A06F7942B483071
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04E40C53
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4135966249.0000000004E40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_4e40000_RageMP131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: 66fa436d6b857a8e5b626a6ae772beb2fa56462ede836ae36aedf774a1226fe7
                                  • Instruction ID: 50615bdc7cc22bf4db8d79111ec0372ee3f26c59ad8a205d84dc6a6a06bd4b7e
                                  • Opcode Fuzzy Hash: 66fa436d6b857a8e5b626a6ae772beb2fa56462ede836ae36aedf774a1226fe7
                                  • Instruction Fuzzy Hash: 5A3145EB74D111EEE61286517B10AF66B6EE7C7330330A4B6F647C6606F3942B4D6231
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04E40C53
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4135966249.0000000004E40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_4e40000_RageMP131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: d53e94e7d5faa3c655b278c786bbe0ef56cd72b45759be0e13b53f013d57dd62
                                  • Instruction ID: ea3648e52b1a706cddf081a58b29cc4633657437903958f5cd60b331d6bebb41
                                  • Opcode Fuzzy Hash: d53e94e7d5faa3c655b278c786bbe0ef56cd72b45759be0e13b53f013d57dd62
                                  • Instruction Fuzzy Hash: 6B21DFEB34D021FEE15285457B40AF6676EE7C6630730A476B60BC6A06F7942B893471
                                  APIs
                                  • Concurrency::cancel_current_task.LIBCPMT ref: 002106AE
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000007.00000002.4129166018.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129278379.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129579639.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130178335.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130462840.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: Concurrency::cancel_current_task
                                  • String ID:
                                  • API String ID: 118556049-0
                                  • Opcode ID: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
                                  • Instruction ID: 83076e327057845a717a4ba5b3c097f4bb480b2b394468aa26eb6652e16f7ace
                                  • Opcode Fuzzy Hash: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
                                  • Instruction Fuzzy Hash: F741E572A101149BCB15EF68D98069E7BE9AF95310F144169FC05EB346D7B0DDB08BE1
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04E40C53
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4135966249.0000000004E40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_4e40000_RageMP131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: 859de972ee0403962278a154e846cc30d6adbcdccf7adfa81099ea8f63e9bf9b
                                  • Instruction ID: 53902b88d8c5f5752f487c8c2bb18e8c6a6a31404fffd174c6081f99c058813b
                                  • Opcode Fuzzy Hash: 859de972ee0403962278a154e846cc30d6adbcdccf7adfa81099ea8f63e9bf9b
                                  • Instruction Fuzzy Hash: E821B1EB30D011FDE66285553B50AF66B6EE7C6330330A8B6FA0BC6606F7943B492571
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04E40C53
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4135966249.0000000004E40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_4e40000_RageMP131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: d19fa47ef3bb652e4a366b3df43b1e718ed56153161636e96d6462788b4ab126
                                  • Instruction ID: d058544a2993ab2241a640950a05894167f05e840226e726aee30c4424d3d799
                                  • Opcode Fuzzy Hash: d19fa47ef3bb652e4a366b3df43b1e718ed56153161636e96d6462788b4ab126
                                  • Instruction Fuzzy Hash: 4221E0EB30D015FEE55285463B50AF6676EE7CA330730A472BA0BC6A06F7942B4D3071
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04E40C53
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4135966249.0000000004E40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_4e40000_RageMP131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: 5bbe005b54f91412764616b4f5aced885c85b04ce5747afef66839aa3a5b8d3a
                                  • Instruction ID: bca1ee38ae2f6c1a8c40e83891c57468099d0b436e48e58eeb6efe7b409d69e8
                                  • Opcode Fuzzy Hash: 5bbe005b54f91412764616b4f5aced885c85b04ce5747afef66839aa3a5b8d3a
                                  • Instruction Fuzzy Hash: A721B0EB30D015FDE55285463B50AF6576EE7CA330730A476B60BC6A06F7943B493071
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04E40C53
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4135966249.0000000004E40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_4e40000_RageMP131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: f8df4dc47ade09534a88bfab9bb82e8911b91e9e70d0494567a97bb9698751f4
                                  • Instruction ID: cfd93396fbb6f900fc4818287c25f157b10e3c382406ea31b62457b95b3f14fb
                                  • Opcode Fuzzy Hash: f8df4dc47ade09534a88bfab9bb82e8911b91e9e70d0494567a97bb9698751f4
                                  • Instruction Fuzzy Hash: 7221B0EB30D011EEE55285463B50AF6676EE7C6330730A4B2B60BC6A06F7942B4D3172
                                  APIs
                                  • FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,002949F9,00000000,CF830579,002D1140,0000000C,00294AB5,00288BBD,?), ref: 00294B68
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000007.00000002.4129166018.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129278379.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129579639.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130178335.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130462840.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ChangeCloseFindNotification
                                  • String ID:
                                  • API String ID: 2591292051-0
                                  • Opcode ID: c9b7ef385f9ac0f2e93e5b083d1a6123ad63fe55f9e5a805c41e26051a3d96b1
                                  • Instruction ID: 4c010bcfcff3dd7f09b83d2808b1c576c59bfcf0207115f444b1fbdb0887b1b5
                                  • Opcode Fuzzy Hash: c9b7ef385f9ac0f2e93e5b083d1a6123ad63fe55f9e5a805c41e26051a3d96b1
                                  • Instruction Fuzzy Hash: 31114832E7121416DF253A75AC25F7E678D8F9277CF2A020AF9088B0C2EE60EC624195
                                  APIs
                                  • SetFilePointerEx.KERNELBASE(00000000,00000000,002D0DF8,001AA3EB,00000002,001AA3EB,00000000,?,?,?,0028E166,00000000,?,001AA3EB,00000002,002D0DF8), ref: 0028E098
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000007.00000002.4129166018.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129278379.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129579639.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130178335.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130462840.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: FilePointer
                                  • String ID:
                                  • API String ID: 973152223-0
                                  • Opcode ID: 9f294ba6162931f66cd0973808806190119cd43709ce5971429d41891b29f9f8
                                  • Instruction ID: 4a38f902d686992f4fa14a01fdbfd7dbc3274efcafc2d6f9e35a07b9ccb7dc09
                                  • Opcode Fuzzy Hash: 9f294ba6162931f66cd0973808806190119cd43709ce5971429d41891b29f9f8
                                  • Instruction Fuzzy Hash: 65012636621215AFCF15AF19CC05C9E3B6ADB81334B250249F851AB2D1E6B2ED618BD0
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 001A220E
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000007.00000002.4129166018.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129278379.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129579639.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130178335.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130462840.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID:
                                  • API String ID: 2659868963-0
                                  • Opcode ID: 0066a1e10b838dc2517601967adab8722ae9df092e045c2984987d96b19a8257
                                  • Instruction ID: 7ec0627b89d2b1a4731f947e5883af93e13595e5f035cd1909d73d709955e1f9
                                  • Opcode Fuzzy Hash: 0066a1e10b838dc2517601967adab8722ae9df092e045c2984987d96b19a8257
                                  • Instruction Fuzzy Hash: D7012B3951430DABCB14FFA8E80299977AC9E01320B408436FE1CDB991EB70E9748BD0
                                  APIs
                                  • RtlAllocateHeap.NTDLL(00000008,002891F7,00000000,?,00295D79,00000001,00000364,00000000,00000006,000000FF,?,00000000,0028D244,002889C3,002891F7,00000000), ref: 00296435
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000007.00000002.4129166018.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129278379.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129579639.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130178335.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130462840.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: AllocateHeap
                                  • String ID:
                                  • API String ID: 1279760036-0
                                  • Opcode ID: 545ce9f5ac8b66467ddf3152798a5470cb66b59cb1f795be01dd233cdeb0931f
                                  • Instruction ID: 185e181de97f036ee12829bc50a2a7cdbda2f42e8ee39505ac21cd2e9662c056
                                  • Opcode Fuzzy Hash: 545ce9f5ac8b66467ddf3152798a5470cb66b59cb1f795be01dd233cdeb0931f
                                  • Instruction Fuzzy Hash: 49F0893157512666DF317FE29C0EB6B7BC99F417A4F15A011AC08A65C0DB70DC3146F1
                                  APIs
                                  • RtlAllocateHeap.NTDLL(00000000,0029D635,4D88C033,?,0029D635,00000220,?,002957EF,4D88C033), ref: 00296E5F
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000007.00000002.4129166018.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129278379.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129579639.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130178335.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130462840.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: AllocateHeap
                                  • String ID:
                                  • API String ID: 1279760036-0
                                  • Opcode ID: 07b7971b70c9b9995811d15f40eaf88af7cdd985f674bf7546a569346954184a
                                  • Instruction ID: 301a10e5a3c9fcfb197585e662ecc9d7dfdccfd8ec4807124bfe958cfe1beb6c
                                  • Opcode Fuzzy Hash: 07b7971b70c9b9995811d15f40eaf88af7cdd985f674bf7546a569346954184a
                                  • Instruction Fuzzy Hash: 75E0ED3E172A2766DE303EA6DD09F5B77C88F817A0F150121AC84A24E2CB60CC3085A4
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4136042782.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_4e50000_RageMP131.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: dc4a0bd117c5c5f337c3e4a7b844a839d026db706ce196e4709155332ac9746f
                                  • Instruction ID: 5a2a764af507803bc91366a6280da9730178443ab2fd36d38ab96ff913d5ad20
                                  • Opcode Fuzzy Hash: dc4a0bd117c5c5f337c3e4a7b844a839d026db706ce196e4709155332ac9746f
                                  • Instruction Fuzzy Hash: E72109EB6881107DB25292816B18AFAAB7EF6D37303309826F842C5423F2D85F4E6131
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4136042782.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_4e50000_RageMP131.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 95663d70ffff63ba306b9f79e3befda40ede459afba0eb95d89ae622de558e7f
                                  • Instruction ID: 95c5f6c25fe1e2961eb52367d1084ef010910b86c9e4d258f3b840702a8294a3
                                  • Opcode Fuzzy Hash: 95663d70ffff63ba306b9f79e3befda40ede459afba0eb95d89ae622de558e7f
                                  • Instruction Fuzzy Hash: 212160EB6880107DF25181906B18AF66B7EF6D3730370E826FC42C5423F288AA4E6131
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4136042782.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_4e50000_RageMP131.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 53c41c4cb0728582050c691fee02f5abfaecbd6daa9d5eefcb36bc0a1d3dd16c
                                  • Instruction ID: 21c39bd4a5ef676a85fefc19ac6f4f411dd893fe7c19bb5335cb31ab951aa70a
                                  • Opcode Fuzzy Hash: 53c41c4cb0728582050c691fee02f5abfaecbd6daa9d5eefcb36bc0a1d3dd16c
                                  • Instruction Fuzzy Hash: 6D1149EB68C0107DB25282816B18AF66B7EE6D3730331A82AFC42C5423F2895A0E6131
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4136042782.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_4e50000_RageMP131.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 2512e08cccbca70c8d41a730daa459016e34ea9bf3155a6bc78a7f717f5729b3
                                  • Instruction ID: 58b340c0256f9188212f66e4209c691e9117afe191d3f690f98cc8be5aa2aa9b
                                  • Opcode Fuzzy Hash: 2512e08cccbca70c8d41a730daa459016e34ea9bf3155a6bc78a7f717f5729b3
                                  • Instruction Fuzzy Hash: BB118FEB2881107DF25296816B18AF6AB7EF6D3330370A436F842D4423F2D81B4E6131
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4136042782.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_4e50000_RageMP131.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: ebc85509d6373921b34ab959d431fb1b3f1e83962544ef6fc13c879c4d884a31
                                  • Instruction ID: 59408b615e9abf7605d53f1c97a8cb5f40e1c6948ad4fac7e33eb7e8d777ac0d
                                  • Opcode Fuzzy Hash: ebc85509d6373921b34ab959d431fb1b3f1e83962544ef6fc13c879c4d884a31
                                  • Instruction Fuzzy Hash: A50184EF68C1207DB15282852B28AFAAB7EF6C27313309437F802D5412F2D85B5D6131
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4136042782.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_4e50000_RageMP131.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: c72191560adcd2a3399e202544d417de532682ffe0ffd25e3fb5051ed1c3683c
                                  • Instruction ID: 2db0ce3eb719d930cae3eff2678fd5d79018933b6e1dc801bb7fe740b6047e20
                                  • Opcode Fuzzy Hash: c72191560adcd2a3399e202544d417de532682ffe0ffd25e3fb5051ed1c3683c
                                  • Instruction Fuzzy Hash: 1001BBEF6881247DB16192952B1CAF7A77EF6D3730370943AF802D0816F6C85B5D6131
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4136042782.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_4e50000_RageMP131.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 09bef79e3943062e49fd1f0c5c8d4d4cd41c03152a1e39b970dbc6f2800d89ca
                                  • Instruction ID: d0f50d166c4eda12ec0fa5cb51f59172585d12b4ed28532663b6c41419875398
                                  • Opcode Fuzzy Hash: 09bef79e3943062e49fd1f0c5c8d4d4cd41c03152a1e39b970dbc6f2800d89ca
                                  • Instruction Fuzzy Hash: DA01A4EB68D1247CB15281812B19AFAAB7EF1D37313749936F802D0813F2C85B5E6131
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4136042782.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_4e50000_RageMP131.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: e6149b5788fc314bb08b7f3a0ad911687881df53bd75f8c94304486d0a626529
                                  • Instruction ID: 9bee84b7fbd31d7e11f69a449e6d0521a0bf9ce50b9fb92d8cbf6b134bb1d55a
                                  • Opcode Fuzzy Hash: e6149b5788fc314bb08b7f3a0ad911687881df53bd75f8c94304486d0a626529
                                  • Instruction Fuzzy Hash: 55F098AF6880157CF16196862B18AFAA73DF2D37313709837F842D0422F6C85B1D6530
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4136042782.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_4e50000_RageMP131.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 465940cb43fb34a3ddf8421d539d0905c84d288c627f451af6d376da65cecdf2
                                  • Instruction ID: 1f480ac6e30360d57b2a57e8e6964b4bb54e6dd9d5c3b3d6150d5c66426a1cd4
                                  • Opcode Fuzzy Hash: 465940cb43fb34a3ddf8421d539d0905c84d288c627f451af6d376da65cecdf2
                                  • Instruction Fuzzy Hash: DAE04EEF68C0147DB05192823B1CAFAA77DF2D37303709836F842D0412A2D84B5E6131
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000007.00000002.4129166018.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129278379.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129579639.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130178335.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130462840.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
                                  • Instruction ID: 5fb4f5a3a4908dbe5290cbef44e4eafe06387f307f4eedee9eec334ca4fec437
                                  • Opcode Fuzzy Hash: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
                                  • Instruction Fuzzy Hash: 04025C75E1121A9BDF14DFA8C9806AEFBF5FF48314F648269D519E7380DB31A911CB80
                                  APIs
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 0020F833
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 0020F855
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 0020F875
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 0020F89F
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 0020F90D
                                  • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0020F959
                                  • std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0020F973
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 0020FA08
                                  • std::_Facet_Register.LIBCPMT ref: 0020FA15
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000007.00000002.4129166018.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129278379.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129579639.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130178335.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130462840.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
                                  • String ID: bad locale name$",
                                  • API String ID: 3375549084-3755561545
                                  • Opcode ID: cecd18cddc7d977882cbd031f8cb2cc2a14f86a64e21ee874b6869aaad957f8b
                                  • Instruction ID: d04c1b24472785ddd9c1385b38f81989888a257ca44e054184537d95b69c61c6
                                  • Opcode Fuzzy Hash: cecd18cddc7d977882cbd031f8cb2cc2a14f86a64e21ee874b6869aaad957f8b
                                  • Instruction Fuzzy Hash: 6561C071D203499FDF60DFA4D945B9EBBB4AF14310F188069E809A7782E774ED14CBA1
                                  APIs
                                  • _ValidateLocalCookies.LIBCMT ref: 00282E47
                                  • ___except_validate_context_record.LIBVCRUNTIME ref: 00282E4F
                                  • _ValidateLocalCookies.LIBCMT ref: 00282ED8
                                  • __IsNonwritableInCurrentImage.LIBCMT ref: 00282F03
                                  • _ValidateLocalCookies.LIBCMT ref: 00282F58
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000007.00000002.4129166018.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129278379.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129579639.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130178335.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130462840.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                  • String ID: i-$csm
                                  • API String ID: 1170836740-2298156223
                                  • Opcode ID: 0dc54f098738b74930305181f827d2f0d72f7a3bb389a8c0e83d59535f8f7d77
                                  • Instruction ID: 84fa196245cf84de9666bbdb9f5b61385e6ff3b69b748a8a1c407435376074a2
                                  • Opcode Fuzzy Hash: 0dc54f098738b74930305181f827d2f0d72f7a3bb389a8c0e83d59535f8f7d77
                                  • Instruction Fuzzy Hash: 3841E738A21209EBCF10EF58C884A9EBBB5EF45314F148055E9149B7D2D731EE69CF91
                                  APIs
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 001A3A58
                                  • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 001A3AA4
                                  • __Getctype.LIBCPMT ref: 001A3ABA
                                  • std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 001A3AE6
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 001A3B7B
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000007.00000002.4129166018.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129278379.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129579639.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130178335.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130462840.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
                                  • String ID: bad locale name
                                  • API String ID: 1840309910-1405518554
                                  • Opcode ID: 7153a208c8cd81cf15f60fa35d5dea86d6e515c8d394b11491c60756dc85158e
                                  • Instruction ID: b33b5804003c8c0a7e14425f4787b52261e7e08ec48ee0eaaed0840de7c69070
                                  • Opcode Fuzzy Hash: 7153a208c8cd81cf15f60fa35d5dea86d6e515c8d394b11491c60756dc85158e
                                  • Instruction Fuzzy Hash: 575161B5D112489FEF10DFA4D845B9EBBB8AF15310F148069F819EB381E774EA18CB61
                                  APIs
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 0020DE93
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 0020DEB6
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 0020DED6
                                  • std::_Facet_Register.LIBCPMT ref: 0020DF4B
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 0020DF63
                                  • Concurrency::cancel_current_task.LIBCPMT ref: 0020DF7B
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000007.00000002.4129166018.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129278379.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129579639.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130178335.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130462840.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
                                  • String ID:
                                  • API String ID: 2081738530-0
                                  • Opcode ID: 28010c4433b1799a2708157f0aa6e8af048628cbf18a2258e16ef1aa60b026db
                                  • Instruction ID: abc922409c2b9162dff1b04a7c0e6bb79938d816a0dc2226ce8fd56c20db88a0
                                  • Opcode Fuzzy Hash: 28010c4433b1799a2708157f0aa6e8af048628cbf18a2258e16ef1aa60b026db
                                  • Instruction Fuzzy Hash: 5B41F271D212169FCB14DF94D849B6EBBB4FB15710F148269E815AB392DB30AD20CBD1
                                  APIs
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 001A4F72
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 001A4FFF
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 001A50C8
                                  Strings
                                  • recursive_directory_iterator::operator++, xrefs: 001A504C
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000007.00000002.4129166018.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129278379.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129579639.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130178335.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130462840.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_destroy$___std_exception_copy
                                  • String ID: recursive_directory_iterator::operator++
                                  • API String ID: 1206660477-953255998
                                  • Opcode ID: a443f62dd7dfacc0e5adefae7553184b7239d4262ea5ec2c9954f7302da83185
                                  • Instruction ID: d560f6a0a2c713b3bc322d100e5bff48b78f38337fc5f5326152e361011fbdeb
                                  • Opcode Fuzzy Hash: a443f62dd7dfacc0e5adefae7553184b7239d4262ea5ec2c9954f7302da83185
                                  • Instruction Fuzzy Hash: 29E105759102049FCB28DF68D845BAEF7F9FF45300F108A2DE45693B82E7B4A954CBA1
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 001A799A
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 001A7B75
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000007.00000002.4129166018.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129278379.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129579639.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130178335.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130462840.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: out_of_range$type_error
                                  • API String ID: 2659868963-3702451861
                                  • Opcode ID: 5716541bf7f5768026a5e876e3a836ec32d912b639eae1924417e410436ff793
                                  • Instruction ID: acf8353ace8d719e32bc2758f357b777ee5565d60fa2c352e7417adfd0466c76
                                  • Opcode Fuzzy Hash: 5716541bf7f5768026a5e876e3a836ec32d912b639eae1924417e410436ff793
                                  • Instruction Fuzzy Hash: E4C169B59002089FDB58CFA8D984B9EFBF1FF49310F14866AE419E7781E7749984CB50
                                  APIs
                                  • std::_Xinvalid_argument.LIBCPMT ref: 001A2275
                                    • Part of subcall function 0027D6E9: std::invalid_argument::invalid_argument.LIBCONCRT ref: 0027D6F5
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000007.00000002.4129166018.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129278379.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129579639.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130178335.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130462840.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: Xinvalid_argumentstd::_std::invalid_argument::invalid_argument
                                  • String ID: string too long$L-$L-
                                  • API String ID: 1997705970-77905906
                                  • Opcode ID: 3f9d0107efebf2c8a2d638cf5fbd2a6d9e44408e8ffb90de447d386557371334
                                  • Instruction ID: d5106d7899414a2951c7f8a7d676449398fc533cd44c2b86b104e1744eaf9e6a
                                  • Opcode Fuzzy Hash: 3f9d0107efebf2c8a2d638cf5fbd2a6d9e44408e8ffb90de447d386557371334
                                  • Instruction Fuzzy Hash: BC81E179A052859FDB16CF6CC4507EEBFB1BF6B300F18416AC894A7782C3758945CBA1
                                  APIs
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 001A75BE
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 001A75CD
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000007.00000002.4129166018.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129278379.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129579639.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130178335.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130462840.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_destroy
                                  • String ID: at line $, column
                                  • API String ID: 4194217158-191570568
                                  • Opcode ID: 9a84bfe0e15f032864443f45a48a9de5e0389ff3f1321ab3cf2e4d200c56592b
                                  • Instruction ID: 393c97ca0ca969a67e8906d07de29f0a6c8cbd87fda570dfb866191df20fc186
                                  • Opcode Fuzzy Hash: 9a84bfe0e15f032864443f45a48a9de5e0389ff3f1321ab3cf2e4d200c56592b
                                  • Instruction Fuzzy Hash: 58611575A142049FDB08DF68DC94BADBBB6FF4A300F24862CE415A77C2D774AA54CB90
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 001A3E7F
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000007.00000002.4129166018.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129278379.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129579639.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130178335.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130462840.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                  • API String ID: 2659868963-1866435925
                                  • Opcode ID: 1ae429c783331f9702656d6ee4c88d096cdbb38a98c73b2c3991691858bd806f
                                  • Instruction ID: 46fd0018d7484f8135ae9d7b1fb94a06feebda05d87e9bb7e8ab6faf24f2ac1b
                                  • Opcode Fuzzy Hash: 1ae429c783331f9702656d6ee4c88d096cdbb38a98c73b2c3991691858bd806f
                                  • Instruction Fuzzy Hash: 8241D5B6910204AFCB04DF98C845BAEF7F8EF4A310F14852AF925D7741E774AA148BA0
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 001A3E7F
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000007.00000002.4129166018.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129278379.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129579639.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130178335.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130462840.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                  • API String ID: 2659868963-1866435925
                                  • Opcode ID: e13fc2a0d315f8db1c656ddf6c0421f390534240a35697569b21f6b5483df2ab
                                  • Instruction ID: e107e710da847a439edb641cb9f1e0042d6ebd2fb9dcdb5afeece9078fba2ccb
                                  • Opcode Fuzzy Hash: e13fc2a0d315f8db1c656ddf6c0421f390534240a35697569b21f6b5483df2ab
                                  • Instruction Fuzzy Hash: 90212BB6910304AFC714DF98D801F96F7DCAB06310F08886AFA78C7641E774EA24CB90
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 001A7340
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000007.00000002.4129166018.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129278379.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129579639.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130178335.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130462840.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: parse error$parse_error
                                  • API String ID: 2659868963-1820534363
                                  • Opcode ID: b8bd574dec8177d7dc99ad8e8e9f4f5f4e475482575eb34bb5e76c07e2391e1e
                                  • Instruction ID: 92c8c26d2d2200a94325f05c741cded6e65d05bcd43fd7a2e24b40372ece7a61
                                  • Opcode Fuzzy Hash: b8bd574dec8177d7dc99ad8e8e9f4f5f4e475482575eb34bb5e76c07e2391e1e
                                  • Instruction Fuzzy Hash: BEE17C749042488FDB18CF68CD94BADBBB1FF49300F248269E418EB792D7749A85CF90
                                  APIs
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 001A6F11
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 001A6F20
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000007.00000002.4129166018.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129278379.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129579639.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130178335.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130462840.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_destroy
                                  • String ID: [json.exception.
                                  • API String ID: 4194217158-791563284
                                  • Opcode ID: 111e496ef94ea28fb43651af2e5fd20a98fd81b2947c6c7c46d64bacafb70551
                                  • Instruction ID: d2c0a6da5da8981e7dd2b487033fc4868bb653cff16d5d10b090bea5d415a861
                                  • Opcode Fuzzy Hash: 111e496ef94ea28fb43651af2e5fd20a98fd81b2947c6c7c46d64bacafb70551
                                  • Instruction Fuzzy Hash: B391E474A002049FDB18CF68C994BAEFBF6FF46300F24866CE419AB791D771A985CB50
                                  APIs
                                  • std::_Xinvalid_argument.LIBCPMT ref: 0021B612
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000007.00000002.4129166018.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129278379.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129579639.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130178335.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130462840.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: Xinvalid_argumentstd::_
                                  • String ID: Px!$invalid hash bucket count
                                  • API String ID: 909987262-1766863255
                                  • Opcode ID: bebad3da1a5ae37abf669b7b5f8ce494fdb8838e7aa2be20a3331b2f1a8cefbb
                                  • Instruction ID: 96a57ff71c40646cba73a34b1504f72fbc244bbfd1fc4b10332717b31c32295b
                                  • Opcode Fuzzy Hash: bebad3da1a5ae37abf669b7b5f8ce494fdb8838e7aa2be20a3331b2f1a8cefbb
                                  • Instruction Fuzzy Hash: 227133B4A10605EFCB15CF48C1808AAFBFAFF98300764C5AAD8199B315D731EA91CF90
                                  APIs
                                  • Concurrency::cancel_current_task.LIBCPMT ref: 0021E491
                                  Strings
                                  • type must be boolean, but is , xrefs: 0021E582
                                  • type must be string, but is , xrefs: 0021E4F8
                                  Memory Dump Source
                                  • Source File: 00000007.00000002.4129278379.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000007.00000002.4129166018.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129278379.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129579639.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4129609409.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130178335.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000007.00000002.4130462840.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_7_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: Concurrency::cancel_current_task
                                  • String ID: type must be boolean, but is $type must be string, but is
                                  • API String ID: 118556049-436076039
                                  • Opcode ID: dd57cf8771039f6da5c4db4436e9afccc9ecb3256ec21fcfda4d51c5a516ce6d
                                  • Instruction ID: 807f83b116ce08602a82da5c397a1371a26fbed58aa9945632879e5ef5bf4cde
                                  • Opcode Fuzzy Hash: dd57cf8771039f6da5c4db4436e9afccc9ecb3256ec21fcfda4d51c5a516ce6d
                                  • Instruction Fuzzy Hash: 98415DB5910248AFCF14EFA4DC02B9E77A8DB24310F144679F815D7AC2EB35E964C791

                                  Execution Graph

                                  Execution Coverage:2.9%
                                  Dynamic/Decrypted Code Coverage:2.3%
                                  Signature Coverage:0%
                                  Total number of Nodes:748
                                  Total number of Limit Nodes:75
                                  execution_graph 18830 295d2c 18831 295d35 __Getctype 18830->18831 18832 2963f3 __Getctype RtlAllocateHeap 18831->18832 18838 295d4c 18831->18838 18833 295d79 __Getctype 18832->18833 18834 295db9 18833->18834 18835 295d81 __Getctype 18833->18835 18837 295a09 __Getctype RtlAllocateHeap 18834->18837 18836 296db3 ___std_exception_copy RtlAllocateHeap 18835->18836 18836->18838 18839 295dc4 18837->18839 18840 296db3 ___std_exception_copy RtlAllocateHeap 18839->18840 18840->18838 18843 1aa210 18844 27f290 std::_Facet_Register RtlAllocateHeap 18843->18844 18845 1aa248 18844->18845 18876 1a2ae0 18845->18876 18847 1aa28b 18892 285362 18847->18892 18851 1aa377 18853 1aa34e 18853->18851 18855 2847b0 RtlAllocateHeap 18853->18855 18859 1aa399 18855->18859 18857 289136 4 API calls 18858 1aa2fc 18857->18858 18863 1aa318 18858->18863 18907 20cf60 18858->18907 18861 285362 RtlAllocateHeap 18859->18861 18862 1aa3d8 18861->18862 18866 289136 4 API calls 18862->18866 18870 1aa3f9 18862->18870 18912 28dbdf 18863->18912 18864 1aa423 18867 1aa3eb 18866->18867 18869 284eeb 2 API calls 18867->18869 18872 1aa3f1 18869->18872 18870->18864 18873 2847b0 RtlAllocateHeap 18870->18873 18874 288be8 5 API calls 18872->18874 18875 1aa439 18873->18875 18874->18870 18877 1a2ba5 18876->18877 18883 1a2af6 18876->18883 18878 1a2270 RtlAllocateHeap 18877->18878 18881 1a2baa 18878->18881 18879 1a2b02 std::locale::_Locimp::_Locimp 18879->18847 18880 1a2b2a 18884 27f290 std::_Facet_Register RtlAllocateHeap 18880->18884 18882 1a21d0 Concurrency::cancel_current_task RtlAllocateHeap 18881->18882 18885 1a2b3d 18882->18885 18883->18879 18883->18880 18886 1a2b6e 18883->18886 18887 1a2b65 18883->18887 18884->18885 18888 2847b0 RtlAllocateHeap 18885->18888 18891 1a2b46 std::locale::_Locimp::_Locimp 18885->18891 18890 27f290 std::_Facet_Register RtlAllocateHeap 18886->18890 18886->18891 18887->18880 18887->18881 18889 1a2bb4 18888->18889 18890->18891 18891->18847 18921 2852a0 18892->18921 18894 1aa2d7 18894->18853 18895 289136 18894->18895 18896 289149 __fread_nolock 18895->18896 18945 288e8d 18896->18945 18898 28915e 18899 2844dc __fread_nolock RtlAllocateHeap 18898->18899 18900 1aa2ea 18899->18900 18901 284eeb 18900->18901 18902 284efe __fread_nolock 18901->18902 19078 284801 18902->19078 18904 284f0a 18905 2844dc __fread_nolock RtlAllocateHeap 18904->18905 18906 1aa2f0 18905->18906 18906->18857 18908 20cfa7 18907->18908 18911 20cf78 __fread_nolock 18907->18911 19126 210560 18908->19126 18910 20cfba 18910->18863 18911->18863 19141 28dbfc 18912->19141 18914 1aa348 18915 288be8 18914->18915 18916 288bfb __fread_nolock 18915->18916 19265 288ac3 18916->19265 18918 288c07 18919 2844dc __fread_nolock RtlAllocateHeap 18918->18919 18920 288c13 18919->18920 18920->18853 18923 2852ac __fread_nolock 18921->18923 18922 2852b3 18924 28d23f __dosmaperr RtlAllocateHeap 18922->18924 18923->18922 18926 2852d3 18923->18926 18925 2852b8 18924->18925 18927 2847a0 __fread_nolock RtlAllocateHeap 18925->18927 18928 2852d8 18926->18928 18929 2852e5 18926->18929 18930 2852c3 18927->18930 18931 28d23f __dosmaperr RtlAllocateHeap 18928->18931 18935 296688 18929->18935 18930->18894 18931->18930 18933 2852ee 18933->18930 18934 28d23f __dosmaperr RtlAllocateHeap 18933->18934 18934->18930 18936 296694 __fread_nolock std::_Lockit::_Lockit 18935->18936 18939 29672c 18936->18939 18938 2966af 18938->18933 18944 29674f __fread_nolock 18939->18944 18940 2963f3 __Getctype RtlAllocateHeap 18941 2967b0 18940->18941 18942 296db3 ___std_exception_copy RtlAllocateHeap 18941->18942 18943 296795 __fread_nolock 18942->18943 18943->18938 18944->18940 18944->18943 18946 288e99 __fread_nolock 18945->18946 18947 288e9f 18946->18947 18949 288ee2 __fread_nolock 18946->18949 18948 284723 __fread_nolock RtlAllocateHeap 18947->18948 18951 288eba 18948->18951 18952 289010 18949->18952 18951->18898 18953 289023 18952->18953 18954 289036 18952->18954 18953->18951 18961 288f37 18954->18961 18956 2890e7 18956->18951 18957 289059 18957->18956 18965 2855d3 18957->18965 18962 288fa0 18961->18962 18963 288f48 18961->18963 18962->18957 18963->18962 18974 28e13d 18963->18974 18966 2855ec 18965->18966 18967 285613 18965->18967 18966->18967 19001 295f82 18966->19001 18971 28e17d 18967->18971 18969 285608 19008 29538b 18969->19008 18972 28e05c __fread_nolock 2 API calls 18971->18972 18973 28e196 18972->18973 18973->18956 18975 28e151 __fread_nolock 18974->18975 18980 28e05c 18975->18980 18977 28e166 18978 2844dc __fread_nolock RtlAllocateHeap 18977->18978 18979 28e175 18978->18979 18979->18962 18985 29a6de 18980->18985 18982 28e06e 18983 28e08a SetFilePointerEx 18982->18983 18984 28e076 __fread_nolock 18982->18984 18983->18984 18984->18977 18986 29a6eb 18985->18986 18987 29a700 18985->18987 18998 28d22c 18986->18998 18989 28d22c __dosmaperr RtlAllocateHeap 18987->18989 18992 29a725 18987->18992 18993 29a730 18989->18993 18991 28d23f __dosmaperr RtlAllocateHeap 18995 29a6f8 18991->18995 18992->18982 18994 28d23f __dosmaperr RtlAllocateHeap 18993->18994 18996 29a738 18994->18996 18995->18982 18997 2847a0 __fread_nolock RtlAllocateHeap 18996->18997 18997->18995 18999 295d2c __dosmaperr RtlAllocateHeap 18998->18999 19000 28d231 18999->19000 19000->18991 19002 295f8e 19001->19002 19003 295fa3 19001->19003 19004 28d23f __dosmaperr RtlAllocateHeap 19002->19004 19003->18969 19005 295f93 19004->19005 19006 2847a0 __fread_nolock RtlAllocateHeap 19005->19006 19007 295f9e 19006->19007 19007->18969 19010 295397 __fread_nolock 19008->19010 19009 2953d8 19011 284723 __fread_nolock RtlAllocateHeap 19009->19011 19010->19009 19012 29541e 19010->19012 19013 29539f 19010->19013 19011->19013 19012->19013 19015 29549c 19012->19015 19013->18967 19016 2954c4 19015->19016 19028 2954e7 __fread_nolock 19015->19028 19017 2954c8 19016->19017 19019 295523 19016->19019 19018 284723 __fread_nolock RtlAllocateHeap 19017->19018 19018->19028 19020 295541 19019->19020 19021 28e17d 2 API calls 19019->19021 19029 294fe1 19020->19029 19021->19020 19024 295559 19024->19028 19034 294bb2 19024->19034 19025 2955a0 19026 295609 WriteFile 19025->19026 19025->19028 19026->19028 19028->19013 19040 2a0d44 19029->19040 19031 295021 19031->19024 19031->19025 19032 294ff3 19032->19031 19049 289d10 19032->19049 19035 294c1a 19034->19035 19036 289d10 std::_Locinfo::_Locinfo_ctor 2 API calls 19035->19036 19038 294c2b std::_Locinfo::_Locinfo_ctor std::locale::_Locimp::_Locimp 19035->19038 19036->19038 19037 294ee1 _ValidateLocalCookies 19037->19028 19038->19037 19039 2984be RtlAllocateHeap RtlAllocateHeap 19038->19039 19039->19038 19041 2a0d5e 19040->19041 19042 2a0d51 19040->19042 19044 2a0d6a 19041->19044 19045 28d23f __dosmaperr RtlAllocateHeap 19041->19045 19043 28d23f __dosmaperr RtlAllocateHeap 19042->19043 19046 2a0d56 19043->19046 19044->19032 19047 2a0d8b 19045->19047 19046->19032 19048 2847a0 __fread_nolock RtlAllocateHeap 19047->19048 19048->19046 19050 284587 __fread_nolock RtlAllocateHeap 19049->19050 19051 289d20 19050->19051 19056 295ef3 19051->19056 19057 295f0a 19056->19057 19058 289d3d 19056->19058 19057->19058 19064 29f4f3 19057->19064 19060 295f51 19058->19060 19061 295f68 19060->19061 19062 289d4a 19060->19062 19061->19062 19073 29d81e 19061->19073 19062->19031 19065 29f4ff __fread_nolock 19064->19065 19066 295bdb __Getctype RtlAllocateHeap 19065->19066 19068 29f508 std::_Lockit::_Lockit 19066->19068 19067 29f54e 19067->19058 19068->19067 19069 29f574 __Getctype RtlAllocateHeap 19068->19069 19070 29f537 __Getctype 19069->19070 19070->19067 19071 290259 __Getctype RtlAllocateHeap 19070->19071 19072 29f573 19071->19072 19074 295bdb __Getctype RtlAllocateHeap 19073->19074 19075 29d823 19074->19075 19076 29d736 std::_Locinfo::_Locinfo_ctor RtlAllocateHeap RtlAllocateHeap 19075->19076 19077 29d82e 19076->19077 19077->19062 19079 28480d __fread_nolock 19078->19079 19080 284814 19079->19080 19082 284835 __fread_nolock 19079->19082 19081 284723 __fread_nolock RtlAllocateHeap 19080->19081 19084 28482d 19081->19084 19085 284910 19082->19085 19084->18904 19088 284942 19085->19088 19087 284922 19087->19084 19089 284979 19088->19089 19090 284951 19088->19090 19092 295f82 __fread_nolock RtlAllocateHeap 19089->19092 19091 284723 __fread_nolock RtlAllocateHeap 19090->19091 19100 28496c __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 19091->19100 19093 284982 19092->19093 19101 28e11f 19093->19101 19096 284a2c 19104 284cae 19096->19104 19098 284a43 19098->19100 19112 284ae3 19098->19112 19100->19087 19119 28df37 19101->19119 19103 2849a0 19103->19096 19103->19098 19103->19100 19105 284cbd 19104->19105 19106 295f82 __fread_nolock RtlAllocateHeap 19105->19106 19107 284cd9 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 19106->19107 19108 28e11f 2 API calls 19107->19108 19109 284ce5 _ValidateLocalCookies 19107->19109 19110 284d39 19108->19110 19109->19100 19110->19109 19111 28e11f 2 API calls 19110->19111 19111->19109 19113 295f82 __fread_nolock RtlAllocateHeap 19112->19113 19114 284af6 19113->19114 19115 28e11f 2 API calls 19114->19115 19118 284b40 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 19114->19118 19116 284b9d 19115->19116 19117 28e11f 2 API calls 19116->19117 19116->19118 19117->19118 19118->19100 19121 28df43 __fread_nolock 19119->19121 19120 28df4b 19120->19103 19121->19120 19122 28df86 19121->19122 19124 28dfcc 19121->19124 19123 284723 __fread_nolock RtlAllocateHeap 19122->19123 19123->19120 19124->19120 19125 28e05c __fread_nolock 2 API calls 19124->19125 19125->19120 19127 2106a9 19126->19127 19131 210585 19126->19131 19128 1a2270 RtlAllocateHeap 19127->19128 19129 2106ae 19128->19129 19130 1a21d0 Concurrency::cancel_current_task RtlAllocateHeap 19129->19130 19139 2105aa __fread_nolock std::locale::_Locimp::_Locimp 19130->19139 19133 2105f0 19131->19133 19134 2105e3 19131->19134 19136 21059a 19131->19136 19132 27f290 std::_Facet_Register RtlAllocateHeap 19132->19139 19138 27f290 std::_Facet_Register RtlAllocateHeap 19133->19138 19133->19139 19134->19129 19134->19136 19135 2847b0 RtlAllocateHeap 19137 2106b8 19135->19137 19136->19132 19138->19139 19139->19135 19140 210667 __fread_nolock std::locale::_Locimp::_Locimp 19139->19140 19140->18910 19143 28dc08 __fread_nolock 19141->19143 19142 28dc40 __fread_nolock 19142->18914 19143->19142 19144 28dc1b __fread_nolock 19143->19144 19145 28dc52 __fread_nolock 19143->19145 19146 28d23f __dosmaperr RtlAllocateHeap 19144->19146 19150 28da06 19145->19150 19148 28dc35 19146->19148 19149 2847a0 __fread_nolock RtlAllocateHeap 19148->19149 19149->19142 19153 28da18 __fread_nolock 19150->19153 19156 28da35 19150->19156 19151 28da25 19152 28d23f __dosmaperr RtlAllocateHeap 19151->19152 19154 28da2a 19152->19154 19153->19151 19153->19156 19158 28da76 __fread_nolock 19153->19158 19155 2847a0 __fread_nolock RtlAllocateHeap 19154->19155 19155->19156 19156->19142 19157 28dba1 __fread_nolock 19161 28d23f __dosmaperr RtlAllocateHeap 19157->19161 19158->19156 19158->19157 19160 295f82 __fread_nolock RtlAllocateHeap 19158->19160 19163 294623 19158->19163 19222 288a2b 19158->19222 19160->19158 19161->19154 19164 29464d 19163->19164 19165 294635 19163->19165 19167 29498f 19164->19167 19175 294690 19164->19175 19166 28d22c __dosmaperr RtlAllocateHeap 19165->19166 19168 29463a 19166->19168 19169 28d22c __dosmaperr RtlAllocateHeap 19167->19169 19171 28d23f __dosmaperr RtlAllocateHeap 19168->19171 19170 294994 19169->19170 19172 28d23f __dosmaperr RtlAllocateHeap 19170->19172 19173 294642 19171->19173 19176 2946a8 19172->19176 19173->19158 19174 29469b 19177 28d22c __dosmaperr RtlAllocateHeap 19174->19177 19175->19173 19175->19174 19181 2946cb 19175->19181 19180 2847a0 __fread_nolock RtlAllocateHeap 19176->19180 19178 2946a0 19177->19178 19179 28d23f __dosmaperr RtlAllocateHeap 19178->19179 19179->19176 19180->19173 19182 2946e4 19181->19182 19183 29471f 19181->19183 19184 2946f1 19181->19184 19182->19184 19188 29470d 19182->19188 19236 296e2d 19183->19236 19185 28d22c __dosmaperr RtlAllocateHeap 19184->19185 19187 2946f6 19185->19187 19190 28d23f __dosmaperr RtlAllocateHeap 19187->19190 19191 2a0d44 __fread_nolock RtlAllocateHeap 19188->19191 19193 2946fd 19190->19193 19205 29486b 19191->19205 19192 296db3 ___std_exception_copy RtlAllocateHeap 19194 294739 19192->19194 19195 2847a0 __fread_nolock RtlAllocateHeap 19193->19195 19197 296db3 ___std_exception_copy RtlAllocateHeap 19194->19197 19221 294708 __fread_nolock 19195->19221 19196 2948e3 ReadFile 19198 2948fb 19196->19198 19199 294957 19196->19199 19200 294740 19197->19200 19198->19199 19201 2948d4 19198->19201 19209 294964 19199->19209 19219 2948b5 19199->19219 19202 29474a 19200->19202 19203 294765 19200->19203 19212 294920 19201->19212 19213 294937 19201->19213 19201->19221 19206 28d23f __dosmaperr RtlAllocateHeap 19202->19206 19204 28e13d __fread_nolock 2 API calls 19203->19204 19204->19188 19205->19196 19208 29489b 19205->19208 19210 29474f 19206->19210 19207 296db3 ___std_exception_copy RtlAllocateHeap 19207->19173 19208->19201 19208->19219 19211 28d23f __dosmaperr RtlAllocateHeap 19209->19211 19214 28d22c __dosmaperr RtlAllocateHeap 19210->19214 19215 294969 19211->19215 19247 294335 19212->19247 19213->19221 19257 29417b 19213->19257 19214->19221 19220 28d22c __dosmaperr RtlAllocateHeap 19215->19220 19219->19221 19242 28d1e5 19219->19242 19220->19221 19221->19207 19223 288a3c 19222->19223 19226 288a38 std::locale::_Locimp::_Locimp 19222->19226 19224 288a43 19223->19224 19228 288a56 __fread_nolock 19223->19228 19225 28d23f __dosmaperr RtlAllocateHeap 19224->19225 19227 288a48 19225->19227 19226->19158 19229 2847a0 __fread_nolock RtlAllocateHeap 19227->19229 19228->19226 19230 288a8d 19228->19230 19231 288a84 19228->19231 19229->19226 19230->19226 19233 28d23f __dosmaperr RtlAllocateHeap 19230->19233 19232 28d23f __dosmaperr RtlAllocateHeap 19231->19232 19234 288a89 19232->19234 19233->19234 19235 2847a0 __fread_nolock RtlAllocateHeap 19234->19235 19235->19226 19237 296e6b 19236->19237 19241 296e3b __Getctype std::_Facet_Register 19236->19241 19238 28d23f __dosmaperr RtlAllocateHeap 19237->19238 19240 294730 19238->19240 19239 296e56 RtlAllocateHeap 19239->19240 19239->19241 19240->19192 19241->19237 19241->19239 19243 28d22c __dosmaperr RtlAllocateHeap 19242->19243 19244 28d1f0 __dosmaperr 19243->19244 19245 28d23f __dosmaperr RtlAllocateHeap 19244->19245 19246 28d203 19245->19246 19246->19221 19261 29402e 19247->19261 19250 2943d7 19254 294391 __fread_nolock 19250->19254 19255 28e13d __fread_nolock 2 API calls 19250->19255 19251 2943c7 19252 28d23f __dosmaperr RtlAllocateHeap 19251->19252 19253 29437d 19252->19253 19253->19221 19254->19253 19256 28d1e5 __dosmaperr RtlAllocateHeap 19254->19256 19255->19254 19256->19253 19258 2941b5 19257->19258 19259 294246 19258->19259 19260 28e13d __fread_nolock 2 API calls 19258->19260 19259->19221 19260->19259 19262 294062 19261->19262 19263 2940ce 19262->19263 19264 28e13d __fread_nolock 2 API calls 19262->19264 19263->19250 19263->19251 19263->19253 19263->19254 19264->19263 19266 288acf __fread_nolock 19265->19266 19267 288ad9 19266->19267 19269 288afc __fread_nolock 19266->19269 19268 284723 __fread_nolock RtlAllocateHeap 19267->19268 19270 288af4 19268->19270 19269->19270 19272 288b5a 19269->19272 19270->18918 19273 288b8a 19272->19273 19274 288b67 19272->19274 19276 2855d3 4 API calls 19273->19276 19284 288b82 19273->19284 19275 284723 __fread_nolock RtlAllocateHeap 19274->19275 19275->19284 19277 288ba2 19276->19277 19286 296ded 19277->19286 19280 295f82 __fread_nolock RtlAllocateHeap 19281 288bb6 19280->19281 19290 294a3f 19281->19290 19284->19270 19285 296db3 ___std_exception_copy RtlAllocateHeap 19285->19284 19287 296e04 19286->19287 19289 288baa 19286->19289 19288 296db3 ___std_exception_copy RtlAllocateHeap 19287->19288 19287->19289 19288->19289 19289->19280 19291 294a68 19290->19291 19292 288bbd 19290->19292 19293 294ab7 19291->19293 19295 294a8f 19291->19295 19292->19284 19292->19285 19294 284723 __fread_nolock RtlAllocateHeap 19293->19294 19294->19292 19297 2949ae 19295->19297 19298 2949ba __fread_nolock 19297->19298 19300 2949f9 19298->19300 19301 294b12 19298->19301 19300->19292 19302 29a6de __fread_nolock RtlAllocateHeap 19301->19302 19303 294b22 19302->19303 19305 29a6de __fread_nolock RtlAllocateHeap 19303->19305 19311 294b28 19303->19311 19312 294b5a 19303->19312 19307 294b51 19305->19307 19306 29a6de __fread_nolock RtlAllocateHeap 19308 294b66 FindCloseChangeNotification 19306->19308 19310 29a6de __fread_nolock RtlAllocateHeap 19307->19310 19308->19311 19309 294b80 __fread_nolock 19309->19300 19310->19312 19313 29a64d 19311->19313 19312->19306 19312->19311 19314 29a65c 19313->19314 19315 28d23f __dosmaperr RtlAllocateHeap 19314->19315 19318 29a686 19314->19318 19316 29a6c8 19315->19316 19317 28d22c __dosmaperr RtlAllocateHeap 19316->19317 19317->19318 19318->19309 19325 1bea00 19332 1bea62 19325->19332 19326 1bf193 19327 2847b0 RtlAllocateHeap 19328 1bf1b3 19327->19328 19340 27e4bb 19328->19340 19332->19326 19332->19327 19341 27e4c6 19340->19341 19342 27e4d9 19341->19342 19345 290259 std::locale::_Setgloballocale 19341->19345 19349 27e4e8 19342->19349 19344 290269 std::locale::_Setgloballocale 19347 28f224 std::locale::_Setgloballocale RtlAllocateHeap 19344->19347 19345->19344 19346 29c7c6 std::locale::_Setgloballocale RtlAllocateHeap 19345->19346 19346->19344 19348 29029c 19347->19348 19350 27e4fe 19349->19350 19357 27e46e 19350->19357 19352 27e50e Concurrency::cancel_current_task 19353 27e583 19352->19353 19354 289136 4 API calls 19352->19354 19355 27e57d 19352->19355 19353->19342 19354->19355 19355->19353 19356 288be8 5 API calls 19355->19356 19356->19353 19358 27e47a __EH_prolog3_GS 19357->19358 19365 1a2980 19358->19365 19362 27e4a3 19386 1a28d0 19362->19386 19364 27e4ab 19364->19352 19366 1a29a2 19365->19366 19366->19366 19367 1a2ae0 RtlAllocateHeap 19366->19367 19368 1a29b4 19367->19368 19369 1a3190 19368->19369 19391 20a770 19369->19391 19371 1a31be 19372 1a31e1 19371->19372 19408 2106c0 19371->19408 19423 20a4f0 19372->19423 19375 1a3236 19376 1a3260 19375->19376 19377 1a332b 19375->19377 19378 280651 ___std_exception_copy RtlAllocateHeap 19376->19378 19379 2847b0 RtlAllocateHeap 19377->19379 19381 1a32cb 19378->19381 19379->19381 19380 1a32fa 19380->19362 19381->19380 19382 2847b0 RtlAllocateHeap 19381->19382 19383 1a3335 19382->19383 19428 2806b4 19383->19428 19385 1a3355 19385->19362 19387 1a28db 19386->19387 19388 1a28f6 19386->19388 19387->19388 19389 2847b0 RtlAllocateHeap 19387->19389 19388->19364 19390 1a291a 19389->19390 19390->19364 19392 20a799 19391->19392 19393 20a851 19392->19393 19399 20a7aa 19392->19399 19395 1a2270 RtlAllocateHeap 19393->19395 19394 20a7b6 std::locale::_Locimp::_Locimp 19394->19371 19396 20a856 19395->19396 19398 1a21d0 Concurrency::cancel_current_task RtlAllocateHeap 19396->19398 19397 20a7db 19403 27f290 std::_Facet_Register RtlAllocateHeap 19397->19403 19400 20a7ee 19398->19400 19399->19394 19399->19397 19401 20a814 19399->19401 19402 20a81d 19399->19402 19404 2847b0 RtlAllocateHeap 19400->19404 19407 20a7f5 std::locale::_Locimp::_Locimp 19400->19407 19401->19396 19401->19397 19406 27f290 std::_Facet_Register RtlAllocateHeap 19402->19406 19402->19407 19403->19400 19405 20a860 19404->19405 19405->19371 19406->19407 19407->19371 19409 210802 19408->19409 19413 2106e5 19408->19413 19410 1a2270 RtlAllocateHeap 19409->19410 19411 210807 19410->19411 19412 1a21d0 Concurrency::cancel_current_task RtlAllocateHeap 19411->19412 19421 21070a std::locale::_Locimp::_Locimp 19412->19421 19415 210750 19413->19415 19416 210743 19413->19416 19418 2106fa 19413->19418 19414 27f290 std::_Facet_Register RtlAllocateHeap 19414->19421 19419 27f290 std::_Facet_Register RtlAllocateHeap 19415->19419 19415->19421 19416->19411 19416->19418 19417 2847b0 RtlAllocateHeap 19420 210811 19417->19420 19418->19414 19419->19421 19420->19372 19421->19417 19422 2107c0 std::locale::_Locimp::_Locimp 19421->19422 19422->19372 19424 20a504 19423->19424 19425 2106c0 RtlAllocateHeap 19424->19425 19427 20a514 std::locale::_Locimp::_Locimp 19424->19427 19426 20a55a 19425->19426 19426->19375 19427->19375 19429 2806c8 19428->19429 19430 2806c1 19428->19430 19429->19385 19431 28d7d6 ___std_exception_copy RtlAllocateHeap 19430->19431 19431->19429 19432 4d802f8 19433 4d80325 19432->19433 19435 4d80396 19433->19435 19436 4d803a3 19433->19436 19437 4d803be GetCurrentHwProfileW 19436->19437 19439 4d80466 19437->19439 19319 1be0a0 WSAStartup 19320 1be0d8 19319->19320 19321 1be1a7 19319->19321 19320->19321 19322 1be175 socket 19320->19322 19322->19321 19323 1be18b connect 19322->19323 19323->19321 19324 1be19d closesocket 19323->19324 19324->19321 19324->19322 20605 4d803e4 20606 4d803f1 GetCurrentHwProfileW 20605->20606 20608 4d80466 20606->20608 18559 203a40 18562 203a55 18559->18562 18560 203b28 GetPEB 18560->18562 18561 203a73 GetPEB 18561->18562 18562->18560 18562->18561 18563 203b9d Sleep 18562->18563 18564 203ae8 Sleep 18562->18564 18565 203bc7 18562->18565 18563->18562 18564->18562 18566 2106c0 18567 210802 18566->18567 18571 2106e5 18566->18571 18586 1a2270 18567->18586 18569 210807 18596 1a21d0 18569->18596 18573 210750 18571->18573 18574 210743 18571->18574 18576 2106fa 18571->18576 18572 27f290 std::_Facet_Register RtlAllocateHeap 18579 21070a std::locale::_Locimp::_Locimp 18572->18579 18573->18579 18581 27f290 18573->18581 18574->18569 18574->18576 18576->18572 18580 2107c0 std::locale::_Locimp::_Locimp 18579->18580 18600 2847b0 18579->18600 18583 1a21d0 Concurrency::cancel_current_task ___std_exception_copy std::_Facet_Register 18581->18583 18582 27f2af 18582->18579 18583->18582 18603 280651 18583->18603 18821 27d6e9 18586->18821 18597 1a21de Concurrency::cancel_current_task 18596->18597 18598 280651 ___std_exception_copy RtlAllocateHeap 18597->18598 18599 1a2213 18598->18599 18599->18579 18601 2846ec __fread_nolock RtlAllocateHeap 18600->18601 18602 2847bf __Getctype 18601->18602 18604 28065e ___std_exception_copy 18603->18604 18608 1a2213 18603->18608 18605 28068b 18604->18605 18604->18608 18609 2956b8 18604->18609 18618 28d7d6 18605->18618 18608->18579 18610 2956d4 18609->18610 18611 2956c6 18609->18611 18621 28d23f 18610->18621 18611->18610 18616 2956ec 18611->18616 18613 2956dc 18624 2847a0 18613->18624 18615 2956e6 18615->18605 18616->18615 18617 28d23f __dosmaperr RtlAllocateHeap 18616->18617 18617->18613 18619 296db3 ___std_exception_copy RtlAllocateHeap 18618->18619 18620 28d7ee 18619->18620 18620->18608 18627 295d2c 18621->18627 18732 2846ec 18624->18732 18628 295d35 __Getctype 18627->18628 18635 28d244 18628->18635 18638 2963f3 18628->18638 18630 295d79 __Getctype 18631 295db9 18630->18631 18632 295d81 __Getctype 18630->18632 18646 295a09 18631->18646 18642 296db3 18632->18642 18635->18613 18637 296db3 ___std_exception_copy RtlAllocateHeap 18637->18635 18641 296400 __Getctype std::_Facet_Register 18638->18641 18639 29642b RtlAllocateHeap 18640 29643e __dosmaperr 18639->18640 18639->18641 18640->18630 18641->18639 18641->18640 18643 296dbe __dosmaperr 18642->18643 18645 296de8 18642->18645 18644 28d23f __dosmaperr RtlAllocateHeap 18643->18644 18643->18645 18644->18645 18645->18635 18647 295a77 __Getctype 18646->18647 18650 2959af 18647->18650 18649 295aa0 18649->18637 18651 2959bb __fread_nolock std::_Lockit::_Lockit 18650->18651 18654 295b90 18651->18654 18653 2959dd __Getctype 18653->18649 18655 295b9f __Getctype 18654->18655 18657 295bc6 __Getctype 18654->18657 18655->18657 18658 29f2a7 18655->18658 18657->18653 18659 29f327 18658->18659 18662 29f2bd 18658->18662 18661 296db3 ___std_exception_copy RtlAllocateHeap 18659->18661 18684 29f375 18659->18684 18663 29f349 18661->18663 18662->18659 18667 296db3 ___std_exception_copy RtlAllocateHeap 18662->18667 18680 29f2f0 18662->18680 18664 296db3 ___std_exception_copy RtlAllocateHeap 18663->18664 18665 29f35c 18664->18665 18669 296db3 ___std_exception_copy RtlAllocateHeap 18665->18669 18666 296db3 ___std_exception_copy RtlAllocateHeap 18671 29f31c 18666->18671 18668 29f2e5 18667->18668 18686 29e5ab 18668->18686 18674 29f36a 18669->18674 18670 296db3 ___std_exception_copy RtlAllocateHeap 18675 29f307 18670->18675 18676 296db3 ___std_exception_copy RtlAllocateHeap 18671->18676 18672 29f3e3 18677 296db3 ___std_exception_copy RtlAllocateHeap 18672->18677 18681 296db3 ___std_exception_copy RtlAllocateHeap 18674->18681 18714 29ea0a 18675->18714 18676->18659 18678 29f3e9 18677->18678 18678->18657 18679 29f383 18679->18672 18683 296db3 RtlAllocateHeap ___std_exception_copy 18679->18683 18680->18670 18685 29f312 18680->18685 18681->18684 18683->18679 18726 29f418 18684->18726 18685->18666 18687 29e5bc 18686->18687 18713 29e6a5 18686->18713 18688 29e5cd 18687->18688 18689 296db3 ___std_exception_copy RtlAllocateHeap 18687->18689 18690 29e5df 18688->18690 18692 296db3 ___std_exception_copy RtlAllocateHeap 18688->18692 18689->18688 18691 29e5f1 18690->18691 18693 296db3 ___std_exception_copy RtlAllocateHeap 18690->18693 18694 29e603 18691->18694 18695 296db3 ___std_exception_copy RtlAllocateHeap 18691->18695 18692->18690 18693->18691 18696 29e615 18694->18696 18697 296db3 ___std_exception_copy RtlAllocateHeap 18694->18697 18695->18694 18698 296db3 ___std_exception_copy RtlAllocateHeap 18696->18698 18702 29e627 18696->18702 18697->18696 18698->18702 18699 296db3 ___std_exception_copy RtlAllocateHeap 18701 29e639 18699->18701 18700 29e64b 18704 29e65d 18700->18704 18705 296db3 ___std_exception_copy RtlAllocateHeap 18700->18705 18701->18700 18703 296db3 ___std_exception_copy RtlAllocateHeap 18701->18703 18702->18699 18702->18701 18703->18700 18706 29e66f 18704->18706 18708 296db3 ___std_exception_copy RtlAllocateHeap 18704->18708 18705->18704 18707 29e681 18706->18707 18709 296db3 ___std_exception_copy RtlAllocateHeap 18706->18709 18710 29e693 18707->18710 18711 296db3 ___std_exception_copy RtlAllocateHeap 18707->18711 18708->18706 18709->18707 18712 296db3 ___std_exception_copy RtlAllocateHeap 18710->18712 18710->18713 18711->18710 18712->18713 18713->18680 18715 29ea6f 18714->18715 18716 29ea17 18714->18716 18715->18685 18717 29ea27 18716->18717 18718 296db3 ___std_exception_copy RtlAllocateHeap 18716->18718 18719 29ea39 18717->18719 18721 296db3 ___std_exception_copy RtlAllocateHeap 18717->18721 18718->18717 18720 29ea4b 18719->18720 18722 296db3 ___std_exception_copy RtlAllocateHeap 18719->18722 18723 29ea5d 18720->18723 18724 296db3 ___std_exception_copy RtlAllocateHeap 18720->18724 18721->18719 18722->18720 18723->18715 18725 296db3 ___std_exception_copy RtlAllocateHeap 18723->18725 18724->18723 18725->18715 18727 29f444 18726->18727 18728 29f425 18726->18728 18727->18679 18728->18727 18729 29ef31 __Getctype RtlAllocateHeap 18728->18729 18730 29f43e 18729->18730 18731 296db3 ___std_exception_copy RtlAllocateHeap 18730->18731 18731->18727 18733 2846fe __fread_nolock 18732->18733 18738 284723 18733->18738 18735 284716 18745 2844dc 18735->18745 18739 284733 18738->18739 18742 28473a __fread_nolock __Getctype 18738->18742 18751 284541 18739->18751 18741 284748 18741->18735 18742->18741 18743 2846ec __fread_nolock RtlAllocateHeap 18742->18743 18744 2847ac 18743->18744 18744->18735 18746 2844e8 18745->18746 18748 2844ff 18746->18748 18766 284587 18746->18766 18749 284512 18748->18749 18750 284587 __fread_nolock RtlAllocateHeap 18748->18750 18749->18615 18750->18749 18752 284550 18751->18752 18755 295ddd 18752->18755 18756 295df0 __Getctype 18755->18756 18757 2963f3 __Getctype RtlAllocateHeap 18756->18757 18765 284572 18756->18765 18758 295e20 __Getctype 18757->18758 18759 295e5c 18758->18759 18760 295e28 __Getctype 18758->18760 18761 295a09 __Getctype RtlAllocateHeap 18759->18761 18762 296db3 ___std_exception_copy RtlAllocateHeap 18760->18762 18763 295e67 18761->18763 18762->18765 18764 296db3 ___std_exception_copy RtlAllocateHeap 18763->18764 18764->18765 18765->18742 18767 28459a 18766->18767 18768 284591 18766->18768 18767->18748 18769 284541 __fread_nolock RtlAllocateHeap 18768->18769 18770 284596 18769->18770 18770->18767 18773 290259 18770->18773 18774 29025e std::locale::_Setgloballocale 18773->18774 18778 290269 std::locale::_Setgloballocale 18774->18778 18779 29c7c6 18774->18779 18800 28f224 18778->18800 18784 29c7d2 __fread_nolock 18779->18784 18780 29c834 std::_Lockit::_Lockit std::locale::_Setgloballocale 18788 29c9a4 std::_Lockit::~_Lockit 18780->18788 18789 29c8a7 18780->18789 18791 29c8d5 std::locale::_Setgloballocale 18780->18791 18781 295d2c __dosmaperr RtlAllocateHeap 18786 29c803 std::locale::_Setgloballocale 18781->18786 18782 29c822 18783 28d23f __dosmaperr RtlAllocateHeap 18782->18783 18785 29c827 18783->18785 18784->18780 18784->18781 18784->18782 18784->18786 18787 2847a0 __fread_nolock RtlAllocateHeap 18785->18787 18786->18780 18786->18782 18792 29c80c 18786->18792 18787->18792 18790 28f224 std::locale::_Setgloballocale RtlAllocateHeap 18788->18790 18789->18791 18803 295bdb 18789->18803 18793 29c9b7 18790->18793 18791->18792 18796 295bdb __Getctype RtlAllocateHeap 18791->18796 18798 29c92a 18791->18798 18792->18778 18796->18798 18797 295bdb __Getctype RtlAllocateHeap 18797->18791 18798->18792 18799 295bdb __Getctype RtlAllocateHeap 18798->18799 18799->18792 18817 28f094 18800->18817 18802 28f235 18804 295be4 __Getctype 18803->18804 18805 2963f3 __Getctype RtlAllocateHeap 18804->18805 18807 295bfb 18804->18807 18808 295c28 __Getctype 18805->18808 18806 295c8b 18806->18797 18807->18806 18809 290259 __Getctype RtlAllocateHeap 18807->18809 18810 295c68 18808->18810 18812 295c30 __Getctype 18808->18812 18811 295c95 18809->18811 18814 295a09 __Getctype RtlAllocateHeap 18810->18814 18813 296db3 ___std_exception_copy RtlAllocateHeap 18812->18813 18813->18807 18815 295c73 18814->18815 18816 296db3 ___std_exception_copy RtlAllocateHeap 18815->18816 18816->18807 18818 28f0c1 std::locale::_Setgloballocale 18817->18818 18819 28ef23 std::locale::_Setgloballocale RtlAllocateHeap 18818->18819 18820 28f10a std::locale::_Setgloballocale 18819->18820 18820->18802 18824 27d4af 18821->18824 18823 27d6fa Concurrency::cancel_current_task 18827 1a3010 18824->18827 18828 280651 ___std_exception_copy RtlAllocateHeap 18827->18828 18829 1a303d 18828->18829 18829->18823 18841 4d8043e GetCurrentHwProfileW 18842 4d80466 18841->18842 21450 4d803b3 21451 4d803b8 GetCurrentHwProfileW 21450->21451 21455 4d8032e 21450->21455 21456 4d80466 21451->21456 21452 4d803a3 GetCurrentHwProfileW 21452->21455 21454 4d80396 21455->21452 21455->21454

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 176 203a40-203a52 177 203a55-203a61 176->177 179 203a67-203a6d 177->179 180 203b28-203b31 GetPEB 177->180 179->180 182 203a73-203a7f GetPEB 179->182 181 203b34-203b48 180->181 183 203b99-203b9b 181->183 184 203b4a-203b4f 181->184 185 203a80-203a94 182->185 183->181 184->183 186 203b51-203b59 184->186 187 203ae4-203ae6 185->187 188 203a96-203a9b 185->188 189 203b60-203b73 186->189 187->185 188->187 190 203a9d-203aa3 188->190 192 203b92-203b97 189->192 193 203b75-203b88 189->193 191 203aa5-203ab8 190->191 195 203aba 191->195 196 203add-203ae2 191->196 192->183 192->189 193->193 194 203b8a-203b90 193->194 194->192 197 203b9d-203bc2 Sleep 194->197 198 203ac0-203ad3 195->198 196->187 196->191 197->177 198->198 199 203ad5-203adb 198->199 199->196 200 203ae8-203b0d Sleep 199->200 201 203b13-203b1a 200->201 201->180 202 203b1c-203b22 201->202 202->180 203 203bc7-203bd8 call 1a6bd0 202->203 206 203bda-203bdc 203->206 207 203bde 203->207 208 203be0-203bfd call 1a6bd0 206->208 207->208
                                  APIs
                                  • Sleep.KERNELBASE(000003E9,?,00000001,00000000,?,?,?,?,?,?,?,?,00203DB6), ref: 00203B08
                                  • Sleep.KERNELBASE(00000001,?,00000001,00000000,?,?,?,?,?,?,?,?,00203DB6), ref: 00203BBA
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000009.00000002.4129182772.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129261086.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129453751.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130054809.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130367278.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: Sleep
                                  • String ID:
                                  • API String ID: 3472027048-0
                                  • Opcode ID: 1a5272b4ba7d49ffa1925e747fb1e444fc6a87c69a9d2553073cafbea26b176b
                                  • Instruction ID: 8fd2e1a1556ca1373933fc46cbc0bad6408363a15c14d2d8a529bddbc7136485
                                  • Opcode Fuzzy Hash: 1a5272b4ba7d49ffa1925e747fb1e444fc6a87c69a9d2553073cafbea26b176b
                                  • Instruction Fuzzy Hash: AF51BC35A14216CFCB24CF58C4D0EA9B3B9FF45708B29459AD445AF392D731EE15CB80

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 0 1be0a0-1be0d2 WSAStartup 1 1be0d8-1be102 call 1a6bd0 * 2 0->1 2 1be1b7-1be1c0 0->2 7 1be10e-1be165 1->7 8 1be104-1be108 1->8 10 1be1b1 7->10 11 1be167-1be16d 7->11 8->2 8->7 10->2 12 1be16f 11->12 13 1be1c5-1be1cf 11->13 14 1be175-1be189 socket 12->14 13->10 17 1be1d1-1be1d9 13->17 14->10 16 1be18b-1be19b connect 14->16 18 1be19d-1be1a5 closesocket 16->18 19 1be1c1 16->19 18->14 20 1be1a7-1be1ab 18->20 19->13 20->10
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000009.00000002.4129182772.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129261086.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129453751.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130054809.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130367278.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: Startupclosesocketconnectsocket
                                  • String ID:
                                  • API String ID: 3098855095-0
                                  • Opcode ID: 81e4e1ad59f69988ad2564c654c950568246b17d7c7052cc3b4e399ca1faf427
                                  • Instruction ID: f19356d7d9bbc3089a7452c5890340ce7519545eeea1e194fb08d3a6fb9dba0d
                                  • Opcode Fuzzy Hash: 81e4e1ad59f69988ad2564c654c950568246b17d7c7052cc3b4e399ca1faf427
                                  • Instruction Fuzzy Hash: 79319271605310ABD7209F39C848BABB7E4EF85764F104F1DF9A8A62D0D37599148AA2

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 21 284942-28494f 22 284979-28498d call 295f82 21->22 23 284951-284974 call 284723 21->23 29 28498f 22->29 30 284992-28499b call 28e11f 22->30 28 284ae0-284ae2 23->28 29->30 32 2849a0-2849af 30->32 33 2849bf-2849c8 32->33 34 2849b1 32->34 37 2849ca-2849d7 33->37 38 2849dc-284a10 33->38 35 284a89-284a8e 34->35 36 2849b7-2849b9 34->36 39 284ade-284adf 35->39 36->33 36->35 40 284adc 37->40 41 284a6d-284a79 38->41 42 284a12-284a1c 38->42 39->28 40->39 43 284a7b-284a82 41->43 44 284a90-284a93 41->44 45 284a1e-284a2a 42->45 46 284a43-284a4f 42->46 43->35 47 284a96-284a9e 44->47 45->46 48 284a2c-284a3e call 284cae 45->48 46->44 49 284a51-284a6b call 284e59 46->49 50 284ada 47->50 51 284aa0-284aa6 47->51 48->39 49->47 50->40 54 284aa8-284abc call 284ae3 51->54 55 284abe-284ac2 51->55 54->39 59 284ac4-284ad2 call 2a4a10 55->59 60 284ad5-284ad7 55->60 59->60 60->50
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000009.00000002.4129182772.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129261086.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129453751.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130054809.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130367278.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID:
                                  • String ID: O(
                                  • API String ID: 0-2961352692
                                  • Opcode ID: de2682b5db8e2563b81c24c700635fd82509e6c6ca500bcdbd72a5da6d0bf684
                                  • Instruction ID: f4a823e26f3e85ead8dcb2b2093d541122f88a2ac611247369fe9a0f2a563f87
                                  • Opcode Fuzzy Hash: de2682b5db8e2563b81c24c700635fd82509e6c6ca500bcdbd72a5da6d0bf684
                                  • Instruction Fuzzy Hash: E2511738A11109AFCF14FF58C895AAABFB1EF45314F248159F8499F292D371EE61CB90

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 64 294623-294633 65 29464d-29464f 64->65 66 294635-294648 call 28d22c call 28d23f 64->66 68 29498f-29499c call 28d22c call 28d23f 65->68 69 294655-29465b 65->69 83 2949a7 66->83 85 2949a2 call 2847a0 68->85 69->68 71 294661-29468a 69->71 71->68 75 294690-294699 71->75 78 29469b-2946ae call 28d22c call 28d23f 75->78 79 2946b3-2946b5 75->79 78->85 81 29498b-29498d 79->81 82 2946bb-2946bf 79->82 87 2949aa-2949ad 81->87 82->81 86 2946c5-2946c9 82->86 83->87 85->83 86->78 91 2946cb-2946e2 86->91 93 2946e4-2946e7 91->93 94 294717-29471d 91->94 97 2946e9-2946ef 93->97 98 29470d-294715 93->98 95 29471f-294726 94->95 96 2946f1-294708 call 28d22c call 28d23f call 2847a0 94->96 100 294728 95->100 101 29472a-29472b call 296e2d 95->101 129 2948c2 96->129 97->96 97->98 99 29478a-2947a9 98->99 103 2947af-2947bb 99->103 104 294865-29486e call 2a0d44 99->104 100->101 108 294730-294748 call 296db3 * 2 101->108 103->104 107 2947c1-2947c3 103->107 118 2948df 104->118 119 294870-294882 104->119 107->104 111 2947c9-2947ea 107->111 133 29474a-294760 call 28d23f call 28d22c 108->133 134 294765-294788 call 28e13d 108->134 111->104 115 2947ec-294802 111->115 115->104 122 294804-294806 115->122 121 2948e3-2948f9 ReadFile 118->121 119->118 120 294884-294893 119->120 120->118 137 294895-294899 120->137 125 2948fb-294901 121->125 126 294957-294962 121->126 122->104 127 294808-29482b 122->127 125->126 131 294903 125->131 146 29497b-29497e 126->146 147 294964-294976 call 28d23f call 28d22c 126->147 127->104 132 29482d-294843 127->132 135 2948c5-2948cf call 296db3 129->135 139 294906-294918 131->139 132->104 140 294845-294847 132->140 133->129 134->99 135->87 137->121 145 29489b-2948b3 137->145 139->135 148 29491a-29491e 139->148 140->104 149 294849-294860 140->149 165 2948b5-2948ba 145->165 166 2948d4-2948dd 145->166 154 2948bb-2948c1 call 28d1e5 146->154 155 294984-294986 146->155 147->129 152 294920-294930 call 294335 148->152 153 294937-294944 148->153 149->104 173 294933-294935 152->173 161 294950-294955 call 29417b 153->161 162 294946 call 29448c 153->162 154->129 155->135 174 29494b-29494e 161->174 162->174 165->154 166->139 173->135 174->173
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000009.00000002.4129182772.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129261086.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129453751.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130054809.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130367278.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 6160038fdca57b9904698820e89c8124165ead298d79ea393b05522b1ceaa316
                                  • Instruction ID: e93ff6114757ae591a98bfc6cb6f576bf3bb2d54ef33197bdd6b53925ba4f5fa
                                  • Opcode Fuzzy Hash: 6160038fdca57b9904698820e89c8124165ead298d79ea393b05522b1ceaa316
                                  • Instruction Fuzzy Hash: 9EB1F174A20246ABEF15BFA8D844FAEBBB1BF45304F14415AE84097282C7709D62CF60

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 211 4d80181-4d8032b 230 4d80339-4d80394 call 4d803a3 211->230 238 4d8032e-4d80334 230->238 239 4d80396-4d803a1 230->239 238->230
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4135929384.0000000004D80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_4d80000_RageMP131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: 26c743e5359bfdf36859432415dff8ab2d1e00a6d0c01d7989ce8b2912644df9
                                  • Instruction ID: 51480288e8fcb5f89ea0430e62398390a1e4f0870e2b17bd9f147bf6aa3f3022
                                  • Opcode Fuzzy Hash: 26c743e5359bfdf36859432415dff8ab2d1e00a6d0c01d7989ce8b2912644df9
                                  • Instruction Fuzzy Hash: AC819BEB34C110BEB603A1866B54EFB676DE6C6730732846FF887D5506F294AA8D2031

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 240 4d803b3-4d803b6 241 4d803b8-4d80435 240->241 242 4d80351-4d8036e 240->242 253 4d80447-4d80453 GetCurrentHwProfileW 241->253 245 4d8036f-4d80394 call 4d803a3 242->245 257 4d8032e-4d80356 245->257 258 4d80396-4d803a1 245->258 255 4d80466-4d807fe 253->255 257->245
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04D8044C
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4135929384.0000000004D80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_4d80000_RageMP131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: fd8790526849a086cac4f3c353c1242da2c63823e2bc2c9e2330062199dee3a0
                                  • Instruction ID: d50104125261a878c75c5b1ae7932fe4fe03ccdedd21d7be9719595374b65a8c
                                  • Opcode Fuzzy Hash: fd8790526849a086cac4f3c353c1242da2c63823e2bc2c9e2330062199dee3a0
                                  • Instruction Fuzzy Hash: 1C5181EB34C110BDB613A1466F55EFB672DE6C6B30332846FF887D5506F284AA8E2431

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 301 4d803a3-4d80435 307 4d80447-4d80453 GetCurrentHwProfileW 301->307 308 4d80466-4d807fe 307->308
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04D8044C
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4135929384.0000000004D80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_4d80000_RageMP131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: b8f985d9d7c59db7b0bc0d2f7062ca86010378a8946f30cde1120ecab5eb8133
                                  • Instruction ID: 3e94bdf0d9f4928e74da1d088b25f93191935c4abea48f29a0a2e8bd83dd718f
                                  • Opcode Fuzzy Hash: b8f985d9d7c59db7b0bc0d2f7062ca86010378a8946f30cde1120ecab5eb8133
                                  • Instruction Fuzzy Hash: 47513DEB34C114BDB153A1462F55EFB672DE2C6730732846BF887D5546F284AE8E2431

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 349 4d803e4-4d80435 354 4d80447-4d80453 GetCurrentHwProfileW 349->354 355 4d80466-4d807fe 354->355
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04D8044C
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4135929384.0000000004D80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_4d80000_RageMP131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: 39b964908f762c68dadb46d523cae50b1026cd9161b7acb0a23d84d743b71eff
                                  • Instruction ID: c927c08e103aeca41a15baff6f2233c5d5a4e8a0169523d8dd62e093a77ed85d
                                  • Opcode Fuzzy Hash: 39b964908f762c68dadb46d523cae50b1026cd9161b7acb0a23d84d743b71eff
                                  • Instruction Fuzzy Hash: 7A515EEB34C110BD7153A1462F54EFB672EE2D6730332846FF887D5506F288AA8E2431

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 396 4d803fb-4d80435 400 4d80447-4d80453 GetCurrentHwProfileW 396->400 401 4d80466-4d807fe 400->401
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04D8044C
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4135929384.0000000004D80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_4d80000_RageMP131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: c2fef618934c3584cc8bb1ede4d3fd65c1f5c65355d1cbb178a7c754b50ec1e4
                                  • Instruction ID: 3872d657f0c53a1650d5d3b599dc9e3bb856b6cb645e5078c2ae2fe34ca694c3
                                  • Opcode Fuzzy Hash: c2fef618934c3584cc8bb1ede4d3fd65c1f5c65355d1cbb178a7c754b50ec1e4
                                  • Instruction Fuzzy Hash: 82513DEB34C111BDB253A1462F54EFB672EE2D6730732846BF887D5546F384AA8E2431

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 442 4d80418-4d80435 443 4d80447-4d80453 GetCurrentHwProfileW 442->443 444 4d80466-4d807fe 443->444
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04D8044C
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4135929384.0000000004D80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_4d80000_RageMP131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: 07e6110c8d2b73d11b1c707b9fb3f490abfce34d162fde4f68c3a19219f6b945
                                  • Instruction ID: 40684f6a5ac999e502611fffd05714916b44512f871013ee3a1207cd7f9b6af3
                                  • Opcode Fuzzy Hash: 07e6110c8d2b73d11b1c707b9fb3f490abfce34d162fde4f68c3a19219f6b945
                                  • Instruction Fuzzy Hash: DA516DEB34C120BDB243A1562F55EFB672DE6D6730732846FF887D1506F284AA8E2531

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 485 4d8043e-4d80453 GetCurrentHwProfileW 486 4d80466-4d807fe 485->486
                                  APIs
                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04D8044C
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4135929384.0000000004D80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_4d80000_RageMP131.jbxd
                                  Similarity
                                  • API ID: CurrentProfile
                                  • String ID:
                                  • API String ID: 2104809126-0
                                  • Opcode ID: bf2be4495c3fa03136b1f471875278ac6ad3109daeec50da859d98562e45d361
                                  • Instruction ID: dd084c13dd62572cd8509a7f3dc194a5e9f31a96caf2ed857bf98f8fa218e136
                                  • Opcode Fuzzy Hash: bf2be4495c3fa03136b1f471875278ac6ad3109daeec50da859d98562e45d361
                                  • Instruction Fuzzy Hash: 42414CEB34C121BDB253A1462F54EFB672DE6D6730732846BF887D1506F394AA8E2431

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 527 1aa210-1aa2ab call 27f290 call 1a2ae0 532 1aa2b0-1aa2bb 527->532 532->532 533 1aa2bd-1aa2c8 532->533 534 1aa2ca 533->534 535 1aa2cd-1aa2de call 285362 533->535 534->535 538 1aa2e0-1aa305 call 289136 call 284eeb call 289136 535->538 539 1aa351-1aa357 535->539 556 1aa30c-1aa316 538->556 557 1aa307 538->557 541 1aa359-1aa365 539->541 542 1aa381-1aa393 539->542 543 1aa377-1aa37e call 27f511 541->543 544 1aa367-1aa375 541->544 543->542 544->543 546 1aa394-1aa3ae call 2847b0 544->546 554 1aa3b0-1aa3bb 546->554 554->554 558 1aa3bd-1aa3c8 554->558 559 1aa328-1aa32f call 20cf60 556->559 560 1aa318-1aa31c 556->560 557->556 561 1aa3ca 558->561 562 1aa3cd-1aa3df call 285362 558->562 567 1aa334-1aa33a 559->567 563 1aa31e 560->563 564 1aa320-1aa326 560->564 561->562 571 1aa3fc-1aa403 562->571 572 1aa3e1-1aa3f9 call 289136 call 284eeb call 288be8 562->572 563->564 564->567 569 1aa33e-1aa349 call 28dbdf call 288be8 567->569 570 1aa33c 567->570 588 1aa34e 569->588 570->569 573 1aa42d-1aa433 571->573 574 1aa405-1aa411 571->574 572->571 578 1aa423-1aa42a call 27f511 574->578 579 1aa413-1aa421 574->579 578->573 579->578 582 1aa434-1aa45e call 2847b0 579->582 594 1aa46f-1aa474 582->594 595 1aa460-1aa464 582->595 588->539 595->594 596 1aa466-1aa46e 595->596
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000009.00000002.4129182772.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129261086.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129453751.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130054809.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130367278.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: __fread_nolock
                                  • String ID:
                                  • API String ID: 2638373210-0
                                  • Opcode ID: 6933a1ccea3cb2208017e7263a422f6394436289d78137a05792a89832d6d0b4
                                  • Instruction ID: c97a7cfd2831d7d138dee1ded1b36d9e05549537124de91c70d521a1206af472
                                  • Opcode Fuzzy Hash: 6933a1ccea3cb2208017e7263a422f6394436289d78137a05792a89832d6d0b4
                                  • Instruction Fuzzy Hash: 7C717B74901204AFDF14EF68CC49BAEBBE8EF42300F54856DF8089B282D7B5D944CB92

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 597 29549c-2954be 598 2956b1 597->598 599 2954c4-2954c6 597->599 602 2956b3-2956b7 598->602 600 2954c8-2954e7 call 284723 599->600 601 2954f2-295515 599->601 608 2954ea-2954ed 600->608 604 29551b-295521 601->604 605 295517-295519 601->605 604->600 607 295523-295534 604->607 605->604 605->607 609 295547-295557 call 294fe1 607->609 610 295536-295544 call 28e17d 607->610 608->602 615 295559-29555f 609->615 616 2955a0-2955b2 609->616 610->609 619 295588-29559e call 294bb2 615->619 620 295561-295564 615->620 617 295609-295629 WriteFile 616->617 618 2955b4-2955ba 616->618 623 29562b-295631 617->623 624 295634 617->624 626 2955bc-2955bf 618->626 627 2955f5-295607 call 29505e 618->627 639 295581-295583 619->639 621 29556f-29557e call 294f79 620->621 622 295566-295569 620->622 621->639 622->621 628 295649-29564c 622->628 623->624 632 295637-295642 624->632 633 2955e1-2955f3 call 295222 626->633 634 2955c1-2955c4 626->634 645 2955dc-2955df 627->645 643 29564f-295651 628->643 640 2956ac-2956af 632->640 641 295644-295647 632->641 633->645 642 2955ca-2955d7 call 295139 634->642 634->643 639->632 640->602 641->628 642->645 647 29567f-29568b 643->647 648 295653-295658 643->648 645->639 649 29568d-295693 647->649 650 295695-2956a7 647->650 651 29565a-29566c 648->651 652 295671-29567a call 28d208 648->652 649->598 649->650 650->608 651->608 652->608
                                  APIs
                                  • WriteFile.KERNELBASE(?,00000000,00289087,?,00000000,00000000,00000000,?,00000000,?,001AA3EB,00289087,00000000,001AA3EB,?,?), ref: 00295621
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000009.00000002.4129182772.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129261086.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129453751.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130054809.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130367278.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: FileWrite
                                  • String ID:
                                  • API String ID: 3934441357-0
                                  • Opcode ID: b1a5ed08a6b84192d3bf8bf03d8bc68a154fbb182acdbe0e9551eb21a8018e69
                                  • Instruction ID: bc6e0ea886450dc1ade7e0ef5e3ce2b50038854450efa8ac75a0af6180b74507
                                  • Opcode Fuzzy Hash: b1a5ed08a6b84192d3bf8bf03d8bc68a154fbb182acdbe0e9551eb21a8018e69
                                  • Instruction Fuzzy Hash: 7961D971E2452AAFDF12DFA8C844EEEBFB9AF05304F550149E904A7256D371DD21CBA0

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 655 2106c0-2106df 656 210802 call 1a2270 655->656 657 2106e5-2106f8 655->657 662 210807 call 1a21d0 656->662 658 210720-210728 657->658 659 2106fa 657->659 663 210731-210735 658->663 664 21072a-21072f 658->664 661 2106fc-210701 659->661 665 210704-21070f call 27f290 661->665 670 21080c-210840 call 2847b0 call 285379 662->670 667 210737 663->667 668 210739-210741 663->668 664->661 665->670 680 210715-21071e 665->680 667->668 671 210750-210752 668->671 672 210743-210748 668->672 673 210761 671->673 674 210754-210755 call 27f290 671->674 672->662 677 21074e 672->677 679 210763-210782 673->679 682 21075a-21075f 674->682 677->665 683 210784-2107ae call 280f70 * 2 679->683 684 2107d9-2107ff call 280f70 * 2 679->684 680->679 682->679 695 2107b0-2107be 683->695 696 2107c2-2107d6 call 27f511 683->696 695->670 697 2107c0 695->697 697->696
                                  APIs
                                  • Concurrency::cancel_current_task.LIBCPMT ref: 00210807
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000009.00000002.4129182772.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129261086.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129453751.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130054809.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130367278.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: Concurrency::cancel_current_task
                                  • String ID:
                                  • API String ID: 118556049-0
                                  • Opcode ID: 72ae2a14724d4e83691c0531f3cf1eefdbecef984361d26ffcaed67d00a3d962
                                  • Instruction ID: 10bd9799b05915a0ac675ff8a5ed57cfb7532a6f72d6144a8d78c9cd0bb5e08e
                                  • Opcode Fuzzy Hash: 72ae2a14724d4e83691c0531f3cf1eefdbecef984361d26ffcaed67d00a3d962
                                  • Instruction Fuzzy Hash: 4D4157769101189BCB04EF68DDC069EB7E5EF54350F1042A9FC05D7285DBB0ADB18BD1

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 700 210560-21057f 701 210585-210598 700->701 702 2106a9 call 1a2270 700->702 704 2105c0-2105c8 701->704 705 21059a 701->705 706 2106ae call 1a21d0 702->706 707 2105d1-2105d5 704->707 708 2105ca-2105cf 704->708 709 21059c-2105a1 705->709 715 2106b3-2106b8 call 2847b0 706->715 712 2105d7 707->712 713 2105d9-2105e1 707->713 708->709 710 2105a4-2105a5 call 27f290 709->710 718 2105aa-2105af 710->718 712->713 716 2105f0-2105f2 713->716 717 2105e3-2105e8 713->717 721 210601 716->721 722 2105f4-2105ff call 27f290 716->722 717->706 720 2105ee 717->720 718->715 724 2105b5-2105be 718->724 720->710 723 210603-210629 721->723 722->723 727 210680-2106a6 call 280f70 call 2814f0 723->727 728 21062b-210655 call 280f70 call 2814f0 723->728 724->723 738 210657-210665 728->738 739 210669-21067d call 27f511 728->739 738->715 740 210667 738->740 740->739
                                  APIs
                                  • Concurrency::cancel_current_task.LIBCPMT ref: 002106AE
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000009.00000002.4129182772.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129261086.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129453751.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130054809.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130367278.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: Concurrency::cancel_current_task
                                  • String ID:
                                  • API String ID: 118556049-0
                                  • Opcode ID: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
                                  • Instruction ID: 83076e327057845a717a4ba5b3c097f4bb480b2b394468aa26eb6652e16f7ace
                                  • Opcode Fuzzy Hash: 318ca63d53af118050337d2617cc9b2857a3311d5737a2fcb3013cc935154a5b
                                  • Instruction Fuzzy Hash: F741E572A101149BCB15EF68D98069E7BE9AF95310F144169FC05EB346D7B0DDB08BE1
                                  APIs
                                  • FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,002949F9,00000000,CF830579,002D1140,0000000C,00294AB5,00288BBD,?), ref: 00294B68
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000009.00000002.4129182772.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129261086.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129453751.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130054809.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130367278.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ChangeCloseFindNotification
                                  • String ID:
                                  • API String ID: 2591292051-0
                                  • Opcode ID: db5523cd8147b2c636344ee494e916018787653a50ef6acbd66c43ecb7cc3f16
                                  • Instruction ID: 268c009c9285076848e8cb2f79dc5e2a22d67f79d0d745b3f8f0fa584bed552e
                                  • Opcode Fuzzy Hash: db5523cd8147b2c636344ee494e916018787653a50ef6acbd66c43ecb7cc3f16
                                  • Instruction Fuzzy Hash: 39114C33E7521416DE143A756C25F7D578D8F927BCF2A024AF918870C2EE60DC625195
                                  APIs
                                  • SetFilePointerEx.KERNELBASE(00000000,00000000,002D0DF8,001AA3EB,00000002,001AA3EB,00000000,?,?,?,0028E166,00000000,?,001AA3EB,00000002,002D0DF8), ref: 0028E098
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000009.00000002.4129182772.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129261086.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129453751.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130054809.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130367278.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: FilePointer
                                  • String ID:
                                  • API String ID: 973152223-0
                                  • Opcode ID: db549fbffc427a0b09a5a4492872e4821874e02315510deb13146a9092323c9b
                                  • Instruction ID: 9c9efdf1d76443ab59abd77633ac3810dbb672a5ec474fd9c2e4a60283b8e3ed
                                  • Opcode Fuzzy Hash: db549fbffc427a0b09a5a4492872e4821874e02315510deb13146a9092323c9b
                                  • Instruction Fuzzy Hash: 0A014936621115AFDF05AF19CC05C9E3B6ADF81334F250249FC50AB2D1E6B2ED618BD0
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 001A220E
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000009.00000002.4129182772.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129261086.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129453751.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130054809.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130367278.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID:
                                  • API String ID: 2659868963-0
                                  • Opcode ID: 0066a1e10b838dc2517601967adab8722ae9df092e045c2984987d96b19a8257
                                  • Instruction ID: 7ec0627b89d2b1a4731f947e5883af93e13595e5f035cd1909d73d709955e1f9
                                  • Opcode Fuzzy Hash: 0066a1e10b838dc2517601967adab8722ae9df092e045c2984987d96b19a8257
                                  • Instruction Fuzzy Hash: D7012B3951430DABCB14FFA8E80299977AC9E01320B408436FE1CDB991EB70E9748BD0
                                  APIs
                                  • RtlAllocateHeap.NTDLL(00000008,002891F7,00000000,?,00295D79,00000001,00000364,00000000,00000006,000000FF,?,00000000,0028D244,002889C3,002891F7,00000000), ref: 00296435
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000009.00000002.4129182772.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129261086.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129453751.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130054809.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130367278.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: AllocateHeap
                                  • String ID:
                                  • API String ID: 1279760036-0
                                  • Opcode ID: 545ce9f5ac8b66467ddf3152798a5470cb66b59cb1f795be01dd233cdeb0931f
                                  • Instruction ID: 185e181de97f036ee12829bc50a2a7cdbda2f42e8ee39505ac21cd2e9662c056
                                  • Opcode Fuzzy Hash: 545ce9f5ac8b66467ddf3152798a5470cb66b59cb1f795be01dd233cdeb0931f
                                  • Instruction Fuzzy Hash: 49F0893157512666DF317FE29C0EB6B7BC99F417A4F15A011AC08A65C0DB70DC3146F1
                                  APIs
                                  • RtlAllocateHeap.NTDLL(00000000,0029D635,4D88C033,?,0029D635,00000220,?,002957EF,4D88C033), ref: 00296E60
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000009.00000002.4129182772.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129261086.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129453751.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130054809.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130367278.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: AllocateHeap
                                  • String ID:
                                  • API String ID: 1279760036-0
                                  • Opcode ID: d473450625e253d461a9ff0d660f66d49befc86e2be1e3f0a3b029f57d15cfda
                                  • Instruction ID: 20287079a56181d003b602466e32515aed4510e3a1d67ff987e41364490cbf36
                                  • Opcode Fuzzy Hash: d473450625e253d461a9ff0d660f66d49befc86e2be1e3f0a3b029f57d15cfda
                                  • Instruction Fuzzy Hash: 89E0ED3D131A2766DE303EA6DD08F6B77C88F823A1F050121AC84924D2DB60CC3085A4
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000009.00000002.4129182772.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129261086.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129453751.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130054809.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130367278.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
                                  • Instruction ID: 5fb4f5a3a4908dbe5290cbef44e4eafe06387f307f4eedee9eec334ca4fec437
                                  • Opcode Fuzzy Hash: 4df2230cf6d2b22dd9929c0dcf2eb738a93c5ed6b64abc4e5fced81a8044e2fc
                                  • Instruction Fuzzy Hash: 04025C75E1121A9BDF14DFA8C9806AEFBF5FF48314F648269D519E7380DB31A911CB80
                                  APIs
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 0020F833
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 0020F855
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 0020F875
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 0020F89F
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 0020F90D
                                  • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0020F959
                                  • std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0020F973
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 0020FA08
                                  • std::_Facet_Register.LIBCPMT ref: 0020FA15
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000009.00000002.4129182772.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129261086.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129453751.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130054809.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130367278.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
                                  • String ID: bad locale name$",
                                  • API String ID: 3375549084-3755561545
                                  • Opcode ID: cecd18cddc7d977882cbd031f8cb2cc2a14f86a64e21ee874b6869aaad957f8b
                                  • Instruction ID: d04c1b24472785ddd9c1385b38f81989888a257ca44e054184537d95b69c61c6
                                  • Opcode Fuzzy Hash: cecd18cddc7d977882cbd031f8cb2cc2a14f86a64e21ee874b6869aaad957f8b
                                  • Instruction Fuzzy Hash: 6561C071D203499FDF60DFA4D945B9EBBB4AF14310F188069E809A7782E774ED14CBA1
                                  APIs
                                  • _ValidateLocalCookies.LIBCMT ref: 00282E47
                                  • ___except_validate_context_record.LIBVCRUNTIME ref: 00282E4F
                                  • _ValidateLocalCookies.LIBCMT ref: 00282ED8
                                  • __IsNonwritableInCurrentImage.LIBCMT ref: 00282F03
                                  • _ValidateLocalCookies.LIBCMT ref: 00282F58
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000009.00000002.4129182772.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129261086.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129453751.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130054809.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130367278.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                  • String ID: i-$csm
                                  • API String ID: 1170836740-2298156223
                                  • Opcode ID: 0dc54f098738b74930305181f827d2f0d72f7a3bb389a8c0e83d59535f8f7d77
                                  • Instruction ID: 84fa196245cf84de9666bbdb9f5b61385e6ff3b69b748a8a1c407435376074a2
                                  • Opcode Fuzzy Hash: 0dc54f098738b74930305181f827d2f0d72f7a3bb389a8c0e83d59535f8f7d77
                                  • Instruction Fuzzy Hash: 3841E738A21209EBCF10EF58C884A9EBBB5EF45314F148055E9149B7D2D731EE69CF91
                                  APIs
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 001A3A58
                                  • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 001A3AA4
                                  • __Getctype.LIBCPMT ref: 001A3ABA
                                  • std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 001A3AE6
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 001A3B7B
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000009.00000002.4129182772.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129261086.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129453751.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130054809.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130367278.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
                                  • String ID: bad locale name
                                  • API String ID: 1840309910-1405518554
                                  • Opcode ID: 7153a208c8cd81cf15f60fa35d5dea86d6e515c8d394b11491c60756dc85158e
                                  • Instruction ID: b33b5804003c8c0a7e14425f4787b52261e7e08ec48ee0eaaed0840de7c69070
                                  • Opcode Fuzzy Hash: 7153a208c8cd81cf15f60fa35d5dea86d6e515c8d394b11491c60756dc85158e
                                  • Instruction Fuzzy Hash: 575161B5D112489FEF10DFA4D845B9EBBB8AF15310F148069F819EB381E774EA18CB61
                                  APIs
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 0020DE93
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 0020DEB6
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 0020DED6
                                  • std::_Facet_Register.LIBCPMT ref: 0020DF4B
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 0020DF63
                                  • Concurrency::cancel_current_task.LIBCPMT ref: 0020DF7B
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000009.00000002.4129182772.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129261086.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129453751.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130054809.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130367278.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
                                  • String ID:
                                  • API String ID: 2081738530-0
                                  • Opcode ID: 28010c4433b1799a2708157f0aa6e8af048628cbf18a2258e16ef1aa60b026db
                                  • Instruction ID: abc922409c2b9162dff1b04a7c0e6bb79938d816a0dc2226ce8fd56c20db88a0
                                  • Opcode Fuzzy Hash: 28010c4433b1799a2708157f0aa6e8af048628cbf18a2258e16ef1aa60b026db
                                  • Instruction Fuzzy Hash: 5B41F271D212169FCB14DF94D849B6EBBB4FB15710F148269E815AB392DB30AD20CBD1
                                  APIs
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 001A4F72
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 001A4FFF
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 001A50C8
                                  Strings
                                  • recursive_directory_iterator::operator++, xrefs: 001A504C
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000009.00000002.4129182772.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129261086.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129453751.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130054809.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130367278.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_destroy$___std_exception_copy
                                  • String ID: recursive_directory_iterator::operator++
                                  • API String ID: 1206660477-953255998
                                  • Opcode ID: ef4976efbcc0c0ab99e25f55510a3355889f9b2cf5487f1be8d31684b5b27b02
                                  • Instruction ID: d560f6a0a2c713b3bc322d100e5bff48b78f38337fc5f5326152e361011fbdeb
                                  • Opcode Fuzzy Hash: ef4976efbcc0c0ab99e25f55510a3355889f9b2cf5487f1be8d31684b5b27b02
                                  • Instruction Fuzzy Hash: 29E105759102049FCB28DF68D845BAEF7F9FF45300F108A2DE45693B82E7B4A954CBA1
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 001A799A
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 001A7B75
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000009.00000002.4129182772.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129261086.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129453751.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130054809.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130367278.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: out_of_range$type_error
                                  • API String ID: 2659868963-3702451861
                                  • Opcode ID: 5716541bf7f5768026a5e876e3a836ec32d912b639eae1924417e410436ff793
                                  • Instruction ID: acf8353ace8d719e32bc2758f357b777ee5565d60fa2c352e7417adfd0466c76
                                  • Opcode Fuzzy Hash: 5716541bf7f5768026a5e876e3a836ec32d912b639eae1924417e410436ff793
                                  • Instruction Fuzzy Hash: E4C169B59002089FDB58CFA8D984B9EFBF1FF49310F14866AE419E7781E7749984CB50
                                  APIs
                                  • std::_Xinvalid_argument.LIBCPMT ref: 001A2275
                                    • Part of subcall function 0027D6E9: std::invalid_argument::invalid_argument.LIBCONCRT ref: 0027D6F5
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000009.00000002.4129182772.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129261086.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129453751.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130054809.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130367278.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: Xinvalid_argumentstd::_std::invalid_argument::invalid_argument
                                  • String ID: string too long$L-$L-
                                  • API String ID: 1997705970-77905906
                                  • Opcode ID: 3f9d0107efebf2c8a2d638cf5fbd2a6d9e44408e8ffb90de447d386557371334
                                  • Instruction ID: d5106d7899414a2951c7f8a7d676449398fc533cd44c2b86b104e1744eaf9e6a
                                  • Opcode Fuzzy Hash: 3f9d0107efebf2c8a2d638cf5fbd2a6d9e44408e8ffb90de447d386557371334
                                  • Instruction Fuzzy Hash: BC81E179A052859FDB16CF6CC4507EEBFB1BF6B300F18416AC894A7782C3758945CBA1
                                  APIs
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 001A75BE
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 001A75CD
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000009.00000002.4129182772.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129261086.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129453751.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130054809.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130367278.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_destroy
                                  • String ID: at line $, column
                                  • API String ID: 4194217158-191570568
                                  • Opcode ID: 5b6f82af69b4ade8b3770209dd007584e2a5ff049cce845e6450eee9e0e2a926
                                  • Instruction ID: 393c97ca0ca969a67e8906d07de29f0a6c8cbd87fda570dfb866191df20fc186
                                  • Opcode Fuzzy Hash: 5b6f82af69b4ade8b3770209dd007584e2a5ff049cce845e6450eee9e0e2a926
                                  • Instruction Fuzzy Hash: 58611575A142049FDB08DF68DC94BADBBB6FF4A300F24862CE415A77C2D774AA54CB90
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 001A3E7F
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000009.00000002.4129182772.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129261086.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129453751.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130054809.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130367278.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                  • API String ID: 2659868963-1866435925
                                  • Opcode ID: 1ae429c783331f9702656d6ee4c88d096cdbb38a98c73b2c3991691858bd806f
                                  • Instruction ID: 46fd0018d7484f8135ae9d7b1fb94a06feebda05d87e9bb7e8ab6faf24f2ac1b
                                  • Opcode Fuzzy Hash: 1ae429c783331f9702656d6ee4c88d096cdbb38a98c73b2c3991691858bd806f
                                  • Instruction Fuzzy Hash: 8241D5B6910204AFCB04DF98C845BAEF7F8EF4A310F14852AF925D7741E774AA148BA0
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 001A3E7F
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000009.00000002.4129182772.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129261086.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129453751.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130054809.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130367278.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                  • API String ID: 2659868963-1866435925
                                  • Opcode ID: e13fc2a0d315f8db1c656ddf6c0421f390534240a35697569b21f6b5483df2ab
                                  • Instruction ID: e107e710da847a439edb641cb9f1e0042d6ebd2fb9dcdb5afeece9078fba2ccb
                                  • Opcode Fuzzy Hash: e13fc2a0d315f8db1c656ddf6c0421f390534240a35697569b21f6b5483df2ab
                                  • Instruction Fuzzy Hash: 90212BB6910304AFC714DF98D801F96F7DCAB06310F08886AFA78C7641E774EA24CB90
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 001A7340
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000009.00000002.4129182772.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129261086.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129453751.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130054809.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130367278.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: parse error$parse_error
                                  • API String ID: 2659868963-1820534363
                                  • Opcode ID: 434132c2db87bbbb940706ce3a25ad810c6ccb68916a08e538ca1fde04d734bd
                                  • Instruction ID: 92c8c26d2d2200a94325f05c741cded6e65d05bcd43fd7a2e24b40372ece7a61
                                  • Opcode Fuzzy Hash: 434132c2db87bbbb940706ce3a25ad810c6ccb68916a08e538ca1fde04d734bd
                                  • Instruction Fuzzy Hash: BEE17C749042488FDB18CF68CD94BADBBB1FF49300F248269E418EB792D7749A85CF90
                                  APIs
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 001A6F11
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 001A6F20
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000009.00000002.4129182772.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129261086.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129453751.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130054809.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130367278.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ___std_exception_destroy
                                  • String ID: [json.exception.
                                  • API String ID: 4194217158-791563284
                                  • Opcode ID: 7b16c5c16b842a3c4a4cc06fe1c1784e050ba9f00a49a61a7c512b78953ac08f
                                  • Instruction ID: d2c0a6da5da8981e7dd2b487033fc4868bb653cff16d5d10b090bea5d415a861
                                  • Opcode Fuzzy Hash: 7b16c5c16b842a3c4a4cc06fe1c1784e050ba9f00a49a61a7c512b78953ac08f
                                  • Instruction Fuzzy Hash: B391E474A002049FDB18CF68C994BAEFBF6FF46300F24866CE419AB791D771A985CB50
                                  APIs
                                  • std::_Xinvalid_argument.LIBCPMT ref: 0021B612
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000009.00000002.4129182772.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129261086.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129453751.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130054809.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130367278.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: Xinvalid_argumentstd::_
                                  • String ID: Px!$invalid hash bucket count
                                  • API String ID: 909987262-1766863255
                                  • Opcode ID: bebad3da1a5ae37abf669b7b5f8ce494fdb8838e7aa2be20a3331b2f1a8cefbb
                                  • Instruction ID: 96a57ff71c40646cba73a34b1504f72fbc244bbfd1fc4b10332717b31c32295b
                                  • Opcode Fuzzy Hash: bebad3da1a5ae37abf669b7b5f8ce494fdb8838e7aa2be20a3331b2f1a8cefbb
                                  • Instruction Fuzzy Hash: 227133B4A10605EFCB15CF48C1808AAFBFAFF98300764C5AAD8199B315D731EA91CF90
                                  APIs
                                  • Concurrency::cancel_current_task.LIBCPMT ref: 0021E491
                                  Strings
                                  • type must be string, but is , xrefs: 0021E4F8
                                  • type must be boolean, but is , xrefs: 0021E582
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.4129261086.00000000001A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 001A0000, based on PE: true
                                  • Associated: 00000009.00000002.4129182772.00000000001A0000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129261086.00000000002D3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129453751.00000000002D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.00000000002DC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000458000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000546000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.000000000057D000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000586000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4129486258.0000000000594000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130054809.0000000000595000.00000080.00000001.01000000.00000006.sdmpDownload File
                                  • Associated: 00000009.00000002.4130367278.000000000073C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1a0000_RageMP131.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: Concurrency::cancel_current_task
                                  • String ID: type must be boolean, but is $type must be string, but is
                                  • API String ID: 118556049-436076039
                                  • Opcode ID: dd57cf8771039f6da5c4db4436e9afccc9ecb3256ec21fcfda4d51c5a516ce6d
                                  • Instruction ID: 807f83b116ce08602a82da5c397a1371a26fbed58aa9945632879e5ef5bf4cde
                                  • Opcode Fuzzy Hash: dd57cf8771039f6da5c4db4436e9afccc9ecb3256ec21fcfda4d51c5a516ce6d
                                  • Instruction Fuzzy Hash: 98415DB5910248AFCF14EFA4DC02B9E77A8DB24310F144679F815D7AC2EB35E964C791