Edit tour

Windows Analysis Report
AlCsIOd0pd.exe

Overview

General Information

Sample name:	AlCsIOd0pd.exe renamed because original name is a hash value
Original sample name:	de584dd4970a8099454611ee0c739ea8.exe
Analysis ID:	1460268
MD5:	de584dd4970a8099454611ee0c739ea8
SHA1:	f22fe3bfb22b55d1f0dc2fd802a32d2beb157e0b
SHA256:	d0eff53cfd30f061451987b4e98205d81f9495e8f26def46aec15f7a4c171c20
Tags:	exeRiseProStealer
Infos:

Detection

RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RisePro Stealer

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Contains functionality to inject threads in other processes

Found stalling execution ending in API Sleep call

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to evade debugger and weak emulator (self modifying code)

Uses schtasks.exe or at.exe to add and modify task schedules

Contains capabilities to detect virtual machines

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found evasive API chain (date check)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

AlCsIOd0pd.exe (PID: 4852 cmdline: "C:\Users\user\Desktop\AlCsIOd0pd.exe" MD5: DE584DD4970A8099454611EE0C739EA8)

schtasks.exe (PID: 1900 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 4304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 2004 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MPGPH131.exe (PID: 5644 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: DE584DD4970A8099454611EE0C739EA8)

MPGPH131.exe (PID: 5740 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: DE584DD4970A8099454611EE0C739EA8)

RageMP131.exe (PID: 3720 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: DE584DD4970A8099454611EE0C739EA8)

RageMP131.exe (PID: 4460 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: DE584DD4970A8099454611EE0C739EA8)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: AlCsIOd0pd.exe PID: 4852	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 5644	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 5740	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 3720	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 4460	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\AlCsIOd0pd.exe, ProcessId: 4852, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131

Snort Signatures

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 77.91.77.66

Timestamp:	06/20/24-18:18:46.029864
SID:	2046269
Source Port:	49741
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN RisePro TCP Heartbeat Packet - Source IP: 192.168.2.4 - Destination IP: 77.91.77.66

Timestamp:	06/20/24-18:16:18.111786
SID:	2049060
Source Port:	49731
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 77.91.77.66

Timestamp:	06/20/24-18:18:43.639253
SID:	2046269
Source Port:	49732
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 77.91.77.66

Timestamp:	06/20/24-18:18:46.029916
SID:	2046269
Source Port:	49735
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 77.91.77.66

Timestamp:	06/20/24-18:18:45.967425
SID:	2046269
Source Port:	49731
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-18:16:22.687972
SID:	2046266
Source Port:	58709
Destination Port:	49732
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-18:16:40.743118
SID:	2046266
Source Port:	58709
Destination Port:	49741
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-18:16:18.693887
SID:	2046266
Source Port:	58709
Destination Port:	49731
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-18:16:22.714525
SID:	2046266
Source Port:	58709
Destination Port:	49733
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 77.91.77.66

Timestamp:	06/20/24-18:18:43.701803
SID:	2046269
Source Port:	49733
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-18:16:34.458767
SID:	2046266
Source Port:	58709
Destination Port:	49735
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	ReversingLabs: Detection: 63%

Multi AV Scanner detection for submitted file

Source: AlCsIOd0pd.exe

ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: AlCsIOd0pd.exe

Joe Sandbox ML: detected

Source: AlCsIOd0pd.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Code function: 0_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	0_2_00431F9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	5_2_00431F9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	6_2_00431F9C

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2049060 ET TROJAN RisePro TCP Heartbeat Packet 192.168.2.4:49731 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.4:49731
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49731 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.4:49732
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.4:49733
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49732 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49733 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.4:49735
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49735 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.4:49741
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49741 -> 77.91.77.66:58709

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 77.91.77.66 ports 0,5,7,8,58709,9

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 77.91.77.66:58709

Source: Joe Sandbox View

IP Address: 77.91.77.66 77.91.77.66

Source: Joe Sandbox View

ASN Name: FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU

Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66

Source: C:\Users\user\Desktop\AlCsIOd0pd.exe

Code function: 0_2_00409280 recv,GetProcAddress,GetModuleHandleA,GetProcAddress,WSASend,

0_2_00409280

Source: AlCsIOd0pd.exe, 00000000.00000003.1748570602.0000000000CD0000.00000004.00001000.00020000.00000000.sdmp, AlCsIOd0pd.exe, 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000003.1783897542.0000000002850000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.1784572733.0000000002850000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3251444322.000000000055D000.00000002.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000003.1896625468.0000000002850000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.1976471958.0000000002840000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3251481803.000000000055D000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: MPGPH131.exe	String found in binary or memory: https://ipinfo.io/
Source: AlCsIOd0pd.exe, 00000000.00000003.1748570602.0000000000CD0000.00000004.00001000.00020000.00000000.sdmp, AlCsIOd0pd.exe, 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000003.1783897542.0000000002850000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.1784572733.0000000002850000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3251444322.000000000055D000.00000002.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000003.1896625468.0000000002850000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.1976471958.0000000002840000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3251481803.000000000055D000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: AlCsIOd0pd.exe, 00000000.00000002.3253969387.0000000000D1E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.3255069543.0000000000CED000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3253912060.0000000000C37000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3253787477.0000000000D3E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3253822490.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: AlCsIOd0pd.exe, 00000000.00000002.3253969387.0000000000D1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTB
Source: RageMP131.exe, 00000007.00000002.3253787477.0000000000D3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTX
Source: MPGPH131.exe, 00000006.00000002.3253912060.0000000000C37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORToE
Source: MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

System Summary

PE file contains section with special chars

Source: AlCsIOd0pd.exe	Static PE information: section name:
Source: AlCsIOd0pd.exe	Static PE information: section name:
Source: AlCsIOd0pd.exe	Static PE information: section name:
Source: AlCsIOd0pd.exe	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Code function: 0_2_0043C960	0_2_0043C960
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Code function: 0_2_0043A928	0_2_0043A928
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Code function: 0_2_004371A0	0_2_004371A0
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Code function: 0_2_0044DA86	0_2_0044DA86
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Code function: 0_2_0044036F	0_2_0044036F
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Code function: 0_2_00458BB0	0_2_00458BB0
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Code function: 0_2_004EFC40	0_2_004EFC40
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Code function: 0_2_0042F580	0_2_0042F580
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Code function: 0_2_00452610	0_2_00452610
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Code function: 0_2_004F2FD0	0_2_004F2FD0
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Code function: 0_2_004547BF	0_2_004547BF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0043C960	5_2_0043C960
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0043A928	5_2_0043A928
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004371A0	5_2_004371A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0044DA86	5_2_0044DA86
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0044036F	5_2_0044036F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00458BB0	5_2_00458BB0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004EFC40	5_2_004EFC40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0042F580	5_2_0042F580
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00452610	5_2_00452610
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004F2FD0	5_2_004F2FD0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004547BF	5_2_004547BF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0043C960	6_2_0043C960
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0043A928	6_2_0043A928
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004371A0	6_2_004371A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0044DA86	6_2_0044DA86
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0044036F	6_2_0044036F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00458BB0	6_2_00458BB0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004EFC40	6_2_004EFC40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0042F580	6_2_0042F580
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00452610	6_2_00452610
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004F2FD0	6_2_004F2FD0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004547BF	6_2_004547BF

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Code function: String function: 00434380 appears 48 times

Source: AlCsIOd0pd.exe	Binary or memory string: OriginalFilename vs AlCsIOd0pd.exe
Source: AlCsIOd0pd.exe, 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedotnet.exe6 vs AlCsIOd0pd.exe
Source: AlCsIOd0pd.exe, 00000000.00000000.1745421628.000000000058A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedotnet.exe6 vs AlCsIOd0pd.exe
Source: AlCsIOd0pd.exe	Binary or memory string: OriginalFilenamedotnet.exe6 vs AlCsIOd0pd.exe

Source: AlCsIOd0pd.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: AlCsIOd0pd.exe	Static PE information: Section: ZLIB complexity 0.9988486351431981
Source: AlCsIOd0pd.exe	Static PE information: Section: ZLIB complexity 0.9942874765037594
Source: AlCsIOd0pd.exe	Static PE information: Section: ZLIB complexity 0.98974609375
Source: AlCsIOd0pd.exe	Static PE information: Section: .reloc ZLIB complexity 1.5
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9988486351431981
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9942874765037594
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.98974609375
Source: RageMP131.exe.0.dr	Static PE information: Section: .reloc ZLIB complexity 1.5
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9988486351431981
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9942874765037594
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.98974609375
Source: MPGPH131.exe.0.dr	Static PE information: Section: .reloc ZLIB complexity 1.5

Source: classification engine

Classification label: mal100.troj.evad.winEXE@11/5@0/1

Source: C:\Users\user\Desktop\AlCsIOd0pd.exe

File created: C:\Users\user\AppData\Local\RageMP131

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4304:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6128:120:WilError_03

Source: C:\Users\user\Desktop\AlCsIOd0pd.exe

File created: C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Jump to behavior

Source: C:\Users\user\Desktop\AlCsIOd0pd.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: AlCsIOd0pd.exe, 00000000.00000003.1748570602.0000000000CD0000.00000004.00001000.00020000.00000000.sdmp, AlCsIOd0pd.exe, 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000003.1783897542.0000000002850000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.1784572733.0000000002850000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3251444322.000000000055D000.00000002.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000003.1896625468.0000000002850000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.1976471958.0000000002840000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3251481803.000000000055D000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: AlCsIOd0pd.exe, 00000000.00000003.1748570602.0000000000CD0000.00000004.00001000.00020000.00000000.sdmp, AlCsIOd0pd.exe, 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000003.1783897542.0000000002850000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.1784572733.0000000002850000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3251444322.000000000055D000.00000002.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000003.1896625468.0000000002850000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.1976471958.0000000002840000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3251481803.000000000055D000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

Source: AlCsIOd0pd.exe

ReversingLabs: Detection: 63%

Source: AlCsIOd0pd.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: C:\Users\user\Desktop\AlCsIOd0pd.exe

File read: C:\Users\user\Desktop\AlCsIOd0pd.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\AlCsIOd0pd.exe "C:\Users\user\Desktop\AlCsIOd0pd.exe"
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior

Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll	Jump to behavior

Source: AlCsIOd0pd.exe

Static file information: File size 3259920 > 1048576

Source: AlCsIOd0pd.exe

Static PE information: Raw size of .boot is bigger than: 0x100000 < 0x264600

Source: C:\Users\user\Desktop\AlCsIOd0pd.exe

Code function: 0_2_004CF280 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,

0_2_004CF280

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: AlCsIOd0pd.exe	Static PE information: section name:
Source: AlCsIOd0pd.exe	Static PE information: section name:
Source: AlCsIOd0pd.exe	Static PE information: section name:
Source: AlCsIOd0pd.exe	Static PE information: section name:
Source: AlCsIOd0pd.exe	Static PE information: section name: .themida
Source: AlCsIOd0pd.exe	Static PE information: section name: .boot
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name: .themida
Source: RageMP131.exe.0.dr	Static PE information: section name: .boot
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name: .themida
Source: MPGPH131.exe.0.dr	Static PE information: section name: .boot

Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Code function: 0_2_00598B86 push 677583F0h; mov dword ptr [esp], ecx	0_2_00873ADB
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Code function: 0_2_00598B86 push edx; mov dword ptr [esp], 7E9A49CCh	0_2_00873B0A
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Code function: 0_2_00598B86 push 0EDD01E1h; mov dword ptr [esp], ecx	0_2_00873B1D
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Code function: 0_2_00433F59 push ecx; ret	0_2_00433F6C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00598B86 push 677583F0h; mov dword ptr [esp], ecx	5_2_00873ADB
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00598B86 push edx; mov dword ptr [esp], 7E9A49CCh	5_2_00873B0A
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00598B86 push 0EDD01E1h; mov dword ptr [esp], ecx	5_2_00873B1D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00433F59 push ecx; ret	5_2_00433F6C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00598B86 push 677583F0h; mov dword ptr [esp], ecx	6_2_00873ADB
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00598B86 push edx; mov dword ptr [esp], 7E9A49CCh	6_2_00873B0A
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00598B86 push 0EDD01E1h; mov dword ptr [esp], ecx	6_2_00873B1D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00433F59 push ecx; ret	6_2_00433F6C

Source: AlCsIOd0pd.exe	Static PE information: section name: entropy: 7.980197821543003
Source: RageMP131.exe.0.dr	Static PE information: section name: entropy: 7.980197821543003
Source: MPGPH131.exe.0.dr	Static PE information: section name: entropy: 7.980197821543003

Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe			Jump to dropped file
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe			Jump to dropped file

Source: C:\Users\user\Desktop\AlCsIOd0pd.exe

File created: C:\ProgramData\MPGPH131\MPGPH131.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\AlCsIOd0pd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Stalling execution: Execution stalls by calling Sleep			graph_0-13659
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Stalling execution: Execution stalls by calling Sleep			graph_5-13659

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	System information queried: FirmwareTableInformation	Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Special instruction interceptor: First address: 625E3C instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: 625E3C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: 625E3C instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Window / User API: threadDelayed 3495	Jump to behavior
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Window / User API: threadDelayed 6379	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 9806	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 9807	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 9782	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 9885	Jump to behavior

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_5-13659
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_0-13659

Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_0-16262
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_5-16262

Source: C:\Users\user\Desktop\AlCsIOd0pd.exe TID: 3084	Thread sleep count: 3495 > 30	Jump to behavior
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe TID: 3084	Thread sleep time: -352995s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe TID: 3084	Thread sleep count: 6379 > 30	Jump to behavior
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe TID: 3084	Thread sleep time: -644279s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1376	Thread sleep count: 78 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1376	Thread sleep count: 9806 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1376	Thread sleep time: -990406s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5436	Thread sleep count: 74 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5436	Thread sleep count: 9807 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5436	Thread sleep time: -990507s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 1896	Thread sleep count: 101 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 1896	Thread sleep count: 9782 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 1896	Thread sleep time: -987982s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 4520	Thread sleep count: 9885 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 4520	Thread sleep time: -998385s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Code function: 0_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	0_2_00431F9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	5_2_00431F9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	6_2_00431F9C

Source: AlCsIOd0pd.exe, 00000000.00000003.1768008425.0000000000D81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\|
Source: AlCsIOd0pd.exe, 00000000.00000002.3253969387.0000000000D81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}i
Source: RageMP131.exe, 0000000B.00000002.3253822490.0000000000E30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: MPGPH131.exe, 00000006.00000002.3253912060.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllU
Source: MPGPH131.exe, 00000005.00000002.3255069543.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}@_
Source: MPGPH131.exe, 00000006.00000002.3253912060.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}M81
Source: AlCsIOd0pd.exe, 00000000.00000002.3253969387.0000000000D6A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}-K
Source: RageMP131.exe, 0000000B.00000003.1988485374.0000000000E97000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 00000005.00000002.3255069543.0000000000CED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&m
Source: AlCsIOd0pd.exe, 00000000.00000003.1768008425.0000000000D81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}]
Source: RageMP131.exe, 00000007.00000002.3253787477.0000000000D3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__orpo
Source: MPGPH131.exe, 00000005.00000002.3255069543.0000000000CED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}t #7NVD slot #7
Source: AlCsIOd0pd.exe, 00000000.00000002.3253969387.0000000000D6A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000%
Source: RageMP131.exe, 00000007.00000002.3253787477.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll4
Source: MPGPH131.exe, 00000006.00000002.3253912060.0000000000C56000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}>jD
Source: RageMP131.exe, 00000007.00000002.3253787477.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}yj
Source: AlCsIOd0pd.exe, 00000000.00000002.3253969387.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_BEB2C06B
Source: MPGPH131.exe, 00000005.00000003.1808009410.0000000000D51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}O
Source: RageMP131.exe, 0000000B.00000003.1988485374.0000000000E97000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: RageMP131.exe, 0000000B.00000002.3253822490.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll=
Source: AlCsIOd0pd.exe, 00000000.00000002.3253969387.0000000000D1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}NVD slot #44NVD slot #44
Source: AlCsIOd0pd.exe, 00000000.00000002.3253969387.0000000000D1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} slot #34
Source: AlCsIOd0pd.exe, 00000000.00000002.3253969387.0000000000D6A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.3255069543.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\AlCsIOd0pd.exe

Code function: 0_2_00438A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00438A64

Source: C:\Users\user\Desktop\AlCsIOd0pd.exe

0_2_004CF280

Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Code function: 0_2_00438A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00438A64
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Code function: 0_2_0043451D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0043451D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00438A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00438A64
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0043451D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_0043451D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00438A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00438A64
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0043451D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_0043451D

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Code function: 0_2_004CF280 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,	0_2_004CF280
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004CF280 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,	5_2_004CF280
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004CF280 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,	6_2_004CF280

Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Code function: GetLocaleInfoW,	0_2_004531CA
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Code function: EnumSystemLocalesW,	0_2_0044B1B1
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_004532F3
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00452B5A
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Code function: GetLocaleInfoW,	0_2_004533F9
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_004534CF
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Code function: GetLocaleInfoW,	0_2_00452D5F
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Code function: EnumSystemLocalesW,	0_2_00452E51
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Code function: EnumSystemLocalesW,	0_2_00452E06
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Code function: EnumSystemLocalesW,	0_2_00452EEC
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00452F77
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Code function: GetLocaleInfoW,	0_2_0044B734
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	5_2_004531CA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	5_2_0044B1B1
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_004532F3
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	5_2_00452B5A
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	5_2_004533F9
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	5_2_004534CF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	5_2_00452D5F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	5_2_00452E51
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	5_2_00452E06
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	5_2_00452EEC
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	5_2_00452F77
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	5_2_0044B734
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	6_2_004531CA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	6_2_0044B1B1
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_004532F3
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	6_2_00452B5A
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	6_2_004533F9
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	6_2_004534CF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	6_2_00452D5F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	6_2_00452E51
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	6_2_00452E06
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	6_2_00452EEC
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	6_2_00452F77
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	6_2_0044B734

Source: C:\Users\user\Desktop\AlCsIOd0pd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\AlCsIOd0pd.exe

Code function: 0_2_0043361D GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

0_2_0043361D

Source: C:\Users\user\Desktop\AlCsIOd0pd.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected RisePro Stealer

Source: Yara match	File source: Process Memory Space: AlCsIOd0pd.exe PID: 4852, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 5644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 5740, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 3720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 4460, type: MEMORYSTR

Remote Access Functionality

Yara detected RisePro Stealer

Source: Yara match	File source: Process Memory Space: AlCsIOd0pd.exe PID: 4852, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 5644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 5740, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 3720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 4460, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	11 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	12 Virtualization/Sandbox Evasion	LSASS Memory	421 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Native API	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	11 Process Injection	Security Account Manager	12 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	123 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
AlCsIOd0pd.exe	63%	ReversingLabs	Win32.Trojan.RiseProStealer
AlCsIOd0pd.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	63%	ReversingLabs	Win32.Trojan.RiseProStealer
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	63%	ReversingLabs	Win32.Trojan.RiseProStealer

Source	Detection	Scanner	Label
https://ipinfo.io/	0%	URL Reputation	safe
https://t.me/RiseProSUPPORT	0%	Avira URL Cloud	safe
http://www.winimage.com/zLibDll	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORTX	0%	Avira URL Cloud	safe
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	0%	Avira URL Cloud	safe
https://www.maxmind.com/en/locate-my-ip-address	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORTB	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORToE	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	AlCsIOd0pd.exe, 00000000.00000003.1748570602.0000000000CD0000.00000004.00001000.00020000.00000000.sdmp, AlCsIOd0pd.exe, 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000003.1783897542.0000000002850000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.1784572733.0000000002850000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3251444322.000000000055D000.00000002.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000003.1896625468.0000000002850000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.1976471958.0000000002840000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3251481803.000000000055D000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORTX	RageMP131.exe, 00000007.00000002.3253787477.0000000000D3E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDll	AlCsIOd0pd.exe, 00000000.00000003.1748570602.0000000000CD0000.00000004.00001000.00020000.00000000.sdmp, AlCsIOd0pd.exe, 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000003.1783897542.0000000002850000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.1784572733.0000000002850000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3251444322.000000000055D000.00000002.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000003.1896625468.0000000002850000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.1976471958.0000000002840000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3251481803.000000000055D000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORT	AlCsIOd0pd.exe, 00000000.00000002.3253969387.0000000000D1E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.3255069543.0000000000CED000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3253912060.0000000000C37000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3253787477.0000000000D3E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3253822490.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/	MPGPH131.exe	false	URL Reputation: safe	unknown
https://t.me/RiseProSUPPORTB	AlCsIOd0pd.exe, 00000000.00000002.3253969387.0000000000D1E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORToE	MPGPH131.exe, 00000006.00000002.3253912060.0000000000C37000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.maxmind.com/en/locate-my-ip-address	MPGPH131.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
77.91.77.66	unknown	Russian Federation		42861	FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1460268
Start date and time:	2024-06-20 18:15:16 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	AlCsIOd0pd.exe renamed because original name is a hash value
Original Sample Name:	de584dd4970a8099454611ee0c739ea8.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@11/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
VT rate limit hit for: AlCsIOd0pd.exe

Simulations

Behavior and APIs

Time	Type	Description
12:16:49	API Interceptor	331415x Sleep call for process: AlCsIOd0pd.exe modified
12:16:53	API Interceptor	593250x Sleep call for process: MPGPH131.exe modified
12:17:05	API Interceptor	410683x Sleep call for process: RageMP131.exe modified
17:16:18	Task Scheduler	Run new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
17:16:18	Task Scheduler	Run new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
17:16:21	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
17:16:29	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
77.91.77.66	setup.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	D44CPdpkNk.exe	Get hash	malicious	RisePro Stealer	Browse
	WGEfBWbWQI.exe	Get hash	malicious	RisePro Stealer	Browse
	2bT2lTwRku.exe	Get hash	malicious	RisePro Stealer	Browse
	T17sbXrL3i.exe	Get hash	malicious	RisePro Stealer	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU	setup.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	77.91.77.81
	setup.exe	Get hash	malicious	Python Stealer, Amadey, Monster Stealer, PureLog Stealer, RedLine, XWorm, zgRAT	Browse	77.91.77.81
	FN MultiHack v2.exe	Get hash	malicious	RedLine	Browse	77.91.77.6
	D44CPdpkNk.exe	Get hash	malicious	RisePro Stealer	Browse	77.91.77.66
	https://drive.google.com/file/d/1SCCeBL3Md8Sct7wQF5bfbtLysFqXCW6y/view?ts=667387ac	Get hash	malicious	Unknown	Browse	77.91.77.5
	https://drive.google.com/file/d/1SCCeBL3Md8Sct7wQF5bfbtLysFqXCW6y/view?ts=667387ac	Get hash	malicious	Unknown	Browse	77.91.77.5
	WGEfBWbWQI.exe	Get hash	malicious	RisePro Stealer	Browse	77.91.77.66
	2bT2lTwRku.exe	Get hash	malicious	RisePro Stealer	Browse	77.91.77.66
	T17sbXrL3i.exe	Get hash	malicious	RisePro Stealer	Browse	77.91.77.66
	2022and2023TaxDocuments.zip	Get hash	malicious	Remcos	Browse	77.91.77.107

Process:	C:\Users\user\Desktop\AlCsIOd0pd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3259920
Entropy (8bit):	7.966792574709497
Encrypted:	false
SSDEEP:	98304:t+VDlD+ah2X5f2CiioP8peU/Ju4+iU2lfOZy81+1l:AnZYuTcRxuZiUiW9+1l
MD5:	DE584DD4970A8099454611EE0C739EA8
SHA1:	F22FE3BFB22B55D1F0DC2FD802A32D2BEB157E0B
SHA-256:	D0EFF53CFD30F061451987B4E98205D81F9495E8F26DEF46AEC15F7A4C171C20
SHA-512:	58470AB84C35022860036CB5DFDCCEC9BB1F1EBEA37E4745EFC70C464E2FFB9B9835A1251CDF76C012F56DD0A72A4D448B0AC298DA02F4676EBCCCC03B2A0B76
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....iLf...............'.....\|......X.X...........@..........................`~......W2......................................a..........8....................P~..............................p...............................6..@................... ........................... ..` 2~..........................@..@ 0I...P......................@....rsrc...8...........................@..@ X........r..................@..B.idata.......`.......r..............@....tls.........p.......v...................themida..>..........x..............`....boot....F&...X..F&..x..............`..`.reloc.......P~.......1................@................................................................

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\AlCsIOd0pd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Download File

Process:	C:\Users\user\Desktop\AlCsIOd0pd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3259920
Entropy (8bit):	7.966792574709497
Encrypted:	false
SSDEEP:	98304:t+VDlD+ah2X5f2CiioP8peU/Ju4+iU2lfOZy81+1l:AnZYuTcRxuZiUiW9+1l
MD5:	DE584DD4970A8099454611EE0C739EA8
SHA1:	F22FE3BFB22B55D1F0DC2FD802A32D2BEB157E0B
SHA-256:	D0EFF53CFD30F061451987B4E98205D81F9495E8F26DEF46AEC15F7A4C171C20
SHA-512:	58470AB84C35022860036CB5DFDCCEC9BB1F1EBEA37E4745EFC70C464E2FFB9B9835A1251CDF76C012F56DD0A72A4D448B0AC298DA02F4676EBCCCC03B2A0B76
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....iLf...............'.....\|......X.X...........@..........................`~......W2......................................a..........8....................P~..............................p...............................6..@................... ........................... ..` 2~..........................@..@ 0I...P......................@....rsrc...8...........................@..@ X........r..................@..B.idata.......`.......r..............@....tls.........p.......v...................themida..>..........x..............`....boot....F&...X..F&..x..............`..`.reloc.......P~.......1................@................................................................

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\AlCsIOd0pd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Download File

Process:	C:\Users\user\Desktop\AlCsIOd0pd.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	13
Entropy (8bit):	2.8731406795131336
Encrypted:	false
SSDEEP:	3:L1VRXxn:TRXxn
MD5:	2D8F5D015AFD07E66F8F107CA36CCB48
SHA1:	FD9059874E9195951B8F1BEC90C2006B3263A6C9
SHA-256:	6C8364F8F9303EAE139976F9FDA7A9231F560D1173BBD4CC8C6A0269CCBB555D
SHA-512:	EBAE6B06D775C9BC8DFCDA058DE1DD41784C074409D2D17DBB399037E5635F3C7993E8670F64376AA8FCDAF5795FBF152134C3C356FF37E5070C1648306FD722
Malicious:	false
Reputation:	low
Preview:	1718904293224

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.966792574709497
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	AlCsIOd0pd.exe
File size:	3'259'920 bytes
MD5:	de584dd4970a8099454611ee0c739ea8
SHA1:	f22fe3bfb22b55d1f0dc2fd802a32d2beb157e0b
SHA256:	d0eff53cfd30f061451987b4e98205d81f9495e8f26def46aec15f7a4c171c20
SHA512:	58470ab84c35022860036cb5dfdccec9bb1f1ebea37e4745efc70c464e2ffb9b9835a1251cdf76c012f56dd0a72a4d448b0ac298da02f4676ebcccc03b2a0b76
SSDEEP:	98304:t+VDlD+ah2X5f2CiioP8peU/Ju4+iU2lfOZy81+1l:AnZYuTcRxuZiUiW9+1l
TLSH:	94E533201ED31790C1B713F6AE7B2D1A1B43F26A51B47D20812F7ED9D9AE21C6BD506C
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s...../.s

File Icon


Icon Hash:	8596a1a0a1a1b171

Static PE Info

General

Entrypoint:	0x980058
Entrypoint Section:	.boot
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x664C6914 [Tue May 21 09:27:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	63814aaf116ba6abb6496ce4bcad24c6

Entrypoint Preview

Instruction
call 00007FD0F11318A0h
push ebx
mov ebx, esp
push ebx
mov esi, dword ptr [ebx+08h]
mov edi, dword ptr [ebx+10h]
cld
mov dl, 80h
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
mov ebx, 00000002h
add dl, dl
jne 00007FD0F1131757h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007FD0F113173Ch
add dl, dl
jne 00007FD0F1131757h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007FD0F11317A3h
xor eax, eax
add dl, dl
jne 00007FD0F1131757h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007FD0F1131837h
add dl, dl
jne 00007FD0F1131757h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007FD0F1131757h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007FD0F1131757h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007FD0F1131757h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
je 00007FD0F113175Ah
push edi
mov eax, eax
sub edi, eax
mov al, byte ptr [edi]
pop edi
mov byte ptr [edi], al
inc edi
mov ebx, 00000002h
jmp 00007FD0F11316EBh
mov eax, 00000001h
add dl, dl
jne 00007FD0F1131757h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007FD0F1131757h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jc 00007FD0F113173Ch
sub eax, ebx
mov ebx, 00000001h
jne 00007FD0F113177Ah
mov ecx, 00000001h
add dl, dl
jne 00007FD0F1131757h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 00007FD0F1131757h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jc 00007FD0F113173Ch
push esi
mov esi, edi
sub esi, ebp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x19618b	0x184	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x18a000	0x1638	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7e5000	0x10	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x197018	0x18	.tls
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x18369c	0x40
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x15bbc8	0x9d200	72be48f03fa29b125860aa4b7040515f	False	0.9988486351431981	data	7.980197821543003	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
	0x15d000	0x27e32	0x10a00	632b628419d20fc973bcfda8cff5f3be	False	0.9942874765037594	data	7.949044417592158	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x185000	0x4930	0x800	13c7d36a38dc58d8a970d8d422275803	False	0.98974609375	OpenPGP Public Key	7.765144396837099	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x18a000	0x1638	0x1800	fe6f3fdb9e7e97cba92d8ce4e4fcc95b	False	0.7220052083333334	data	6.54017046361188	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x18c000	0x9858	0x7200	96fc680932cb7019c6055702e4e238e3	False	0.9789953399122807	data	7.930725168164811	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.idata	0x196000	0x1000	0x400	1b20e07443fa333ff9692026d1e6c6c2	False	0.3984375	data	3.42439969016873	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x197000	0x1000	0x200	54a50a058e0f3b6aa2fe1b22e2033106	False	0.056640625	data	0.18120187678200297	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.themida	0x198000	0x3e8000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.boot	0x580000	0x264600	0x264600	53baa03dffef8344a9262941737c70c7	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x7e5000	0x1000	0x10	f5bc99b71bad9e8a775cc32747e3ca58	False	1.5	GLS_BINARY_LSB_FIRST	2.474601752714581	IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x18a440	0x1060	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Russian	Russia	0.8838263358778626
RT_GROUP_ICON	0x18b4a0	0x14	data	Russian	Russia	1.05
RT_VERSION	0x18a130	0x310	data	Russian	Russia	0.45408163265306123
RT_MANIFEST	0x18b4b8	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	GetModuleHandleA
USER32.dll	wsprintfA
GDI32.dll	CreateCompatibleBitmap
ADVAPI32.dll	RegQueryValueExA
SHELL32.dll	ShellExecuteA
ole32.dll	CoInitialize
WS2_32.dll	WSAStartup
CRYPT32.dll	CryptUnprotectData
SHLWAPI.dll	PathFindExtensionA
gdiplus.dll	GdipGetImageEncoders
SETUPAPI.dll	SetupDiEnumDeviceInfo
ntdll.dll	RtlUnicodeStringToAnsiString
RstrtMgr.DLL	RmStartSession

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/20/24-18:18:46.029864	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49741	58709	192.168.2.4	77.91.77.66
06/20/24-18:16:18.111786	TCP	2049060	ET TROJAN RisePro TCP Heartbeat Packet	49731	58709	192.168.2.4	77.91.77.66
06/20/24-18:18:43.639253	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49732	58709	192.168.2.4	77.91.77.66
06/20/24-18:18:46.029916	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49735	58709	192.168.2.4	77.91.77.66
06/20/24-18:18:45.967425	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49731	58709	192.168.2.4	77.91.77.66
06/20/24-18:16:22.687972	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49732	77.91.77.66	192.168.2.4
06/20/24-18:16:40.743118	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49741	77.91.77.66	192.168.2.4
06/20/24-18:16:18.693887	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49731	77.91.77.66	192.168.2.4
06/20/24-18:16:22.714525	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49733	77.91.77.66	192.168.2.4
06/20/24-18:18:43.701803	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49733	58709	192.168.2.4	77.91.77.66
06/20/24-18:16:34.458767	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49735	77.91.77.66	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 20, 2024 18:16:18.082406998 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:16:18.087196112 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:16:18.087280989 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:16:18.111785889 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:16:18.116616964 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:16:18.693886995 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:16:18.748128891 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:16:21.826422930 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:16:21.849236012 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:16:22.083770037 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:16:22.084619045 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:16:22.088967085 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 18:16:22.089078903 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:16:22.090025902 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 18:16:22.090116024 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:16:22.097835064 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:16:22.097959995 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:16:22.102804899 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 18:16:22.103224039 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 18:16:22.687972069 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 18:16:22.714524984 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 18:16:22.732546091 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:16:22.763778925 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:16:25.810913086 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:16:25.816184998 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 18:16:25.826411963 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:16:25.831402063 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 18:16:33.820631027 CEST	49735	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:16:33.827883959 CEST	58709	49735	77.91.77.66	192.168.2.4
Jun 20, 2024 18:16:33.827955961 CEST	49735	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:16:33.850049019 CEST	49735	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:16:33.855003119 CEST	58709	49735	77.91.77.66	192.168.2.4
Jun 20, 2024 18:16:34.458766937 CEST	58709	49735	77.91.77.66	192.168.2.4
Jun 20, 2024 18:16:34.513776064 CEST	49735	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:16:37.592094898 CEST	49735	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:16:37.597034931 CEST	58709	49735	77.91.77.66	192.168.2.4
Jun 20, 2024 18:16:40.131934881 CEST	49741	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:16:40.137490034 CEST	58709	49741	77.91.77.66	192.168.2.4
Jun 20, 2024 18:16:40.137599945 CEST	49741	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:16:40.154479027 CEST	49741	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:16:40.159463882 CEST	58709	49741	77.91.77.66	192.168.2.4
Jun 20, 2024 18:16:40.743118048 CEST	58709	49741	77.91.77.66	192.168.2.4
Jun 20, 2024 18:16:40.795069933 CEST	49741	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:16:43.857678890 CEST	49741	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:16:43.862550020 CEST	58709	49741	77.91.77.66	192.168.2.4
Jun 20, 2024 18:16:53.139162064 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:16:53.144341946 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:16:57.092277050 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:16:57.097079992 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 18:16:57.170197964 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:16:57.175059080 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:08.920384884 CEST	49735	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:08.925599098 CEST	58709	49735	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:11.936005116 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:11.941045046 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:15.185986042 CEST	49741	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:15.190887928 CEST	58709	49741	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:15.873939037 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:15.879354954 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:15.967291117 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:15.972165108 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:21.310914993 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:21.316880941 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:24.454423904 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:24.459355116 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:25.279653072 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:25.284882069 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:25.389334917 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:25.394721985 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:27.576925993 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:27.582823038 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:27.702027082 CEST	49735	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:27.708401918 CEST	58709	49735	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:28.420510054 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:28.425458908 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:28.517594099 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:28.522556067 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:30.736263990 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:30.745033026 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:31.561017036 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:31.566310883 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:31.654854059 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:31.659856081 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:33.858002901 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:33.863140106 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:33.967370033 CEST	49741	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:33.973140955 CEST	58709	49741	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:34.686566114 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:34.692332029 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:34.780193090 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:34.785100937 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:36.998781919 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:37.003981113 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:37.108062983 CEST	49735	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:37.112979889 CEST	58709	49735	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:37.826740980 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:37.832756996 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:37.906755924 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:37.911712885 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:40.123719931 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:40.128653049 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:40.248564005 CEST	49735	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:40.253926992 CEST	58709	49735	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:40.967447042 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:40.972373962 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:41.029810905 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:41.034718037 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:43.264266968 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:43.269362926 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:43.373465061 CEST	49735	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:43.376195908 CEST	49741	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:43.380398989 CEST	58709	49735	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:43.381427050 CEST	58709	49741	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:44.092204094 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:44.097125053 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:44.170373917 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:44.175200939 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:46.404901028 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:46.409967899 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:46.498620033 CEST	49735	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:46.498620033 CEST	49741	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:46.503508091 CEST	58709	49735	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:46.503520012 CEST	58709	49741	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:47.217345953 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:47.222398043 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:47.295483112 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:47.300584078 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:49.545661926 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:49.550859928 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:49.623709917 CEST	49735	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:49.627721071 CEST	49741	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:49.628674984 CEST	58709	49735	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:49.632498026 CEST	58709	49741	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:50.342365980 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:50.347349882 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:50.436182022 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:50.441106081 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:52.670891047 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:52.676013947 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:52.748569965 CEST	49735	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:52.748569965 CEST	49741	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:52.754863977 CEST	58709	49735	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:52.754878044 CEST	58709	49741	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:53.467386961 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:53.472249031 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:53.576813936 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:53.581693888 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:55.795363903 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:55.800189018 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:55.889224052 CEST	49741	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:55.889260054 CEST	49735	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:55.894006014 CEST	58709	49741	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:55.894095898 CEST	58709	49735	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:56.607949972 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:56.613042116 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:56.717566967 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:56.722527981 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:58.937108994 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:58.942126989 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:59.014260054 CEST	49741	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:59.014303923 CEST	49735	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:59.020181894 CEST	58709	49741	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:59.020253897 CEST	58709	49735	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:59.748775959 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:59.753906965 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 18:17:59.858185053 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:17:59.863053083 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:02.061353922 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:02.066590071 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:02.154870987 CEST	49741	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:02.154917002 CEST	49735	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:02.160830021 CEST	58709	49741	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:02.160846949 CEST	58709	49735	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:02.889441013 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:02.896599054 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:02.983768940 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:02.991080046 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:05.201714993 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:05.206844091 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:05.295502901 CEST	49741	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:05.300564051 CEST	58709	49741	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:05.300678968 CEST	49735	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:05.305542946 CEST	58709	49735	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:06.014344931 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:06.019401073 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:06.108160973 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:06.113195896 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:08.343862057 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:08.348886013 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:08.420466900 CEST	49741	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:08.424453020 CEST	49735	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:08.425554037 CEST	58709	49741	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:08.429310083 CEST	58709	49735	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:09.154839993 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:09.160027981 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:09.248553991 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:09.254897118 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:11.483021975 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:11.488552094 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:11.561369896 CEST	49741	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:11.561443090 CEST	49735	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:11.570662022 CEST	58709	49741	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:11.571245909 CEST	58709	49735	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:12.279865026 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:12.285075903 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:12.389247894 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:12.394246101 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:14.623620033 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:14.628688097 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:14.686108112 CEST	49741	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:14.686141968 CEST	49735	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:14.691111088 CEST	58709	49741	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:14.691131115 CEST	58709	49735	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:15.404898882 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:15.412401915 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:15.514271021 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:15.519392967 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:17.749006987 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:17.753881931 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:17.826817036 CEST	49735	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:17.826817036 CEST	49741	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:17.834220886 CEST	58709	49735	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:17.834240913 CEST	58709	49741	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:18.545907021 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:18.550836086 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:18.639486074 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:18.644351959 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:20.874095917 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:20.879035950 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:20.967571974 CEST	49741	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:20.967650890 CEST	49735	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:20.973581076 CEST	58709	49741	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:20.973701000 CEST	58709	49735	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:21.670627117 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:21.675652027 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:21.780040979 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:21.785063028 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:24.014272928 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:24.020559072 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:24.108004093 CEST	49735	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:24.108004093 CEST	49741	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:24.298521996 CEST	58709	49735	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:24.298697948 CEST	58709	49741	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:24.811269045 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:24.816102982 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:24.905145884 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:24.910788059 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:27.154906034 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:27.159956932 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:27.248706102 CEST	49741	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:27.248742104 CEST	49735	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:27.254652977 CEST	58709	49741	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:27.254673004 CEST	58709	49735	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:27.951773882 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:27.956631899 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:28.045533895 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:28.051101923 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:30.295551062 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:30.389306068 CEST	49741	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:30.391441107 CEST	49735	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:30.493395090 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:30.493438005 CEST	58709	49741	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:30.493468046 CEST	58709	49735	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:31.092443943 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:31.097237110 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:31.170707941 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:31.175538063 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:33.420533895 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:33.425492048 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:33.514206886 CEST	49741	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:33.514251947 CEST	49735	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:33.519130945 CEST	58709	49741	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:33.519500017 CEST	58709	49735	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:34.233072042 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:34.237952948 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:34.311182022 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:34.317667961 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:36.561214924 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:36.566143036 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:36.639219046 CEST	49741	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:36.639262915 CEST	49735	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:36.645170927 CEST	58709	49741	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:36.645188093 CEST	58709	49735	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:37.373574972 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:37.378360987 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:37.436151981 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:37.441423893 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:39.686177969 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:39.690995932 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:39.764250994 CEST	49741	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:39.764300108 CEST	49735	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:39.769045115 CEST	58709	49741	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:39.769207954 CEST	58709	49735	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:40.514302015 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:40.519665956 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:40.576776028 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:40.581871033 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:42.826821089 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:42.831593990 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:42.905057907 CEST	49741	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:42.905111074 CEST	49735	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:42.911545992 CEST	58709	49741	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:42.911560059 CEST	58709	49735	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:43.639252901 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:43.644092083 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:43.701802969 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:43.706597090 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:45.967425108 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:45.972402096 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:46.029864073 CEST	49741	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:46.029916048 CEST	49735	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 18:18:46.035264015 CEST	58709	49741	77.91.77.66	192.168.2.4
Jun 20, 2024 18:18:46.035303116 CEST	58709	49735	77.91.77.66	192.168.2.4

Target ID:	0
Start time:	12:16:14
Start date:	20/06/2024
Path:	C:\Users\user\Desktop\AlCsIOd0pd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\AlCsIOd0pd.exe"
Imagebase:	0x400000
File size:	3'259'920 bytes
MD5 hash:	DE584DD4970A8099454611EE0C739EA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	12:16:16
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0xb50000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:16:16
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:16:16
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0xb50000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:16:16
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:16:18
Start date:	20/06/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x400000
File size:	3'259'920 bytes
MD5 hash:	DE584DD4970A8099454611EE0C739EA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 63%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	12:16:18
Start date:	20/06/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x400000
File size:	3'259'920 bytes
MD5 hash:	DE584DD4970A8099454611EE0C739EA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	12:16:29
Start date:	20/06/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x400000
File size:	3'259'920 bytes
MD5 hash:	DE584DD4970A8099454611EE0C739EA8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 63%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	12:16:37
Start date:	20/06/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x400000
File size:	3'259'920 bytes
MD5 hash:	DE584DD4970A8099454611EE0C739EA8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	4.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	34

Executed Functions

Function 00409280 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll,?,?,?,?,0054D15C,00000000,74D723A0,-00589880), ref: 004096A6
GetProcAddress.KERNEL32(00000000,?), ref: 004096B4
WSASend.WS2_32(?,?,00000001,00000000,00000000,00000000,00000000,?,?,?,?,0054D15C,00000000,74D723A0,-00589880), ref: 004096C9

Strings

Ws2_32.dll, xrefs: 0040969A

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: AddressHandleModuleProcSend
String ID: Ws2_32.dll
API String ID: 2819740048-3093949381
Opcode ID: d946741ea927b9b060335f299eec8efad25939578b4ebaaa967d5c79e73c84d4
Instruction ID: 188670ed5cfc709ed037a390f66f33add7af100e18449b0941b00ad524943a05
Opcode Fuzzy Hash: d946741ea927b9b060335f299eec8efad25939578b4ebaaa967d5c79e73c84d4
Instruction Fuzzy Hash: 7C02CE70D04298DEDF25CFA4C8907ADBBB0EF59304F24429EE4456B2C6D7781D86CB96

Function 004C7B00 Relevance: 18.3, APIs: 12, Instructions: 279
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000370,0000FFFF,00001006,?,00000008), ref: 004C7BA6
recv.WS2_32(?,00000004,00000002), ref: 004C7BC1
WSAGetLastError.WS2_32 ref: 004C7BC5
recv.WS2_32(00000000,0000000C,00000002,00000000), ref: 004C7C43
recv.WS2_32(00000000,0000000C,00000008), ref: 004C7C64
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?), ref: 004C7D00
recv.WS2_32(00000000,?,00000008), ref: 004C7D1B

Part of subcall function 004C8590: WSAStartup.WS2_32 ref: 004C85BA
Part of subcall function 004C8590: getaddrinfo.WS2_32(?,?,?,00589328), ref: 004C863C
Part of subcall function 004C8590: socket.WS2_32(?,?,?), ref: 004C865D
Part of subcall function 004C8590: connect.WS2_32(00000000,00559BFC,?), ref: 004C8671
Part of subcall function 004C8590: closesocket.WS2_32(00000000), ref: 004C867D
Part of subcall function 004C8590: FreeAddrInfoW.WS2_32(?), ref: 004C868A
Part of subcall function 004C8590: WSACleanup.WS2_32 ref: 004C8690

recv.WS2_32(?,00000004,00000008), ref: 004C7E23
__Xtime_get_ticks.LIBCPMT ref: 004C7E2A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004C7E38
Sleep.KERNELBASE(00000001,00000000,?,00002710,00000000), ref: 004C7EB1
Sleep.KERNELBASE(00000064,?,00002710,00000000), ref: 004C7EB9

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: recv$Sleepsetsockopt$AddrCleanupErrorFreeInfoLastStartupUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@closesocketconnectgetaddrinfosocket
String ID:
API String ID: 3089209366-0
Opcode ID: deda763b8fb6066c72b20903b58187ae793f723e7b47fea433c0891846b4f81f
Instruction ID: b3d54dcccad81d83ab75f13ba9899d4b50e1d8608cabcccfb3508871926cac68
Opcode Fuzzy Hash: deda763b8fb6066c72b20903b58187ae793f723e7b47fea433c0891846b4f81f
Instruction Fuzzy Hash: 9EB1AC71D043089BEB10DBA8CC49BAEBBB1BB54314F24025EE815BB2D2D7785D88DF95

Function 004C8590 Relevance: 12.1, APIs: 8, Instructions: 92
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 004C85BA
getaddrinfo.WS2_32(?,?,?,00589328), ref: 004C863C
socket.WS2_32(?,?,?), ref: 004C865D
connect.WS2_32(00000000,00559BFC,?), ref: 004C8671
closesocket.WS2_32(00000000), ref: 004C867D
FreeAddrInfoW.WS2_32(?), ref: 004C868A
WSACleanup.WS2_32 ref: 004C8690
FreeAddrInfoW.WS2_32(?), ref: 004C86A5

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: AddrFreeInfo$CleanupStartupclosesocketconnectgetaddrinfosocket
String ID:
API String ID: 448659506-0
Opcode ID: 52d29ec15fbf37ccd53ab56e21f2e3f1d11727fcf2b6a4206c2cbc59116a4c78
Instruction ID: ffa07009e3086412046aa5b15573dbd5c691e56a3beb11943292ef2f0f62f1de
Opcode Fuzzy Hash: 52d29ec15fbf37ccd53ab56e21f2e3f1d11727fcf2b6a4206c2cbc59116a4c78
Instruction Fuzzy Hash: 9531C1726043009BD7208F25DC48B2BB7E5FB94729F114B1EF9A4922E0D7759C089AA7

Function 00449789 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00448E9F: GetConsoleOutputCP.KERNEL32(DDE7F8A2,00000000,00000000,?), ref: 00448F02

WriteFile.KERNELBASE(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0044990E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?), ref: 00449918

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 2beaef352ff8862ad6b8b16251cd0bd229135013537871e9a6efb1225fc67aec
Instruction ID: 4c198159cf300fc4e9085a349e24ad4d45033eb13303bb4f9288eddf9455663d
Opcode Fuzzy Hash: 2beaef352ff8862ad6b8b16251cd0bd229135013537871e9a6efb1225fc67aec
Instruction Fuzzy Hash: 9961C5B1C14119BFEF11DFA8C844AAFBBB9AF49304F14014AE800A7316D739DD05EB65

Function 00448DFF Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,00448CE6,00000000,?,0057A178,0000000C,00448DA2,?,?,?), ref: 00448E55
GetLastError.KERNEL32(?,00448CE6,00000000,?,0057A178,0000000C,00448DA2,?,?,?), ref: 00448E5F

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 1fe827fdfe079599b9b1dab25e2b646f0beb01ea40d46a72429d261cc15a62e7
Instruction ID: bfed174018f4c3fae0b74bea86efe9ace0911028d3bee9629bfc5162a0057b67
Opcode Fuzzy Hash: 1fe827fdfe079599b9b1dab25e2b646f0beb01ea40d46a72429d261cc15a62e7
Instruction Fuzzy Hash: 6E1125336042102AF6252236A84677F67499B82738F39061FF918CB2D2DF689C81825D

Function 0044251C Relevance: 3.1, APIs: 2, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(00000000,?,?,?,?,?,00000000,?,?,?,00442626,?,?,?,?,?), ref: 00442558
GetLastError.KERNEL32(?,?,?,?,00442626,?,?,?,?,?,00000000,?,00000000), ref: 00442565

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 0df1753fdbe4f7a704092f8361e7cfb0c7cc0fcadc70f8748e4d2d33b1623b65
Instruction ID: bcffdd1dd92d970d4fbe8e398a8ab980657c5c2bf717c74f1f656664416c076e
Opcode Fuzzy Hash: 0df1753fdbe4f7a704092f8361e7cfb0c7cc0fcadc70f8748e4d2d33b1623b65
Instruction Fuzzy Hash: 9B012632610615BFDF158F69DC1699E3B29EB84334F240209F8019B2E1E6B5ED429BA4

Function 004032D0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0040331F

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 0fd589d96c9d07b1efa01aec19e4ff46bb0766daf2056f60d33bc81ca57302d3
Instruction ID: ac639495c118a2832fc09027b5ebf4fad0cef292c7be368858978faeea3118d5
Opcode Fuzzy Hash: 0fd589d96c9d07b1efa01aec19e4ff46bb0766daf2056f60d33bc81ca57302d3
Instruction Fuzzy Hash: 63F024321001009BCB246F61D4565EAB7ECDF28366B50083FFC8DD7292EB3EDA408788

Function 0044A65A Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000001), ref: 0044A69B

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 89032516e5b3e6299283371760f336f91a06b383302663fb1c071aa923d3998c
Instruction ID: 9689b7dccde3e7d2c1426315cc49502dff6dd5535dcc2f3da2dc3831567fdc71
Opcode Fuzzy Hash: 89032516e5b3e6299283371760f336f91a06b383302663fb1c071aa923d3998c
Instruction Fuzzy Hash: 4CF0E0311905246BFB216A66DC05B5B375CAF41760F1E8117EC84EB190CA3CDC3146EE

Function 0044B094 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000001,?), ref: 0044B0C6

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c639ae0624eff34eb8e57d07392fb4ffc7a0b3e65f726cef66c68c9318aea675
Instruction ID: 07eaf642519ac51a5bd3283dd2addbb445c80e248ae9cef49388ffb333b33e8c
Opcode Fuzzy Hash: c639ae0624eff34eb8e57d07392fb4ffc7a0b3e65f726cef66c68c9318aea675
Instruction Fuzzy Hash: 99E022322006206BFF313AA69C14B5B764CEF413A3F190227EC25A62D1DB3CCC0092EE

Non-executed Functions

Function 004CF280 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 240injectionmemorysynchronizationCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000040), ref: 004CF2F1
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004CF30D
WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 004CF342
VirtualAllocEx.KERNEL32(?,00000000,00001000,00003000,00000040), ref: 004CF36B
WriteProcessMemory.KERNEL32(?,00000000,?,00000218,00000000), ref: 004CF50F
WriteProcessMemory.KERNEL32(?,00000218,004CF5E0,-00000010,00000000), ref: 004CF531
CreateRemoteThread.KERNEL32(?,00000000,00000000,00000218,00000000,00000000,00000000), ref: 004CF544
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 004CF54D

Strings

%s|%s, xrefs: 004CF4EF
131, xrefs: 004CF4D3, 004CF4E3

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: MemoryProcessWrite$AllocVirtual$CreateObjectRemoteSingleThreadWait
String ID: %s|%s$131
API String ID: 2137838514-1629954864
Opcode ID: b88fb1ed2ebfd2a655c4879da0ce9de7ec8f2c0603ef1b71525654192dd42d6d
Instruction ID: 2ab717f03d3c912496b66fb944616d360f792c6fe5d042a247d22025e7d5b78f
Opcode Fuzzy Hash: b88fb1ed2ebfd2a655c4879da0ce9de7ec8f2c0603ef1b71525654192dd42d6d
Instruction Fuzzy Hash: 36B16BB1D002089FDB14CFA4CC95BAEBBB5FF18300F10426DE905BB291D774A984DBA5

Function 004534CF Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00449E42: GetLastError.KERNEL32(00000000,?,0044F82B), ref: 00449E46
Part of subcall function 00449E42: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 00449EE8

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 004535D7
IsValidCodePage.KERNEL32(?), ref: 00453615
IsValidLocale.KERNEL32(?,00000001), ref: 00453628
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 00453670
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 0045368B

Strings

*V, xrefs: 00453534

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: *V
API String ID: 415426439-2897881622
Opcode ID: bb3ee8500ca9cacc625c50b97d6e48ff5c53ad3e39c4a6c01d9da358df15b7ae
Instruction ID: 4a54d826d8e8e5dc964d84ffa3ac1e49b68ae0fe58eca9cd8e7cd24ca5604c7d
Opcode Fuzzy Hash: bb3ee8500ca9cacc625c50b97d6e48ff5c53ad3e39c4a6c01d9da358df15b7ae
Instruction Fuzzy Hash: 4E517471A00209AFDB20DFA5CC41ABF77B8AF05743F14446AED01E7252EB74DA48DB65

Function 004547BF Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 004549D6

Strings

1#SNAN, xrefs: 004548CB
1#INF, xrefs: 004548F5
1#QNAN, xrefs: 004548D2
1#IND, xrefs: 004548C4

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 43a42e638d961d261596a491a02aa4b2327403fcfc943c4a8adc8c2915f1bcde
Instruction ID: 95be6499ce7b8f5c3e7b75284ec9f8f0661dd908efafa341dd21629552806af8
Opcode Fuzzy Hash: 43a42e638d961d261596a491a02aa4b2327403fcfc943c4a8adc8c2915f1bcde
Instruction Fuzzy Hash: 3AD23D71E086288FDB65CE28CD507EAB7B5EB84306F1441EBD80DE7241D778AE898F45

Function 00452B5A Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00449E42: GetLastError.KERNEL32(00000000,?,0044F82B), ref: 00449E46
Part of subcall function 00449E42: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 00449EE8

GetACP.KERNEL32(?,?,?,?,?,?,00447300,?,?,?,?,?,-00000050,?,?,?), ref: 00452C19
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00447300,?,?,?,?,?,-00000050,?,?), ref: 00452C50
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 00452DB3

Strings

utf8, xrefs: 00452D22
*V, xrefs: 00452B98

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: *V$utf8
API String ID: 607553120-210452255
Opcode ID: 95727e6ef7b94787d777f99e21165c393144e5509e4be2ad3f52f8295ffa9360
Instruction ID: 742b11dcb7ff0b0bfa38c284345f0d68b4d7ce619a9ba0daefdf44cafbbca61f
Opcode Fuzzy Hash: 95727e6ef7b94787d777f99e21165c393144e5509e4be2ad3f52f8295ffa9360
Instruction Fuzzy Hash: F071FA32600602A6D725AF75CD45B6B73A8EF16705F10042FFD05D7283EBF8E94C9699

Function 004532F3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,00000000,?,?,?,00453605,?,?), ref: 0045338C
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,00000000,?,?,?,00453605,?,?), ref: 004533B5
GetACP.KERNEL32(?,?,00453605,?,?), ref: 004533CA

Strings

OCP, xrefs: 00453347
ACP, xrefs: 00453311

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: b900ca414d4c4be95a8c6f041d08249478f894891a183a2f82a4edaf5765dc51
Instruction ID: 0023b8279c9b3e3643c8ce07df61025d6c2b7e12d2ffc4f7461f6cfcb2a1a3ae
Opcode Fuzzy Hash: b900ca414d4c4be95a8c6f041d08249478f894891a183a2f82a4edaf5765dc51
Instruction Fuzzy Hash: 8021C432600100A7DB308F54C900A9BB3A6AF50FD3B568466EC06D7312EF36EF49D358

Function 0043C960 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 333d4b6d5425d6f9d03797ee82114c3711da98524c03317fffdb5ec62fb2b380
Instruction ID: 01dad5c531b3804b6668612822d9feb5b6f7af541a2af8c3bc89036eeee974e8
Opcode Fuzzy Hash: 333d4b6d5425d6f9d03797ee82114c3711da98524c03317fffdb5ec62fb2b380
Instruction Fuzzy Hash: DA023A71E002199BDF14CFA9D9C06AEFBB1FF48314F24926AE919B7380D735A9418B94

Function 0043361D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00433077,?,?,?,?,004C7E2F), ref: 00433655
GetSystemTimeAsFileTime.KERNEL32(?,DDE7F8A2,00000000,?,00551382,000000FF,?,00433077,?,?,?,?,004C7E2F), ref: 00433659

Strings

`-@, xrefs: 0043364F

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID: `-@
API String ID: 743729956-3781167437
Opcode ID: a70e229828252f114f3dcb939b169fb3f53d7191ad82fa45b454faadf805d98c
Instruction ID: 3e04e591088ee8cc2650925c1d28f2227fba881fd4e87dc1a7d03300bd93dc66
Opcode Fuzzy Hash: a70e229828252f114f3dcb939b169fb3f53d7191ad82fa45b454faadf805d98c
Instruction Fuzzy Hash: 73F0A032904A54EFCB118F44DC11B59BBA8F708B21F004626EC12A3790DB34A9049F94

Function 00452F77 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00449E42: GetLastError.KERNEL32(00000000,?,0044F82B), ref: 00449E46
Part of subcall function 00449E42: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 00449EE8

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452FCB
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00453015
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004530DB

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: f5cfd2435bfc6126f1a27ca0e302e8257e218aad689c2380b82d9cb027d6b9a4
Instruction ID: 48740d242bba4bd8a9c349c0ec2c6d2d1cd0f344531baebb5e7d544be35332ed
Opcode Fuzzy Hash: f5cfd2435bfc6126f1a27ca0e302e8257e218aad689c2380b82d9cb027d6b9a4
Instruction Fuzzy Hash: 4661C2315006079FEB249F25CC82BABB7A8EF04787F10417AED05C6686EB7CDA49CB54

Function 00438A64 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00438B5C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00438B66
UnhandledExceptionFilter.KERNEL32(?), ref: 00438B73

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 190c57a89f893cc3a60c21e64f5d89c3dc83bf777de16abb744d2c180980a4ce
Instruction ID: 8ec399b23226fa191ec5ef1820ea8a0bb8d05e2da4fe9e987d2f7c16b8c22cf0
Opcode Fuzzy Hash: 190c57a89f893cc3a60c21e64f5d89c3dc83bf777de16abb744d2c180980a4ce
Instruction Fuzzy Hash: 8331D4759013189BCB21DF65D8897CDBBB8BF08310F5051EAF81CA7251EB749B858F48

Function 00431F9C Relevance: 4.5, APIs: 3, Instructions: 35COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(000000FF,?,0041D027,?,?,?,00424721), ref: 00431FA8
FindFirstFileExW.KERNEL32(000000FF,00000001,?,00000000,00000000,00000000,?,?,?,0041D027,?,?,?,00424721), ref: 00431FD7
GetLastError.KERNEL32(?,0041D027,?,?,?,00424721), ref: 00431FE9

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: Find$CloseErrorFileFirstLast
String ID:
API String ID: 4020440971-0
Opcode ID: b16ae3ed5c4ea8c825a7741cabbb9deee3b3ed014939fe7a26025e30d09a83a3
Instruction ID: 374c7283d1fee54890fd1da0f93e4c1b7d6ed331c4205a5270736a92a01d96fc
Opcode Fuzzy Hash: b16ae3ed5c4ea8c825a7741cabbb9deee3b3ed014939fe7a26025e30d09a83a3
Instruction Fuzzy Hash: D9F08232000208BFDB206FB5DC08DBA7BADEB18371F108626FD68C16B0D731D9A596B5

Function 0044B734 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,?,?,?,?,00447E76,?,20001004,?,00000002,?,?,00447468), ref: 0044B768

Strings

`-@, xrefs: 0044B753

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: InfoLocale
String ID: `-@
API String ID: 2299586839-3781167437
Opcode ID: 49b4b54da173fcca6da5c5c7afb6aecc463d0371a21e889a3031e465fe0a4c2b
Instruction ID: 6cde8863e94abc83afdff9d02dc43b85bf30edba8fd47250f688fa8aae92868b
Opcode Fuzzy Hash: 49b4b54da173fcca6da5c5c7afb6aecc463d0371a21e889a3031e465fe0a4c2b
Instruction Fuzzy Hash: 65E04F36500218BBEF223F61EC05EAE7F26EF447A2F008416FD0565271CB75C921BAE9

Function 0044DA86 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0044DA81,?,?,?,?,?,?,00000000), ref: 0044DCB3

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: c4b844f4748ab43110d9ddc2113bf4f3516c88aed4eb779ad480f52b638fb61b
Instruction ID: a9cfdaf791ee03315f30e706cc2315f363a0b4456a4e08294abae47f684f0219
Opcode Fuzzy Hash: c4b844f4748ab43110d9ddc2113bf4f3516c88aed4eb779ad480f52b638fb61b
Instruction Fuzzy Hash: ECB15171910608DFE715CF28C48AB557BE0FF45364F25865AE899CF3A1C339E992CB44

Function 004531CA Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00449E42: GetLastError.KERNEL32(00000000,?,0044F82B), ref: 00449E46
Part of subcall function 00449E42: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 00449EE8

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0045321E

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: ce8f16c0568beb61190bd24bea5fc54c05911f28a5d336557b2a67b9f4554f6f
Instruction ID: c68ba993faf54d01c6f16d81f3f5077507b086e8cfab0080940638b83f1b5490
Opcode Fuzzy Hash: ce8f16c0568beb61190bd24bea5fc54c05911f28a5d336557b2a67b9f4554f6f
Instruction Fuzzy Hash: 8D219872514606ABDB189E25DC42A7BB3A8EF04756F1000BFFD01D6242EB7CDE489758

Function 00452E51 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00449E42: GetLastError.KERNEL32(00000000,?,0044F82B), ref: 00449E46
Part of subcall function 00449E42: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 00449EE8

EnumSystemLocalesW.KERNEL32(00452F77,00000001,00000000,?,?,?,004535AB,?), ref: 00452EC3

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: ed3a15461aa07a0672f4d58e186f542e4a9ded439744096cd7c499f36c17fdd7
Instruction ID: 0b970845e1a8773270f0425e193d970e9e25a52c90aa89fa5165c8154eb0a54b
Opcode Fuzzy Hash: ed3a15461aa07a0672f4d58e186f542e4a9ded439744096cd7c499f36c17fdd7
Instruction Fuzzy Hash: 8B11593B2007014FDB189F39D99267BB7A1FF84319B14442EED8687B41D3B5B806DB44

Function 004533F9 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00449E42: GetLastError.KERNEL32(00000000,?,0044F82B), ref: 00449E46
Part of subcall function 00449E42: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 00449EE8

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00453193,00000000,00000000,?), ref: 00453425

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 9fb8eb4d6cfb5dc9ab71851ad247751131481363ade4371d576ad0b9e7960359
Instruction ID: 7310505bafe8fff12ee8f5912ce4e44c5146d6de948bcf0b33cac505e4352342
Opcode Fuzzy Hash: 9fb8eb4d6cfb5dc9ab71851ad247751131481363ade4371d576ad0b9e7960359
Instruction Fuzzy Hash: 72014E336002127BDB195E25CC45BBB7764DB41797F14442AEC06A3281DA78FE45D994

Function 00452D5F Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00449E42: GetLastError.KERNEL32(00000000,?,0044F82B), ref: 00449E46
Part of subcall function 00449E42: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 00449EE8

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 00452DB3

Strings

utf8, xrefs: 00452D22
*V, xrefs: 00452B98

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: *V$utf8
API String ID: 3736152602-210452255
Opcode ID: 59e00f747d9bc6cf307ab543fe27e9585fa5185e009a5a777542dc83f29e6ce8
Instruction ID: aeef1e48df53c0e1e1989da3d76282249285fc4edbaa792ed956cb55b8cc0ce8
Opcode Fuzzy Hash: 59e00f747d9bc6cf307ab543fe27e9585fa5185e009a5a777542dc83f29e6ce8
Instruction Fuzzy Hash: E3F0C832610205ABD714AF35DC4AEBB73A8DB59316F10017FF902D7282EA7CAD099768

Function 00452EEC Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00449E42: GetLastError.KERNEL32(00000000,?,0044F82B), ref: 00449E46
Part of subcall function 00449E42: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 00449EE8

EnumSystemLocalesW.KERNEL32(004531CA,00000001,?,?,?,?,00453573,?,?,?,?), ref: 00452F36

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: a7aabdafeecc33135d5ef59119c1dd02303f614df75aa08249f401847eac2aa8
Instruction ID: 46f5077cb0f7882f4a3a694ed1b059b17750918d15d6876221f24d4c3ab0ea03
Opcode Fuzzy Hash: a7aabdafeecc33135d5ef59119c1dd02303f614df75aa08249f401847eac2aa8
Instruction Fuzzy Hash: 38F022372003045FDB249F35AC81A7B7BA1FB82769B15842FFE068B692C2B59C02A654

Function 0044B1B1 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0044424B: RtlEnterCriticalSection.NTDLL(-00588967), ref: 0044425A

EnumSystemLocalesW.KERNEL32(0044B1A4,00000001,0057A298,0000000C,0044B5D9,?,?,?,?), ref: 0044B1E9

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: c95449866fe5fa4667aabee73304f47e4942a34859e8fff04667a9b00fb14092
Instruction ID: e80e171ad64c81d089edaf6c836f83e2cf4dda05f2f2c126e8d7e53f9a4c0b50
Opcode Fuzzy Hash: c95449866fe5fa4667aabee73304f47e4942a34859e8fff04667a9b00fb14092
Instruction Fuzzy Hash: F3F04F76A00200DFE700DF99E806B9C7BF0FB59B25F10819BF810E7290DBB999049F45

Function 00452E06 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00449E42: GetLastError.KERNEL32(00000000,?,0044F82B), ref: 00449E46
Part of subcall function 00449E42: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 00449EE8

EnumSystemLocalesW.KERNEL32(00452D5F,00000001,?,?,?,004535CD,?,?,?,?), ref: 00452E3D

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 5ffb0c9d813d6eba6d8fd2e10c847f2c312efa30acac4b18343fb8da06ef6d7e
Instruction ID: fee7300587f55c0c421301d99721cdf1a1ff6f595eefe83fa7d5e966eb6188b0
Opcode Fuzzy Hash: 5ffb0c9d813d6eba6d8fd2e10c847f2c312efa30acac4b18343fb8da06ef6d7e
Instruction Fuzzy Hash: 8FF0553A30020557CB04AF35D80666BBFA0EFC2711B06405BEE09CB392C2B99846DB94

Function 004F2FD0 Relevance: .7, Instructions: 735COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b4a0174d0d62f2b1227807bd6e07e9c018e82f5f56551d9681256b3b92353b2
Instruction ID: 68aa0d5ee95f80c7a91d8174e86b503e14c67071ff11744bcabbed3cfa87bcc2
Opcode Fuzzy Hash: 4b4a0174d0d62f2b1227807bd6e07e9c018e82f5f56551d9681256b3b92353b2
Instruction Fuzzy Hash: F96270B0D002599FDB14CF59C5846BEBBB1BF84308F2481AEDA14AB346C779DA46CF94

Function 0042F580 Relevance: .4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80b9970b4e61b3a89387c81d03852b8640c12f30169ca405eadcc1892538b820
Instruction ID: 0e8ddfc969875e3dd00111f91a6503ca4c3a70c52638cfea05a5ef0fdf848abd
Opcode Fuzzy Hash: 80b9970b4e61b3a89387c81d03852b8640c12f30169ca405eadcc1892538b820
Instruction Fuzzy Hash: 1EE10276F1022A9FDB05CFA8D4816ADFBF1AF88320B5942AAD814B7340D774A945CB94

Function 0044036F Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a41b321b0bedac8989d8c8297ce8e3211a7e70ffbcb0090baa5e3f65be106bda
Instruction ID: 86fdf0966577921a64d033a0687854855d7760d31b02c963075edfb0c817f6d8
Opcode Fuzzy Hash: a41b321b0bedac8989d8c8297ce8e3211a7e70ffbcb0090baa5e3f65be106bda
Instruction Fuzzy Hash: 45C1DA709006069FEB24CF68C484A6BBBB1EF45304F14461FDB969B791C338ED66CB5A

Function 00452610 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 337bf9b0213a408d992dbd779b211f999c4c3a8d278f465cc99103b402b18e84
Instruction ID: 7c06e8313ae742015ce167e0291709e23a9c2e608a4b019449313ff3a09dc83f
Opcode Fuzzy Hash: 337bf9b0213a408d992dbd779b211f999c4c3a8d278f465cc99103b402b18e84
Instruction Fuzzy Hash: 21B129315007019BDB38EB65CD82AB7B3A8EF45309F14452FED43C6642EBB9E989C718

Function 00458BB0 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31304fda07eb44754811e6465f7945cd712cae6a90f07cbe7a52602e90953672
Instruction ID: f297913e25a3591813c030fa515b242fba5e7fe6b87ce0d9dc90972f2508a2cf
Opcode Fuzzy Hash: 31304fda07eb44754811e6465f7945cd712cae6a90f07cbe7a52602e90953672
Instruction Fuzzy Hash: 0281FDB4A002469FDB118F69D8817BEFBF4AB2A315F04016EDC55A7383CB38990DD7A4

Function 004EFC40 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d9e1b96ebeb8905ce8cf41e2ed65b6f129fd888b54bee42289f6865976a0455
Instruction ID: 9260139a4ef8e20400bb9b6c572cac56afe306f3fbbdb3538d7680a8b6287584
Opcode Fuzzy Hash: 5d9e1b96ebeb8905ce8cf41e2ed65b6f129fd888b54bee42289f6865976a0455
Instruction Fuzzy Hash: 506195356345684FE708CF1EECD04363B52A39E30538542AAEA81C7395C576FA2EE7E0

Function 0043A928 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46680d0314554fd398ed7fd020ff60bee8df1d437ae882661bd78aeb1168d151
Instruction ID: 0bb0d4fe57c201db2c152aeff89cf209e4ab217caaafa113e802d716cdce1c0b
Opcode Fuzzy Hash: 46680d0314554fd398ed7fd020ff60bee8df1d437ae882661bd78aeb1168d151
Instruction Fuzzy Hash: 5B517D72D00219AFDF04CF99C940AEFBBB6FF88314F198459E955AB301D7389A50CB95

Function 004371A0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 4ba24db855cab2182e42f47a77fd888252c09f86d43135b4b8e5651c7dd79236
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: B21131F724D08143EA74863DC8B46BBA795EBCD320F2D63BBE0C14BB58D52AD5459908

Function 004579E3 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlDecodePointer.NTDLL(?), ref: 004579FC

Strings

log10, xrefs: 00457A3E, 00457A4D
log, xrefs: 00457A59, 00457A68
sqrt, xrefs: 00457B3B
asin, xrefs: 00457B29
exp, xrefs: 00457A7B, 00457AE0
`-@, xrefs: 00457AC6, 00457B70, 00457BB6
pow, xrefs: 00457A9A, 00457B44, 00457B91
acos, xrefs: 00457B32

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: DecodePointer
String ID: `-@$acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3628989360
Opcode ID: 4c17630f5161de399ffce6b570c60365a2c89c55b52a7f760b39540bf94f5387
Instruction ID: bbf143f63b3841ec77cfacb8c6df481a799db6acf17f433172942b25d65e7ef2
Opcode Fuzzy Hash: 4c17630f5161de399ffce6b570c60365a2c89c55b52a7f760b39540bf94f5387
Instruction Fuzzy Hash: 1651B370808A0ACBCF109F58F84C1BEBFB1FB05309F154166D851A7266C7799A2DCB4D

Function 0041A060 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0041A09D
std::_Lockit::_Lockit.LIBCPMT ref: 0041A0BF
std::_Lockit::~_Lockit.LIBCPMT ref: 0041A0E7
__Getctype.LIBCPMT ref: 0041A1C5
std::_Facet_Register.LIBCPMT ref: 0041A1F9
std::_Lockit::~_Lockit.LIBCPMT ref: 0041A223

Strings

PG@, xrefs: 0041A1BF
E@, xrefs: 0041A1AE
PD@, xrefs: 0041A19A

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID: PD@$PG@$E@
API String ID: 1102183713-4120405683
Opcode ID: 495f4126c8959cda1dad90c343e93fba20469dde2e2043d742b69906c970156d
Instruction ID: b372b58ab1bb25eec4b44a09b7f8f3aef2cc67a410616163416d5e42c3dffe19
Opcode Fuzzy Hash: 495f4126c8959cda1dad90c343e93fba20469dde2e2043d742b69906c970156d
Instruction Fuzzy Hash: 6E51BAB0D01245DFCB11CF98C9457AEBBF0FB14714F14825ED855AB391DB78AA88CB92

Function 004372D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00437307
___except_validate_context_record.LIBVCRUNTIME ref: 0043730F
_ValidateLocalCookies.LIBCMT ref: 00437398
__IsNonwritableInCurrentImage.LIBCMT ref: 004373C3
_ValidateLocalCookies.LIBCMT ref: 00437418

Strings

csm, xrefs: 004373AD
`-@, xrefs: 004373DC

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: `-@$csm
API String ID: 1170836740-3738301566
Opcode ID: a837c65dc98bc53f7a591b5dada66322cfdf011b0ab20b220170fbbfaeea83fd
Instruction ID: bde692452db8eba3752ab90a3e7788ac0719a0bf92b2230e47b89eff8dfd02fd
Opcode Fuzzy Hash: a837c65dc98bc53f7a591b5dada66322cfdf011b0ab20b220170fbbfaeea83fd
Instruction Fuzzy Hash: B041F8709042099FCF20DF59C885A9FBBA4BF08328F14905BFC54AB392D739E905DB95

Function 0041C430 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0041C45A
std::_Lockit::_Lockit.LIBCPMT ref: 0041C47C
std::_Lockit::~_Lockit.LIBCPMT ref: 0041C4A4
std::_Facet_Register.LIBCPMT ref: 0041C59A
std::_Lockit::~_Lockit.LIBCPMT ref: 0041C5C4

Strings

E@, xrefs: 0041C562
PD@, xrefs: 0041C54E

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: E@$PD@
API String ID: 459529453-4103272508
Opcode ID: fb94b052f71f665722219136562a8730e5ed9d67761b2a33bc821d4977d05291
Instruction ID: e4bc83ced0ac359faa997fd18d4eeb760fe14de2594101695cc0fd15b6690fbc
Opcode Fuzzy Hash: fb94b052f71f665722219136562a8730e5ed9d67761b2a33bc821d4977d05291
Instruction Fuzzy Hash: C351EFB0900255EFDB11CF58C991BAEBBF0FB10314F24415EE846AB381D7B9AA45CB95

Function 0044BB66 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0044BBEC

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 785c90e8ff89e0f1a3d98e37725974d6f6ea20f06d45e48120c47f1ca5a82ffe
Instruction ID: d7b9d7273cbfac5d15a556f8c8651b9033d93685d5a38535419dded3191b9e75
Opcode Fuzzy Hash: 785c90e8ff89e0f1a3d98e37725974d6f6ea20f06d45e48120c47f1ca5a82ffe
Instruction Fuzzy Hash: D5B14672D006559FEB158F24CC81BEBBBA5EF59310F2441ABE904AB382D778D901C7E9

Function 0044B37E Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,0044B48D,?,?,00000000,00000001,?,?,0044B6B7,00000022,FlsSetValue,00561B88,00561B90,00000001), ref: 0044B43F

Strings

ext-ms-, xrefs: 0044B3E9
api-ms-, xrefs: 0044B3D5

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 033630484f002e070c94113c7b6ef7f262f68e90d70309fdd043a749aa00ed93
Instruction ID: e3d7dbf8d3e43151f67a2d3675c4fcd7809fc0c9af6198dcb17880ded4e1cd5b
Opcode Fuzzy Hash: 033630484f002e070c94113c7b6ef7f262f68e90d70309fdd043a749aa00ed93
Instruction Fuzzy Hash: A2212B36A01220A7E7319F619C45A6B7768EB51761F140112FC06A7392D734ED05D6D9

Function 00443633 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,DDE7F8A2,?,?,00000000,00551365,000000FF,?,0044360F,?,?,004435E3,00000016), ref: 00443668
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0044367A
FreeLibrary.KERNEL32(00000000,?,00000000,00551365,000000FF,?,0044360F,?,?,004435E3,00000016), ref: 0044369C

Strings

mscoree.dll, xrefs: 00443661
`-@, xrefs: 0044368B
CorExitProcess, xrefs: 00443672

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$`-@$mscoree.dll
API String ID: 4061214504-3731901874
Opcode ID: 66c557226bdf84cfe892202a4e2d9d598a1facfa92736b92f61228ad13b2a6bb
Instruction ID: 11f561727bfec435161e86ab51d2faaed74d5e09c0b89d0474703e999051cdf2
Opcode Fuzzy Hash: 66c557226bdf84cfe892202a4e2d9d598a1facfa92736b92f61228ad13b2a6bb
Instruction Fuzzy Hash: 5601A232A44715AFDB219F44DC19BAFBBB8FB14B52F014526E812E27E0DB749A04CA94

Function 00432729 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00432730
std::_Lockit::_Lockit.LIBCPMT ref: 0043273B
std::_Lockit::~_Lockit.LIBCPMT ref: 004327A9

Part of subcall function 0043288C: std::locale::_Locimp::_Locimp.LIBCPMT ref: 004328A4

std::locale::_Setgloballocale.LIBCPMT ref: 00432756

Strings

`-@, xrefs: 00432778, 0043279C

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_Setgloballocale
String ID: `-@
API String ID: 677527491-3781167437
Opcode ID: 8a5613631ec3d916f95b396eb7cc43f12c5d676d84142dd5ef1a29976cc47206
Instruction ID: 335728d06f8999c9367bb6f0cb93ad347570f0e44e9dcbef2930aaa8ccdcd417
Opcode Fuzzy Hash: 8a5613631ec3d916f95b396eb7cc43f12c5d676d84142dd5ef1a29976cc47206
Instruction Fuzzy Hash: 9D01FC35A006109BC70AFB20CC5157D7BB0FF98790F44250EE81163391CFB8AE06DB89

Function 00432BC8 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00432BDC
RtlAcquireSRWLockExclusive.NTDLL(00000008), ref: 00432BFB
RtlAcquireSRWLockExclusive.NTDLL(00000008), ref: 00432C29
RtlTryAcquireSRWLockExclusive.NTDLL(00000008), ref: 00432C84
RtlTryAcquireSRWLockExclusive.NTDLL(00000008), ref: 00432C9B

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 8f089e7040faa662b45679f060ee1b8a0f0adfff173fd46cb89089840a213128
Instruction ID: ee0d2db44a198d3d02c1eb3b1b0ff5a364ec90963e300245c4d31640e9e12550
Opcode Fuzzy Hash: 8f089e7040faa662b45679f060ee1b8a0f0adfff173fd46cb89089840a213128
Instruction Fuzzy Hash: B2415931900A0ADFCB20DF65CA8096EB3B4FF0C311F20692BD446D7650D7B8E986DB69

Function 00407350 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 158COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 0040750C
___std_exception_destroy.LIBVCRUNTIME ref: 00407522

Strings

[json.exception., xrefs: 004073A1
)@, xrefs: 00407502, 0040751C

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: )@$[json.exception.
API String ID: 4194217158-3378332251
Opcode ID: 74f1ced649a80f54c74698f2e3f1ef80366f2fbaef409b1663f26043a5eac72a
Instruction ID: d1fd1ad00dbeab1566b73d8112c34bc80c76f551163e59ed82d928a5322bc1a2
Opcode Fuzzy Hash: 74f1ced649a80f54c74698f2e3f1ef80366f2fbaef409b1663f26043a5eac72a
Instruction Fuzzy Hash: 8C51CFB1C046489BD710DFA8C905B9EBBB4FF15318F14426EE850A73C2E7B86A44C7A5

Function 00404900 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0040499F

Part of subcall function 004351FB: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,74D723A0,?,00431D09,?,005799D8,74D723A0,?,74D723A0,-00589880), ref: 0043525B

Strings

ios_base::eofbit set, xrefs: 00404946
ios_base::badbit set, xrefs: 00404937, 00404962
ios_base::failbit set, xrefs: 00404828, 00404941

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: ExceptionIos_base_dtorRaisestd::ios_base::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1903096808-1866435925
Opcode ID: 5e8fcf04681b5496c91e096f1d273a5343178b8940b0c322b64de4dd1df32f3c
Instruction ID: 99c94d1e80f512c720ba00148ae48faeb0acee82eabb402b7e5943aa58dcc262
Opcode Fuzzy Hash: 5e8fcf04681b5496c91e096f1d273a5343178b8940b0c322b64de4dd1df32f3c
Instruction Fuzzy Hash: AC119CF2844644ABCB10DF688C03BAB37C8E744715F04463EFE58972C1EB399800C79A

Function 00448E9F Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(DDE7F8A2,00000000,00000000,?), ref: 00448F02

Part of subcall function 0044EC55: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0044A862,?,00000000,-00000008), ref: 0044ECB6

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00449154
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0044919A
GetLastError.KERNEL32 ref: 0044923D

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: d46c0870a8277536d77cd1fa32924c999241811f2f15ebdbc3735bbe4b8907ba
Instruction ID: b6f9ea87837ca93654473fd2bae4ec290e60b55bc3ade45d2d9d29a5185f0d60
Opcode Fuzzy Hash: d46c0870a8277536d77cd1fa32924c999241811f2f15ebdbc3735bbe4b8907ba
Instruction Fuzzy Hash: 70D1BC75D00249AFDF14CFA8C880AAEBBB5FF09304F28456AE856EB351D734AD45CB54

Function 00456D32 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,00000000,?,?,00453DCE,?,00000001,?,?,?,00449291,?,00000000,00000000), ref: 00456D49
GetLastError.KERNEL32(?,00453DCE,?,00000001,?,?,?,00449291,?,00000000,00000000,?,?,?,0044986B,?), ref: 00456D55

Part of subcall function 00456D1B: CloseHandle.KERNEL32(FFFFFFFE,00456D65,?,00453DCE,?,00000001,?,?,?,00449291,?,00000000,00000000,?,?), ref: 00456D2B

___initconout.LIBCMT ref: 00456D65

Part of subcall function 00456CDD: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00456D0C,00453DBB,?,?,00449291,?,00000000,00000000,?), ref: 00456CF0

WriteConsoleW.KERNEL32(?,?,?,00000000,?,00453DCE,?,00000001,?,?,?,00449291,?,00000000,00000000,?), ref: 00456D7A

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 6d252f6c85546040703605b5d122fbb434f3c9b6b34be8e7cd3f73b3df330617
Instruction ID: b582005f90f2c4d159ccd48a3422ceca8e6e351b7b3b67145bbef734a6de3f3c
Opcode Fuzzy Hash: 6d252f6c85546040703605b5d122fbb434f3c9b6b34be8e7cd3f73b3df330617
Instruction Fuzzy Hash: F4F01C37500518BBCF221FD1DC18A8A3F76EB583A2B814415FE0D96231D6328928EB94

Function 004036E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 178COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00403819
___std_exception_destroy.LIBVCRUNTIME ref: 004038F0

Strings

)@, xrefs: 004037ED, 004038EA

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: )@
API String ID: 2970364248-4120265097
Opcode ID: ed1ac0f14267c2b8626e9d784d9228836504f476972db074cc70cf608e0aac1a
Instruction ID: 269ef50febfdc4b1c22cf7239a576f40f0b19685bcb009e1facc48eb6157c32a
Opcode Fuzzy Hash: ed1ac0f14267c2b8626e9d784d9228836504f476972db074cc70cf608e0aac1a
Instruction Fuzzy Hash: DD6169B1C00248DBDB10DF98C945B9EFFB5FF19324F14825EE814AB282D7B95A44CBA5

Function 004047F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 153COMMONLIBRARYCODE

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0040499F

Part of subcall function 004351FB: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,74D723A0,?,00431D09,?,005799D8,74D723A0,?,74D723A0,-00589880), ref: 0043525B

Strings

ios_base::badbit set, xrefs: 00404937, 00404962
ios_base::failbit set, xrefs: 00404828

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: ExceptionIos_base_dtorRaisestd::ios_base::_
String ID: ios_base::badbit set$ios_base::failbit set
API String ID: 1903096808-1240500531
Opcode ID: 8193a8ffeaccef37eb783ff7fe0bdc902a64c2974526b8af49cedd0c2b6b92ef
Instruction ID: 59789774a96eacd1a5b8f49c51d8e497543063f0a2ed12b155596828dbf76f3a
Opcode Fuzzy Hash: 8193a8ffeaccef37eb783ff7fe0bdc902a64c2974526b8af49cedd0c2b6b92ef
Instruction Fuzzy Hash: E84124B2C00244ABCB04DF68C845BAEBBB8FB49710F14826EF554A73C1D7795A00CBA5

Function 00404040 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00404061
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 004040C4

Strings

bad locale name, xrefs: 004040E6

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 0039d2d2ea2786ef81fe116e8b864d57793cf36a19fa060d6cb0c255b1586cee
Instruction ID: 65c2995a4cce64452fc0e082f9126f7f9302ed92d60cad1113ce5137d9e79936
Opcode Fuzzy Hash: 0039d2d2ea2786ef81fe116e8b864d57793cf36a19fa060d6cb0c255b1586cee
Instruction Fuzzy Hash: DB112670805B84EED321CF69C50474BBFF0AF25714F10868DD09597781D3B9A604CB95

Function 00416590 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004165C9
___std_exception_copy.LIBVCRUNTIME ref: 004165FC

Strings

)@, xrefs: 004165BA, 004165ED

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: ___std_exception_copy
String ID: )@
API String ID: 2659868963-4120265097
Opcode ID: ec459901e9a8c12f2536e06f4ce64afd8286d8aca2aa337d2d7da09c98386d96
Instruction ID: 79ebb971947c26e29da123751e765caa72f3f100f47198c89106861aa63fe252
Opcode Fuzzy Hash: ec459901e9a8c12f2536e06f4ce64afd8286d8aca2aa337d2d7da09c98386d96
Instruction Fuzzy Hash: F0112EB6910649EBCB11CF99C980B86FBF8FF09724F10876AE82497641E774A5448BA0

Function 00407A20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00407A5C
___std_exception_destroy.LIBVCRUNTIME ref: 00407A72

Strings

)@, xrefs: 00407A52, 00407A6C

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: )@
API String ID: 4194217158-4120265097
Opcode ID: 9ee8fa866bcea9d2c14fc14309fcadf8facde4318e0e6bb098ed358a1a235593
Instruction ID: 96290d15a7b89a27e7413382239de33ac52fdad5c525fa7f0e86a9c1871ea130
Opcode Fuzzy Hash: 9ee8fa866bcea9d2c14fc14309fcadf8facde4318e0e6bb098ed358a1a235593
Instruction Fuzzy Hash: 68F012B1805744DFC711DF98C90178DFFF8FB05728F50466AE855A3780E7B5660487A5

Function 0044B7F4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00000016,00000001,004389D2,00000001,00000016,00438BE1,?,?,?,?,?,00000000), ref: 0044B834

Strings

InitializeCriticalSectionEx, xrefs: 0044B804
`-@, xrefs: 0044B824

Memory Dump Source

Source File: 00000000.00000002.3251223374.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3251198319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251486483.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251516517.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251547415.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000733000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000737000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.0000000000786000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3251591537.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253399308.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AlCsIOd0pd.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$`-@
API String ID: 2593887523-3269949891
Opcode ID: 1f2253b5c78e33ee57fe7f30907939316c5faef6f9275bf3e632fad4f43c2f0e
Instruction ID: 5bcc12c1b0658f8dc7434a33690804c70bb56e7eadbb0958c8ec10a8e9d05d13
Opcode Fuzzy Hash: 1f2253b5c78e33ee57fe7f30907939316c5faef6f9275bf3e632fad4f43c2f0e
Instruction Fuzzy Hash: BDE09236581318BBCB212F92DC06DAE7F25EB24BA2F048022FD1956161C7768821BBD9

Analysis Process: MPGPH131.exePID: 5644, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	4.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	2000
Total number of Limit Nodes:	34

Executed Functions

Function 004C7B00 Relevance: 18.3, APIs: 12, Instructions: 279
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000338,0000FFFF,00001006,?,00000008), ref: 004C7BA6
recv.WS2_32(?,00000004,00000002), ref: 004C7BC1
WSAGetLastError.WS2_32 ref: 004C7BC5
recv.WS2_32(00000000,0000000C,00000002,00000000), ref: 004C7C43
recv.WS2_32(00000000,0000000C,00000008), ref: 004C7C64
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?), ref: 004C7D00
recv.WS2_32(00000000,?,00000008), ref: 004C7D1B

Part of subcall function 004C8590: WSAStartup.WS2_32 ref: 004C85BA
Part of subcall function 004C8590: getaddrinfo.WS2_32(?,?,?,00589328), ref: 004C863C
Part of subcall function 004C8590: socket.WS2_32(?,?,?), ref: 004C865D
Part of subcall function 004C8590: connect.WS2_32(00000000,00559BFC,?), ref: 004C8671
Part of subcall function 004C8590: closesocket.WS2_32(00000000), ref: 004C867D
Part of subcall function 004C8590: FreeAddrInfoW.WS2_32(?), ref: 004C868A
Part of subcall function 004C8590: WSACleanup.WS2_32 ref: 004C8690

recv.WS2_32(?,00000004,00000008), ref: 004C7E23
__Xtime_get_ticks.LIBCPMT ref: 004C7E2A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004C7E38
Sleep.KERNELBASE(00000001,00000000,?,00002710,00000000), ref: 004C7EB1
Sleep.KERNELBASE(00000064,?,00002710,00000000), ref: 004C7EB9

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID: recv$Sleepsetsockopt$AddrCleanupErrorFreeInfoLastStartupUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@closesocketconnectgetaddrinfosocket
String ID:
API String ID: 3089209366-0
Opcode ID: deda763b8fb6066c72b20903b58187ae793f723e7b47fea433c0891846b4f81f
Instruction ID: b3d54dcccad81d83ab75f13ba9899d4b50e1d8608cabcccfb3508871926cac68
Opcode Fuzzy Hash: deda763b8fb6066c72b20903b58187ae793f723e7b47fea433c0891846b4f81f
Instruction Fuzzy Hash: 9EB1AC71D043089BEB10DBA8CC49BAEBBB1BB54314F24025EE815BB2D2D7785D88DF95

Function 004C8590 Relevance: 12.1, APIs: 8, Instructions: 92
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 004C85BA
getaddrinfo.WS2_32(?,?,?,00589328), ref: 004C863C
socket.WS2_32(?,?,?), ref: 004C865D
connect.WS2_32(00000000,00559BFC,?), ref: 004C8671
closesocket.WS2_32(00000000), ref: 004C867D
FreeAddrInfoW.WS2_32(?), ref: 004C868A
WSACleanup.WS2_32 ref: 004C8690
FreeAddrInfoW.WS2_32(?), ref: 004C86A5

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID: AddrFreeInfo$CleanupStartupclosesocketconnectgetaddrinfosocket
String ID:
API String ID: 448659506-0
Opcode ID: 52d29ec15fbf37ccd53ab56e21f2e3f1d11727fcf2b6a4206c2cbc59116a4c78
Instruction ID: ffa07009e3086412046aa5b15573dbd5c691e56a3beb11943292ef2f0f62f1de
Opcode Fuzzy Hash: 52d29ec15fbf37ccd53ab56e21f2e3f1d11727fcf2b6a4206c2cbc59116a4c78
Instruction Fuzzy Hash: 9531C1726043009BD7208F25DC48B2BB7E5FB94729F114B1EF9A4922E0D7759C089AA7

Function 00409280 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll,?,?,?,?,0054D15C,00000000,74D723A0,-00589880), ref: 004096A6
GetProcAddress.KERNEL32(00000000,?), ref: 004096B4
WSASend.WS2_32(?,?,00000001,00000000,00000000,00000000,00000000,?,?,?,?,0054D15C,00000000,74D723A0,-00589880), ref: 004096C9

Strings

Ws2_32.dll, xrefs: 0040969A

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID: AddressHandleModuleProcSend
String ID: Ws2_32.dll
API String ID: 2819740048-3093949381
Opcode ID: d946741ea927b9b060335f299eec8efad25939578b4ebaaa967d5c79e73c84d4
Instruction ID: 188670ed5cfc709ed037a390f66f33add7af100e18449b0941b00ad524943a05
Opcode Fuzzy Hash: d946741ea927b9b060335f299eec8efad25939578b4ebaaa967d5c79e73c84d4
Instruction Fuzzy Hash: 7C02CE70D04298DEDF25CFA4C8907ADBBB0EF59304F24429EE4456B2C6D7781D86CB96

Function 00449789 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00448E9F: GetConsoleOutputCP.KERNEL32(DDA667AB,00000000,00000000,?), ref: 00448F02

WriteFile.KERNELBASE(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0044990E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?), ref: 00449918

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 2beaef352ff8862ad6b8b16251cd0bd229135013537871e9a6efb1225fc67aec
Instruction ID: 4c198159cf300fc4e9085a349e24ad4d45033eb13303bb4f9288eddf9455663d
Opcode Fuzzy Hash: 2beaef352ff8862ad6b8b16251cd0bd229135013537871e9a6efb1225fc67aec
Instruction Fuzzy Hash: 9961C5B1C14119BFEF11DFA8C844AAFBBB9AF49304F14014AE800A7316D739DD05EB65

Function 00448DFF Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,00448CE6,00000000,?,0057A178,0000000C,00448DA2,?,?,?), ref: 00448E55
GetLastError.KERNEL32(?,00448CE6,00000000,?,0057A178,0000000C,00448DA2,?,?,?), ref: 00448E5F

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 1fe827fdfe079599b9b1dab25e2b646f0beb01ea40d46a72429d261cc15a62e7
Instruction ID: bfed174018f4c3fae0b74bea86efe9ace0911028d3bee9629bfc5162a0057b67
Opcode Fuzzy Hash: 1fe827fdfe079599b9b1dab25e2b646f0beb01ea40d46a72429d261cc15a62e7
Instruction Fuzzy Hash: 6E1125336042102AF6252236A84677F67499B82738F39061FF918CB2D2DF689C81825D

Function 0044251C Relevance: 3.1, APIs: 2, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(00000000,?,?,?,?,?,00000000,?,?,?,00442626,?,?,?,?,?), ref: 00442558
GetLastError.KERNEL32(?,?,?,?,00442626,?,?,?,?,?,00000000,?,00000000), ref: 00442565

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 0df1753fdbe4f7a704092f8361e7cfb0c7cc0fcadc70f8748e4d2d33b1623b65
Instruction ID: bcffdd1dd92d970d4fbe8e398a8ab980657c5c2bf717c74f1f656664416c076e
Opcode Fuzzy Hash: 0df1753fdbe4f7a704092f8361e7cfb0c7cc0fcadc70f8748e4d2d33b1623b65
Instruction Fuzzy Hash: 9B012632610615BFDF158F69DC1699E3B29EB84334F240209F8019B2E1E6B5ED429BA4

Function 004032D0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0040331F

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 0fd589d96c9d07b1efa01aec19e4ff46bb0766daf2056f60d33bc81ca57302d3
Instruction ID: ac639495c118a2832fc09027b5ebf4fad0cef292c7be368858978faeea3118d5
Opcode Fuzzy Hash: 0fd589d96c9d07b1efa01aec19e4ff46bb0766daf2056f60d33bc81ca57302d3
Instruction Fuzzy Hash: 63F024321001009BCB246F61D4565EAB7ECDF28366B50083FFC8DD7292EB3EDA408788

Function 0044A65A Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000001), ref: 0044A69B

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 89032516e5b3e6299283371760f336f91a06b383302663fb1c071aa923d3998c
Instruction ID: 9689b7dccde3e7d2c1426315cc49502dff6dd5535dcc2f3da2dc3831567fdc71
Opcode Fuzzy Hash: 89032516e5b3e6299283371760f336f91a06b383302663fb1c071aa923d3998c
Instruction Fuzzy Hash: 4CF0E0311905246BFB216A66DC05B5B375CAF41760F1E8117EC84EB190CA3CDC3146EE

Function 0044B094 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000001,?), ref: 0044B0C6

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c639ae0624eff34eb8e57d07392fb4ffc7a0b3e65f726cef66c68c9318aea675
Instruction ID: 07eaf642519ac51a5bd3283dd2addbb445c80e248ae9cef49388ffb333b33e8c
Opcode Fuzzy Hash: c639ae0624eff34eb8e57d07392fb4ffc7a0b3e65f726cef66c68c9318aea675
Instruction Fuzzy Hash: 99E022322006206BFF313AA69C14B5B764CEF413A3F190227EC25A62D1DB3CCC0092EE

Non-executed Functions

Function 004CF280 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 240injectionmemorysynchronizationCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000040), ref: 004CF2F1
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004CF30D
WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 004CF342
VirtualAllocEx.KERNEL32(?,00000000,00001000,00003000,00000040), ref: 004CF36B
WriteProcessMemory.KERNEL32(?,00000000,?,00000218,00000000), ref: 004CF50F
WriteProcessMemory.KERNEL32(?,00000218,004CF5E0,-00000010,00000000), ref: 004CF531
CreateRemoteThread.KERNEL32(?,00000000,00000000,00000218,00000000,00000000,00000000), ref: 004CF544
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 004CF54D

Strings

131, xrefs: 004CF4D3, 004CF4E3
%s|%s, xrefs: 004CF4EF

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID: MemoryProcessWrite$AllocVirtual$CreateObjectRemoteSingleThreadWait
String ID: %s|%s$131
API String ID: 2137838514-1629954864
Opcode ID: b88fb1ed2ebfd2a655c4879da0ce9de7ec8f2c0603ef1b71525654192dd42d6d
Instruction ID: 2ab717f03d3c912496b66fb944616d360f792c6fe5d042a247d22025e7d5b78f
Opcode Fuzzy Hash: b88fb1ed2ebfd2a655c4879da0ce9de7ec8f2c0603ef1b71525654192dd42d6d
Instruction Fuzzy Hash: 36B16BB1D002089FDB14CFA4CC95BAEBBB5FF18300F10426DE905BB291D774A984DBA5

Function 004534CF Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00449E42: GetLastError.KERNEL32(00000000,?,0044F82B), ref: 00449E46
Part of subcall function 00449E42: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 00449EE8

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 004535D7
IsValidCodePage.KERNEL32(?), ref: 00453615
IsValidLocale.KERNEL32(?,00000001), ref: 00453628
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 00453670
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 0045368B

Strings

*V, xrefs: 00453534

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: *V
API String ID: 415426439-2897881622
Opcode ID: bb3ee8500ca9cacc625c50b97d6e48ff5c53ad3e39c4a6c01d9da358df15b7ae
Instruction ID: 4a54d826d8e8e5dc964d84ffa3ac1e49b68ae0fe58eca9cd8e7cd24ca5604c7d
Opcode Fuzzy Hash: bb3ee8500ca9cacc625c50b97d6e48ff5c53ad3e39c4a6c01d9da358df15b7ae
Instruction Fuzzy Hash: 4E517471A00209AFDB20DFA5CC41ABF77B8AF05743F14446AED01E7252EB74DA48DB65

Function 00452B5A Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00449E42: GetLastError.KERNEL32(00000000,?,0044F82B), ref: 00449E46
Part of subcall function 00449E42: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 00449EE8

GetACP.KERNEL32(?,?,?,?,?,?,00447300,?,?,?,?,?,-00000050,?,?,?), ref: 00452C19
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00447300,?,?,?,?,?,-00000050,?,?), ref: 00452C50
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 00452DB3

Strings

*V, xrefs: 00452B98
utf8, xrefs: 00452D22

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: *V$utf8
API String ID: 607553120-210452255
Opcode ID: 95727e6ef7b94787d777f99e21165c393144e5509e4be2ad3f52f8295ffa9360
Instruction ID: 742b11dcb7ff0b0bfa38c284345f0d68b4d7ce619a9ba0daefdf44cafbbca61f
Opcode Fuzzy Hash: 95727e6ef7b94787d777f99e21165c393144e5509e4be2ad3f52f8295ffa9360
Instruction Fuzzy Hash: F071FA32600602A6D725AF75CD45B6B73A8EF16705F10042FFD05D7283EBF8E94C9699

Function 004532F3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,00000000,?,?,?,00453605,?,?), ref: 0045338C
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,00000000,?,?,?,00453605,?,?), ref: 004533B5
GetACP.KERNEL32(?,?,00453605,?,?), ref: 004533CA

Strings

OCP, xrefs: 00453347
ACP, xrefs: 00453311

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: b900ca414d4c4be95a8c6f041d08249478f894891a183a2f82a4edaf5765dc51
Instruction ID: 0023b8279c9b3e3643c8ce07df61025d6c2b7e12d2ffc4f7461f6cfcb2a1a3ae
Opcode Fuzzy Hash: b900ca414d4c4be95a8c6f041d08249478f894891a183a2f82a4edaf5765dc51
Instruction Fuzzy Hash: 8021C432600100A7DB308F54C900A9BB3A6AF50FD3B568466EC06D7312EF36EF49D358

Function 0043C960 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 333d4b6d5425d6f9d03797ee82114c3711da98524c03317fffdb5ec62fb2b380
Instruction ID: 01dad5c531b3804b6668612822d9feb5b6f7af541a2af8c3bc89036eeee974e8
Opcode Fuzzy Hash: 333d4b6d5425d6f9d03797ee82114c3711da98524c03317fffdb5ec62fb2b380
Instruction Fuzzy Hash: DA023A71E002199BDF14CFA9D9C06AEFBB1FF48314F24926AE919B7380D735A9418B94

Function 004579E3 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlDecodePointer.NTDLL(?), ref: 004579FC

Strings

asin, xrefs: 00457B29
acos, xrefs: 00457B32
pow, xrefs: 00457A9A, 00457B44, 00457B91
log10, xrefs: 00457A3E, 00457A4D
sqrt, xrefs: 00457B3B
exp, xrefs: 00457A7B, 00457AE0
`-@, xrefs: 00457AC6, 00457B70, 00457BB6
log, xrefs: 00457A59, 00457A68

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID: DecodePointer
String ID: `-@$acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3628989360
Opcode ID: 4c17630f5161de399ffce6b570c60365a2c89c55b52a7f760b39540bf94f5387
Instruction ID: bbf143f63b3841ec77cfacb8c6df481a799db6acf17f433172942b25d65e7ef2
Opcode Fuzzy Hash: 4c17630f5161de399ffce6b570c60365a2c89c55b52a7f760b39540bf94f5387
Instruction Fuzzy Hash: 1651B370808A0ACBCF109F58F84C1BEBFB1FB05309F154166D851A7266C7799A2DCB4D

Function 0041A060 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0041A09D
std::_Lockit::_Lockit.LIBCPMT ref: 0041A0BF
std::_Lockit::~_Lockit.LIBCPMT ref: 0041A0E7
__Getctype.LIBCPMT ref: 0041A1C5
std::_Facet_Register.LIBCPMT ref: 0041A1F9
std::_Lockit::~_Lockit.LIBCPMT ref: 0041A223

Strings

E@, xrefs: 0041A1AE
PD@, xrefs: 0041A19A
PG@, xrefs: 0041A1BF

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID: PD@$PG@$E@
API String ID: 1102183713-4120405683
Opcode ID: 495f4126c8959cda1dad90c343e93fba20469dde2e2043d742b69906c970156d
Instruction ID: b372b58ab1bb25eec4b44a09b7f8f3aef2cc67a410616163416d5e42c3dffe19
Opcode Fuzzy Hash: 495f4126c8959cda1dad90c343e93fba20469dde2e2043d742b69906c970156d
Instruction Fuzzy Hash: 6E51BAB0D01245DFCB11CF98C9457AEBBF0FB14714F14825ED855AB391DB78AA88CB92

Function 004372D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00437307
___except_validate_context_record.LIBVCRUNTIME ref: 0043730F
_ValidateLocalCookies.LIBCMT ref: 00437398
__IsNonwritableInCurrentImage.LIBCMT ref: 004373C3
_ValidateLocalCookies.LIBCMT ref: 00437418

Strings

csm, xrefs: 004373AD
`-@, xrefs: 004373DC

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: `-@$csm
API String ID: 1170836740-3738301566
Opcode ID: a837c65dc98bc53f7a591b5dada66322cfdf011b0ab20b220170fbbfaeea83fd
Instruction ID: bde692452db8eba3752ab90a3e7788ac0719a0bf92b2230e47b89eff8dfd02fd
Opcode Fuzzy Hash: a837c65dc98bc53f7a591b5dada66322cfdf011b0ab20b220170fbbfaeea83fd
Instruction Fuzzy Hash: B041F8709042099FCF20DF59C885A9FBBA4BF08328F14905BFC54AB392D739E905DB95

Function 0041C430 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0041C45A
std::_Lockit::_Lockit.LIBCPMT ref: 0041C47C
std::_Lockit::~_Lockit.LIBCPMT ref: 0041C4A4
std::_Facet_Register.LIBCPMT ref: 0041C59A
std::_Lockit::~_Lockit.LIBCPMT ref: 0041C5C4

Strings

PD@, xrefs: 0041C54E
E@, xrefs: 0041C562

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: E@$PD@
API String ID: 459529453-4103272508
Opcode ID: fb94b052f71f665722219136562a8730e5ed9d67761b2a33bc821d4977d05291
Instruction ID: e4bc83ced0ac359faa997fd18d4eeb760fe14de2594101695cc0fd15b6690fbc
Opcode Fuzzy Hash: fb94b052f71f665722219136562a8730e5ed9d67761b2a33bc821d4977d05291
Instruction Fuzzy Hash: C351EFB0900255EFDB11CF58C991BAEBBF0FB10314F24415EE846AB381D7B9AA45CB95

Function 0044BB66 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0044BBEC

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 785c90e8ff89e0f1a3d98e37725974d6f6ea20f06d45e48120c47f1ca5a82ffe
Instruction ID: d7b9d7273cbfac5d15a556f8c8651b9033d93685d5a38535419dded3191b9e75
Opcode Fuzzy Hash: 785c90e8ff89e0f1a3d98e37725974d6f6ea20f06d45e48120c47f1ca5a82ffe
Instruction Fuzzy Hash: D5B14672D006559FEB158F24CC81BEBBBA5EF59310F2441ABE904AB382D778D901C7E9

Function 0044B37E Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,0044B48D,?,?,00000000,00000001,?,?,0044B6B7,00000022,FlsSetValue,00561B88,00561B90,00000001), ref: 0044B43F

Strings

api-ms-, xrefs: 0044B3D5
ext-ms-, xrefs: 0044B3E9

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 033630484f002e070c94113c7b6ef7f262f68e90d70309fdd043a749aa00ed93
Instruction ID: e3d7dbf8d3e43151f67a2d3675c4fcd7809fc0c9af6198dcb17880ded4e1cd5b
Opcode Fuzzy Hash: 033630484f002e070c94113c7b6ef7f262f68e90d70309fdd043a749aa00ed93
Instruction Fuzzy Hash: A2212B36A01220A7E7319F619C45A6B7768EB51761F140112FC06A7392D734ED05D6D9

Function 00443633 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,DDA667AB,?,?,00000000,00551365,000000FF,?,0044360F,?,?,004435E3,00000016), ref: 00443668
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0044367A
FreeLibrary.KERNEL32(00000000,?,00000000,00551365,000000FF,?,0044360F,?,?,004435E3,00000016), ref: 0044369C

Strings

mscoree.dll, xrefs: 00443661
CorExitProcess, xrefs: 00443672
`-@, xrefs: 0044368B

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$`-@$mscoree.dll
API String ID: 4061214504-3731901874
Opcode ID: 66c557226bdf84cfe892202a4e2d9d598a1facfa92736b92f61228ad13b2a6bb
Instruction ID: 11f561727bfec435161e86ab51d2faaed74d5e09c0b89d0474703e999051cdf2
Opcode Fuzzy Hash: 66c557226bdf84cfe892202a4e2d9d598a1facfa92736b92f61228ad13b2a6bb
Instruction Fuzzy Hash: 5601A232A44715AFDB219F44DC19BAFBBB8FB14B52F014526E812E27E0DB749A04CA94

Function 00432729 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00432730
std::_Lockit::_Lockit.LIBCPMT ref: 0043273B
std::_Lockit::~_Lockit.LIBCPMT ref: 004327A9

Part of subcall function 0043288C: std::locale::_Locimp::_Locimp.LIBCPMT ref: 004328A4

std::locale::_Setgloballocale.LIBCPMT ref: 00432756

Strings

`-@, xrefs: 00432778, 0043279C

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_Setgloballocale
String ID: `-@
API String ID: 677527491-3781167437
Opcode ID: 8a5613631ec3d916f95b396eb7cc43f12c5d676d84142dd5ef1a29976cc47206
Instruction ID: 335728d06f8999c9367bb6f0cb93ad347570f0e44e9dcbef2930aaa8ccdcd417
Opcode Fuzzy Hash: 8a5613631ec3d916f95b396eb7cc43f12c5d676d84142dd5ef1a29976cc47206
Instruction Fuzzy Hash: 9D01FC35A006109BC70AFB20CC5157D7BB0FF98790F44250EE81163391CFB8AE06DB89

Function 00432BC8 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00432BDC
RtlAcquireSRWLockExclusive.NTDLL(00000008), ref: 00432BFB
RtlAcquireSRWLockExclusive.NTDLL(00000008), ref: 00432C29
RtlTryAcquireSRWLockExclusive.NTDLL(00000008), ref: 00432C84
RtlTryAcquireSRWLockExclusive.NTDLL(00000008), ref: 00432C9B

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 8f089e7040faa662b45679f060ee1b8a0f0adfff173fd46cb89089840a213128
Instruction ID: ee0d2db44a198d3d02c1eb3b1b0ff5a364ec90963e300245c4d31640e9e12550
Opcode Fuzzy Hash: 8f089e7040faa662b45679f060ee1b8a0f0adfff173fd46cb89089840a213128
Instruction Fuzzy Hash: B2415931900A0ADFCB20DF65CA8096EB3B4FF0C311F20692BD446D7650D7B8E986DB69

Function 00407350 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 158COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 0040750C
___std_exception_destroy.LIBVCRUNTIME ref: 00407522

Strings

[json.exception., xrefs: 004073A1
)@, xrefs: 00407502, 0040751C

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: )@$[json.exception.
API String ID: 4194217158-3378332251
Opcode ID: 74f1ced649a80f54c74698f2e3f1ef80366f2fbaef409b1663f26043a5eac72a
Instruction ID: d1fd1ad00dbeab1566b73d8112c34bc80c76f551163e59ed82d928a5322bc1a2
Opcode Fuzzy Hash: 74f1ced649a80f54c74698f2e3f1ef80366f2fbaef409b1663f26043a5eac72a
Instruction Fuzzy Hash: 8C51CFB1C046489BD710DFA8C905B9EBBB4FF15318F14426EE850A73C2E7B86A44C7A5

Function 00404900 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0040499F

Part of subcall function 004351FB: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,74D723A0,?,00431D09,?,005799D8,74D723A0,?,74D723A0,-00589880), ref: 0043525B

Strings

ios_base::eofbit set, xrefs: 00404946
ios_base::failbit set, xrefs: 00404828, 00404941
ios_base::badbit set, xrefs: 00404937, 00404962

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID: ExceptionIos_base_dtorRaisestd::ios_base::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1903096808-1866435925
Opcode ID: 5e8fcf04681b5496c91e096f1d273a5343178b8940b0c322b64de4dd1df32f3c
Instruction ID: 99c94d1e80f512c720ba00148ae48faeb0acee82eabb402b7e5943aa58dcc262
Opcode Fuzzy Hash: 5e8fcf04681b5496c91e096f1d273a5343178b8940b0c322b64de4dd1df32f3c
Instruction Fuzzy Hash: AC119CF2844644ABCB10DF688C03BAB37C8E744715F04463EFE58972C1EB399800C79A

Function 00448E9F Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(DDA667AB,00000000,00000000,?), ref: 00448F02

Part of subcall function 0044EC55: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0044A862,?,00000000,-00000008), ref: 0044ECB6

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00449154
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0044919A
GetLastError.KERNEL32 ref: 0044923D

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: d46c0870a8277536d77cd1fa32924c999241811f2f15ebdbc3735bbe4b8907ba
Instruction ID: b6f9ea87837ca93654473fd2bae4ec290e60b55bc3ade45d2d9d29a5185f0d60
Opcode Fuzzy Hash: d46c0870a8277536d77cd1fa32924c999241811f2f15ebdbc3735bbe4b8907ba
Instruction Fuzzy Hash: 70D1BC75D00249AFDF14CFA8C880AAEBBB5FF09304F28456AE856EB351D734AD45CB54

Function 00456D32 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,00000000,?,?,00453DCE,?,00000001,?,?,?,00449291,?,00000000,00000000), ref: 00456D49
GetLastError.KERNEL32(?,00453DCE,?,00000001,?,?,?,00449291,?,00000000,00000000,?,?,?,0044986B,?), ref: 00456D55

Part of subcall function 00456D1B: CloseHandle.KERNEL32(FFFFFFFE,00456D65,?,00453DCE,?,00000001,?,?,?,00449291,?,00000000,00000000,?,?), ref: 00456D2B

___initconout.LIBCMT ref: 00456D65

Part of subcall function 00456CDD: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00456D0C,00453DBB,?,?,00449291,?,00000000,00000000,?), ref: 00456CF0

WriteConsoleW.KERNEL32(?,?,?,00000000,?,00453DCE,?,00000001,?,?,?,00449291,?,00000000,00000000,?), ref: 00456D7A

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 6d252f6c85546040703605b5d122fbb434f3c9b6b34be8e7cd3f73b3df330617
Instruction ID: b582005f90f2c4d159ccd48a3422ceca8e6e351b7b3b67145bbef734a6de3f3c
Opcode Fuzzy Hash: 6d252f6c85546040703605b5d122fbb434f3c9b6b34be8e7cd3f73b3df330617
Instruction Fuzzy Hash: F4F01C37500518BBCF221FD1DC18A8A3F76EB583A2B814415FE0D96231D6328928EB94

Function 004036E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 178COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00403819
___std_exception_destroy.LIBVCRUNTIME ref: 004038F0

Strings

)@, xrefs: 004037ED, 004038EA

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: )@
API String ID: 2970364248-4120265097
Opcode ID: ed1ac0f14267c2b8626e9d784d9228836504f476972db074cc70cf608e0aac1a
Instruction ID: 269ef50febfdc4b1c22cf7239a576f40f0b19685bcb009e1facc48eb6157c32a
Opcode Fuzzy Hash: ed1ac0f14267c2b8626e9d784d9228836504f476972db074cc70cf608e0aac1a
Instruction Fuzzy Hash: DD6169B1C00248DBDB10DF98C945B9EFFB5FF19324F14825EE814AB282D7B95A44CBA5

Function 004047F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 153COMMONLIBRARYCODE

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0040499F

Part of subcall function 004351FB: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,74D723A0,?,00431D09,?,005799D8,74D723A0,?,74D723A0,-00589880), ref: 0043525B

Strings

ios_base::failbit set, xrefs: 00404828
ios_base::badbit set, xrefs: 00404937, 00404962

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID: ExceptionIos_base_dtorRaisestd::ios_base::_
String ID: ios_base::badbit set$ios_base::failbit set
API String ID: 1903096808-1240500531
Opcode ID: 203c698a29c545db5755075702da49fc56ba2ad14afa72da2930693391794826
Instruction ID: 59789774a96eacd1a5b8f49c51d8e497543063f0a2ed12b155596828dbf76f3a
Opcode Fuzzy Hash: 203c698a29c545db5755075702da49fc56ba2ad14afa72da2930693391794826
Instruction Fuzzy Hash: E84124B2C00244ABCB04DF68C845BAEBBB8FB49710F14826EF554A73C1D7795A00CBA5

Function 00404040 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00404061
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 004040C4

Strings

bad locale name, xrefs: 004040E6

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 0039d2d2ea2786ef81fe116e8b864d57793cf36a19fa060d6cb0c255b1586cee
Instruction ID: 65c2995a4cce64452fc0e082f9126f7f9302ed92d60cad1113ce5137d9e79936
Opcode Fuzzy Hash: 0039d2d2ea2786ef81fe116e8b864d57793cf36a19fa060d6cb0c255b1586cee
Instruction Fuzzy Hash: DB112670805B84EED321CF69C50474BBFF0AF25714F10868DD09597781D3B9A604CB95

Function 00416590 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004165C9
___std_exception_copy.LIBVCRUNTIME ref: 004165FC

Strings

)@, xrefs: 004165BA, 004165ED

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID: ___std_exception_copy
String ID: )@
API String ID: 2659868963-4120265097
Opcode ID: ec459901e9a8c12f2536e06f4ce64afd8286d8aca2aa337d2d7da09c98386d96
Instruction ID: 79ebb971947c26e29da123751e765caa72f3f100f47198c89106861aa63fe252
Opcode Fuzzy Hash: ec459901e9a8c12f2536e06f4ce64afd8286d8aca2aa337d2d7da09c98386d96
Instruction Fuzzy Hash: F0112EB6910649EBCB11CF99C980B86FBF8FF09724F10876AE82497641E774A5448BA0

Function 00407A20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00407A5C
___std_exception_destroy.LIBVCRUNTIME ref: 00407A72

Strings

)@, xrefs: 00407A52, 00407A6C

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: )@
API String ID: 4194217158-4120265097
Opcode ID: 9ee8fa866bcea9d2c14fc14309fcadf8facde4318e0e6bb098ed358a1a235593
Instruction ID: 96290d15a7b89a27e7413382239de33ac52fdad5c525fa7f0e86a9c1871ea130
Opcode Fuzzy Hash: 9ee8fa866bcea9d2c14fc14309fcadf8facde4318e0e6bb098ed358a1a235593
Instruction Fuzzy Hash: 68F012B1805744DFC711DF98C90178DFFF8FB05728F50466AE855A3780E7B5660487A5

Function 0043361D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00433077,?,?,?,?,004C7E2F), ref: 00433655
GetSystemTimeAsFileTime.KERNEL32(?,DDA667AB,00000000,?,00551382,000000FF,?,00433077,?,?,?,?,004C7E2F), ref: 00433659

Strings

`-@, xrefs: 0043364F

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID: `-@
API String ID: 743729956-3781167437
Opcode ID: a70e229828252f114f3dcb939b169fb3f53d7191ad82fa45b454faadf805d98c
Instruction ID: 3e04e591088ee8cc2650925c1d28f2227fba881fd4e87dc1a7d03300bd93dc66
Opcode Fuzzy Hash: a70e229828252f114f3dcb939b169fb3f53d7191ad82fa45b454faadf805d98c
Instruction Fuzzy Hash: 73F0A032904A54EFCB118F44DC11B59BBA8F708B21F004626EC12A3790DB34A9049F94

Function 0044B7F4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00000016,00000001,004389D2,00000001,00000016,00438BE1,?,?,?,?,?,00000000), ref: 0044B834

Strings

InitializeCriticalSectionEx, xrefs: 0044B804
`-@, xrefs: 0044B824

Memory Dump Source

Source File: 00000005.00000002.3251572028.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3251442840.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252318852.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252384144.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252449095.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3252508437.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3254583869.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_MPGPH131.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$`-@
API String ID: 2593887523-3269949891
Opcode ID: 1f2253b5c78e33ee57fe7f30907939316c5faef6f9275bf3e632fad4f43c2f0e
Instruction ID: 5bcc12c1b0658f8dc7434a33690804c70bb56e7eadbb0958c8ec10a8e9d05d13
Opcode Fuzzy Hash: 1f2253b5c78e33ee57fe7f30907939316c5faef6f9275bf3e632fad4f43c2f0e
Instruction Fuzzy Hash: BDE09236581318BBCB212F92DC06DAE7F25EB24BA2F048022FD1956161C7768821BBD9

Analysis Process: MPGPH131.exePID: 5740, Parent PID: 1044COMMON

Executed Functions

Function 004C7B00 Relevance: 18.3, APIs: 12, Instructions: 279
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(0000031C,0000FFFF,00001006,?,00000008), ref: 004C7BA6
recv.WS2_32(?,00000004,00000002), ref: 004C7BC1
WSAGetLastError.WS2_32 ref: 004C7BC5
recv.WS2_32(00000000,0000000C,00000002,00000000), ref: 004C7C43
recv.WS2_32(00000000,0000000C,00000008), ref: 004C7C64
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?), ref: 004C7D00
recv.WS2_32(00000000,?,00000008), ref: 004C7D1B

Part of subcall function 004C8590: WSAStartup.WS2_32 ref: 004C85BA
Part of subcall function 004C8590: getaddrinfo.WS2_32(?,?,?,00589328), ref: 004C863C
Part of subcall function 004C8590: socket.WS2_32(?,?,?), ref: 004C865D
Part of subcall function 004C8590: connect.WS2_32(00000000,00559BFC,?), ref: 004C8671
Part of subcall function 004C8590: closesocket.WS2_32(00000000), ref: 004C867D
Part of subcall function 004C8590: FreeAddrInfoW.WS2_32(?), ref: 004C868A
Part of subcall function 004C8590: WSACleanup.WS2_32 ref: 004C8690

recv.WS2_32(?,00000004,00000008), ref: 004C7E23
__Xtime_get_ticks.LIBCPMT ref: 004C7E2A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004C7E38
Sleep.KERNELBASE(00000001,00000000,?,00002710,00000000), ref: 004C7EB1
Sleep.KERNELBASE(00000064,?,00002710,00000000), ref: 004C7EB9

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID: recv$Sleepsetsockopt$AddrCleanupErrorFreeInfoLastStartupUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@closesocketconnectgetaddrinfosocket
String ID:
API String ID: 3089209366-0
Opcode ID: deda763b8fb6066c72b20903b58187ae793f723e7b47fea433c0891846b4f81f
Instruction ID: b3d54dcccad81d83ab75f13ba9899d4b50e1d8608cabcccfb3508871926cac68
Opcode Fuzzy Hash: deda763b8fb6066c72b20903b58187ae793f723e7b47fea433c0891846b4f81f
Instruction Fuzzy Hash: 9EB1AC71D043089BEB10DBA8CC49BAEBBB1BB54314F24025EE815BB2D2D7785D88DF95

Function 004C8590 Relevance: 12.1, APIs: 8, Instructions: 92
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 004C85BA
getaddrinfo.WS2_32(?,?,?,00589328), ref: 004C863C
socket.WS2_32(?,?,?), ref: 004C865D
connect.WS2_32(00000000,00559BFC,?), ref: 004C8671
closesocket.WS2_32(00000000), ref: 004C867D
FreeAddrInfoW.WS2_32(?), ref: 004C868A
WSACleanup.WS2_32 ref: 004C8690
FreeAddrInfoW.WS2_32(?), ref: 004C86A5

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID: AddrFreeInfo$CleanupStartupclosesocketconnectgetaddrinfosocket
String ID:
API String ID: 448659506-0
Opcode ID: 52d29ec15fbf37ccd53ab56e21f2e3f1d11727fcf2b6a4206c2cbc59116a4c78
Instruction ID: ffa07009e3086412046aa5b15573dbd5c691e56a3beb11943292ef2f0f62f1de
Opcode Fuzzy Hash: 52d29ec15fbf37ccd53ab56e21f2e3f1d11727fcf2b6a4206c2cbc59116a4c78
Instruction Fuzzy Hash: 9531C1726043009BD7208F25DC48B2BB7E5FB94729F114B1EF9A4922E0D7759C089AA7

Function 00409280 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll,?,?,?,?,0054D15C,00000000,74D723A0,-00589880), ref: 004096A6
GetProcAddress.KERNEL32(00000000,?), ref: 004096B4
WSASend.WS2_32(?,?,00000001,00000000,00000000,00000000,00000000,?,?,?,?,0054D15C,00000000,74D723A0,-00589880), ref: 004096C9

Strings

Ws2_32.dll, xrefs: 0040969A

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID: AddressHandleModuleProcSend
String ID: Ws2_32.dll
API String ID: 2819740048-3093949381
Opcode ID: d946741ea927b9b060335f299eec8efad25939578b4ebaaa967d5c79e73c84d4
Instruction ID: 188670ed5cfc709ed037a390f66f33add7af100e18449b0941b00ad524943a05
Opcode Fuzzy Hash: d946741ea927b9b060335f299eec8efad25939578b4ebaaa967d5c79e73c84d4
Instruction Fuzzy Hash: 7C02CE70D04298DEDF25CFA4C8907ADBBB0EF59304F24429EE4456B2C6D7781D86CB96

Function 00449789 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00448E9F: GetConsoleOutputCP.KERNEL32(DDAEDC22,00000000,00000000,?), ref: 00448F02

WriteFile.KERNELBASE(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0044990E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?), ref: 00449918

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 2beaef352ff8862ad6b8b16251cd0bd229135013537871e9a6efb1225fc67aec
Instruction ID: 4c198159cf300fc4e9085a349e24ad4d45033eb13303bb4f9288eddf9455663d
Opcode Fuzzy Hash: 2beaef352ff8862ad6b8b16251cd0bd229135013537871e9a6efb1225fc67aec
Instruction Fuzzy Hash: 9961C5B1C14119BFEF11DFA8C844AAFBBB9AF49304F14014AE800A7316D739DD05EB65

Function 00448DFF Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,00448CE6,00000000,?,0057A178,0000000C,00448DA2,?,?,?), ref: 00448E55
GetLastError.KERNEL32(?,00448CE6,00000000,?,0057A178,0000000C,00448DA2,?,?,?), ref: 00448E5F

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 1fe827fdfe079599b9b1dab25e2b646f0beb01ea40d46a72429d261cc15a62e7
Instruction ID: bfed174018f4c3fae0b74bea86efe9ace0911028d3bee9629bfc5162a0057b67
Opcode Fuzzy Hash: 1fe827fdfe079599b9b1dab25e2b646f0beb01ea40d46a72429d261cc15a62e7
Instruction Fuzzy Hash: 6E1125336042102AF6252236A84677F67499B82738F39061FF918CB2D2DF689C81825D

Function 0044251C Relevance: 3.1, APIs: 2, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(00000000,?,?,?,?,?,00000000,?,?,?,00442626,?,?,?,?,?), ref: 00442558
GetLastError.KERNEL32(?,?,?,?,00442626,?,?,?,?,?,00000000,?,00000000), ref: 00442565

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 0df1753fdbe4f7a704092f8361e7cfb0c7cc0fcadc70f8748e4d2d33b1623b65
Instruction ID: bcffdd1dd92d970d4fbe8e398a8ab980657c5c2bf717c74f1f656664416c076e
Opcode Fuzzy Hash: 0df1753fdbe4f7a704092f8361e7cfb0c7cc0fcadc70f8748e4d2d33b1623b65
Instruction Fuzzy Hash: 9B012632610615BFDF158F69DC1699E3B29EB84334F240209F8019B2E1E6B5ED429BA4

Function 004032D0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0040331F

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 4c9de15bf43b7906aab7ed6efc04c82af185101d7b74466eda9590404471e6f8
Instruction ID: ac639495c118a2832fc09027b5ebf4fad0cef292c7be368858978faeea3118d5
Opcode Fuzzy Hash: 4c9de15bf43b7906aab7ed6efc04c82af185101d7b74466eda9590404471e6f8
Instruction Fuzzy Hash: 63F024321001009BCB246F61D4565EAB7ECDF28366B50083FFC8DD7292EB3EDA408788

Function 0044A65A Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000001), ref: 0044A69B

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 89032516e5b3e6299283371760f336f91a06b383302663fb1c071aa923d3998c
Instruction ID: 9689b7dccde3e7d2c1426315cc49502dff6dd5535dcc2f3da2dc3831567fdc71
Opcode Fuzzy Hash: 89032516e5b3e6299283371760f336f91a06b383302663fb1c071aa923d3998c
Instruction Fuzzy Hash: 4CF0E0311905246BFB216A66DC05B5B375CAF41760F1E8117EC84EB190CA3CDC3146EE

Function 0044B094 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000001,?), ref: 0044B0C6

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c639ae0624eff34eb8e57d07392fb4ffc7a0b3e65f726cef66c68c9318aea675
Instruction ID: 07eaf642519ac51a5bd3283dd2addbb445c80e248ae9cef49388ffb333b33e8c
Opcode Fuzzy Hash: c639ae0624eff34eb8e57d07392fb4ffc7a0b3e65f726cef66c68c9318aea675
Instruction Fuzzy Hash: 99E022322006206BFF313AA69C14B5B764CEF413A3F190227EC25A62D1DB3CCC0092EE

Non-executed Functions

Function 004CF280 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 240injectionmemorysynchronizationCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000040), ref: 004CF2F1
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004CF30D
WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 004CF342
VirtualAllocEx.KERNEL32(?,00000000,00001000,00003000,00000040), ref: 004CF36B
WriteProcessMemory.KERNEL32(?,00000000,?,00000218,00000000), ref: 004CF50F
WriteProcessMemory.KERNEL32(?,00000218,004CF5E0,-00000010,00000000), ref: 004CF531
CreateRemoteThread.KERNEL32(?,00000000,00000000,00000218,00000000,00000000,00000000), ref: 004CF544
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 004CF54D

Strings

%s|%s, xrefs: 004CF4EF
131, xrefs: 004CF4D3, 004CF4E3

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID: MemoryProcessWrite$AllocVirtual$CreateObjectRemoteSingleThreadWait
String ID: %s|%s$131
API String ID: 2137838514-1629954864
Opcode ID: b88fb1ed2ebfd2a655c4879da0ce9de7ec8f2c0603ef1b71525654192dd42d6d
Instruction ID: 2ab717f03d3c912496b66fb944616d360f792c6fe5d042a247d22025e7d5b78f
Opcode Fuzzy Hash: b88fb1ed2ebfd2a655c4879da0ce9de7ec8f2c0603ef1b71525654192dd42d6d
Instruction Fuzzy Hash: 36B16BB1D002089FDB14CFA4CC95BAEBBB5FF18300F10426DE905BB291D774A984DBA5

Function 004534CF Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00449E42: GetLastError.KERNEL32(00000000,?,0044F82B), ref: 00449E46
Part of subcall function 00449E42: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 00449EE8

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 004535D7
IsValidCodePage.KERNEL32(?), ref: 00453615
IsValidLocale.KERNEL32(?,00000001), ref: 00453628
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 00453670
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 0045368B

Strings

*V, xrefs: 00453534

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: *V
API String ID: 415426439-2897881622
Opcode ID: bb3ee8500ca9cacc625c50b97d6e48ff5c53ad3e39c4a6c01d9da358df15b7ae
Instruction ID: 4a54d826d8e8e5dc964d84ffa3ac1e49b68ae0fe58eca9cd8e7cd24ca5604c7d
Opcode Fuzzy Hash: bb3ee8500ca9cacc625c50b97d6e48ff5c53ad3e39c4a6c01d9da358df15b7ae
Instruction Fuzzy Hash: 4E517471A00209AFDB20DFA5CC41ABF77B8AF05743F14446AED01E7252EB74DA48DB65

Function 00452B5A Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00449E42: GetLastError.KERNEL32(00000000,?,0044F82B), ref: 00449E46
Part of subcall function 00449E42: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 00449EE8

GetACP.KERNEL32(?,?,?,?,?,?,00447300,?,?,?,?,?,-00000050,?,?,?), ref: 00452C19
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00447300,?,?,?,?,?,-00000050,?,?), ref: 00452C50
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 00452DB3

Strings

utf8, xrefs: 00452D22
*V, xrefs: 00452B98

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: *V$utf8
API String ID: 607553120-210452255
Opcode ID: 95727e6ef7b94787d777f99e21165c393144e5509e4be2ad3f52f8295ffa9360
Instruction ID: 742b11dcb7ff0b0bfa38c284345f0d68b4d7ce619a9ba0daefdf44cafbbca61f
Opcode Fuzzy Hash: 95727e6ef7b94787d777f99e21165c393144e5509e4be2ad3f52f8295ffa9360
Instruction Fuzzy Hash: F071FA32600602A6D725AF75CD45B6B73A8EF16705F10042FFD05D7283EBF8E94C9699

Function 004532F3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,00000000,?,?,?,00453605,?,?), ref: 0045338C
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,00000000,?,?,?,00453605,?,?), ref: 004533B5
GetACP.KERNEL32(?,?,00453605,?,?), ref: 004533CA

Strings

OCP, xrefs: 00453347
ACP, xrefs: 00453311

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: b900ca414d4c4be95a8c6f041d08249478f894891a183a2f82a4edaf5765dc51
Instruction ID: 0023b8279c9b3e3643c8ce07df61025d6c2b7e12d2ffc4f7461f6cfcb2a1a3ae
Opcode Fuzzy Hash: b900ca414d4c4be95a8c6f041d08249478f894891a183a2f82a4edaf5765dc51
Instruction Fuzzy Hash: 8021C432600100A7DB308F54C900A9BB3A6AF50FD3B568466EC06D7312EF36EF49D358

Function 0043C960 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 333d4b6d5425d6f9d03797ee82114c3711da98524c03317fffdb5ec62fb2b380
Instruction ID: 01dad5c531b3804b6668612822d9feb5b6f7af541a2af8c3bc89036eeee974e8
Opcode Fuzzy Hash: 333d4b6d5425d6f9d03797ee82114c3711da98524c03317fffdb5ec62fb2b380
Instruction Fuzzy Hash: DA023A71E002199BDF14CFA9D9C06AEFBB1FF48314F24926AE919B7380D735A9418B94

Function 004579E3 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlDecodePointer.NTDLL(?), ref: 004579FC

Strings

asin, xrefs: 00457B29
sqrt, xrefs: 00457B3B
log, xrefs: 00457A59, 00457A68
exp, xrefs: 00457A7B, 00457AE0
`-@, xrefs: 00457AC6, 00457B70, 00457BB6
log10, xrefs: 00457A3E, 00457A4D
pow, xrefs: 00457A9A, 00457B44, 00457B91
acos, xrefs: 00457B32

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID: DecodePointer
String ID: `-@$acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3628989360
Opcode ID: 4c17630f5161de399ffce6b570c60365a2c89c55b52a7f760b39540bf94f5387
Instruction ID: bbf143f63b3841ec77cfacb8c6df481a799db6acf17f433172942b25d65e7ef2
Opcode Fuzzy Hash: 4c17630f5161de399ffce6b570c60365a2c89c55b52a7f760b39540bf94f5387
Instruction Fuzzy Hash: 1651B370808A0ACBCF109F58F84C1BEBFB1FB05309F154166D851A7266C7799A2DCB4D

Function 0041A060 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0041A09D
std::_Lockit::_Lockit.LIBCPMT ref: 0041A0BF
std::_Lockit::~_Lockit.LIBCPMT ref: 0041A0E7
__Getctype.LIBCPMT ref: 0041A1C5
std::_Facet_Register.LIBCPMT ref: 0041A1F9
std::_Lockit::~_Lockit.LIBCPMT ref: 0041A223

Strings

E@, xrefs: 0041A1AE
PD@, xrefs: 0041A19A
PG@, xrefs: 0041A1BF

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID: PD@$PG@$E@
API String ID: 1102183713-4120405683
Opcode ID: cf66166f52ff7971b600a3250f2a29593a1149a421a208e93fab5363b0ce8f21
Instruction ID: b372b58ab1bb25eec4b44a09b7f8f3aef2cc67a410616163416d5e42c3dffe19
Opcode Fuzzy Hash: cf66166f52ff7971b600a3250f2a29593a1149a421a208e93fab5363b0ce8f21
Instruction Fuzzy Hash: 6E51BAB0D01245DFCB11CF98C9457AEBBF0FB14714F14825ED855AB391DB78AA88CB92

Function 004372D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00437307
___except_validate_context_record.LIBVCRUNTIME ref: 0043730F
_ValidateLocalCookies.LIBCMT ref: 00437398
__IsNonwritableInCurrentImage.LIBCMT ref: 004373C3
_ValidateLocalCookies.LIBCMT ref: 00437418

Strings

csm, xrefs: 004373AD
`-@, xrefs: 004373DC

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: `-@$csm
API String ID: 1170836740-3738301566
Opcode ID: a837c65dc98bc53f7a591b5dada66322cfdf011b0ab20b220170fbbfaeea83fd
Instruction ID: bde692452db8eba3752ab90a3e7788ac0719a0bf92b2230e47b89eff8dfd02fd
Opcode Fuzzy Hash: a837c65dc98bc53f7a591b5dada66322cfdf011b0ab20b220170fbbfaeea83fd
Instruction Fuzzy Hash: B041F8709042099FCF20DF59C885A9FBBA4BF08328F14905BFC54AB392D739E905DB95

Function 0041C430 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0041C45A
std::_Lockit::_Lockit.LIBCPMT ref: 0041C47C
std::_Lockit::~_Lockit.LIBCPMT ref: 0041C4A4
std::_Facet_Register.LIBCPMT ref: 0041C59A
std::_Lockit::~_Lockit.LIBCPMT ref: 0041C5C4

Strings

PD@, xrefs: 0041C54E
E@, xrefs: 0041C562

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: E@$PD@
API String ID: 459529453-4103272508
Opcode ID: 4956459445cc7cc7d841703dbe2ed42e033006db9883af498c412f7626095107
Instruction ID: e4bc83ced0ac359faa997fd18d4eeb760fe14de2594101695cc0fd15b6690fbc
Opcode Fuzzy Hash: 4956459445cc7cc7d841703dbe2ed42e033006db9883af498c412f7626095107
Instruction Fuzzy Hash: C351EFB0900255EFDB11CF58C991BAEBBF0FB10314F24415EE846AB381D7B9AA45CB95

Function 0044BB66 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0044BBEC

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 785c90e8ff89e0f1a3d98e37725974d6f6ea20f06d45e48120c47f1ca5a82ffe
Instruction ID: d7b9d7273cbfac5d15a556f8c8651b9033d93685d5a38535419dded3191b9e75
Opcode Fuzzy Hash: 785c90e8ff89e0f1a3d98e37725974d6f6ea20f06d45e48120c47f1ca5a82ffe
Instruction Fuzzy Hash: D5B14672D006559FEB158F24CC81BEBBBA5EF59310F2441ABE904AB382D778D901C7E9

Function 0044B37E Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,0044B48D,?,?,00000000,00000001,?,?,0044B6B7,00000022,FlsSetValue,00561B88,00561B90,00000001), ref: 0044B43F

Strings

api-ms-, xrefs: 0044B3D5
ext-ms-, xrefs: 0044B3E9

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 033630484f002e070c94113c7b6ef7f262f68e90d70309fdd043a749aa00ed93
Instruction ID: e3d7dbf8d3e43151f67a2d3675c4fcd7809fc0c9af6198dcb17880ded4e1cd5b
Opcode Fuzzy Hash: 033630484f002e070c94113c7b6ef7f262f68e90d70309fdd043a749aa00ed93
Instruction Fuzzy Hash: A2212B36A01220A7E7319F619C45A6B7768EB51761F140112FC06A7392D734ED05D6D9

Function 00443633 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,DDAEDC22,?,?,00000000,00551365,000000FF,?,0044360F,?,?,004435E3,00000016), ref: 00443668
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0044367A
FreeLibrary.KERNEL32(00000000,?,00000000,00551365,000000FF,?,0044360F,?,?,004435E3,00000016), ref: 0044369C

Strings

CorExitProcess, xrefs: 00443672
`-@, xrefs: 0044368B
mscoree.dll, xrefs: 00443661

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$`-@$mscoree.dll
API String ID: 4061214504-3731901874
Opcode ID: 66c557226bdf84cfe892202a4e2d9d598a1facfa92736b92f61228ad13b2a6bb
Instruction ID: 11f561727bfec435161e86ab51d2faaed74d5e09c0b89d0474703e999051cdf2
Opcode Fuzzy Hash: 66c557226bdf84cfe892202a4e2d9d598a1facfa92736b92f61228ad13b2a6bb
Instruction Fuzzy Hash: 5601A232A44715AFDB219F44DC19BAFBBB8FB14B52F014526E812E27E0DB749A04CA94

Function 00432729 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00432730
std::_Lockit::_Lockit.LIBCPMT ref: 0043273B
std::_Lockit::~_Lockit.LIBCPMT ref: 004327A9

Part of subcall function 0043288C: std::locale::_Locimp::_Locimp.LIBCPMT ref: 004328A4

std::locale::_Setgloballocale.LIBCPMT ref: 00432756

Strings

`-@, xrefs: 00432778, 0043279C

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_Setgloballocale
String ID: `-@
API String ID: 677527491-3781167437
Opcode ID: 8a5613631ec3d916f95b396eb7cc43f12c5d676d84142dd5ef1a29976cc47206
Instruction ID: 335728d06f8999c9367bb6f0cb93ad347570f0e44e9dcbef2930aaa8ccdcd417
Opcode Fuzzy Hash: 8a5613631ec3d916f95b396eb7cc43f12c5d676d84142dd5ef1a29976cc47206
Instruction Fuzzy Hash: 9D01FC35A006109BC70AFB20CC5157D7BB0FF98790F44250EE81163391CFB8AE06DB89

Function 00432BC8 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00432BDC
RtlAcquireSRWLockExclusive.NTDLL(00000008), ref: 00432BFB
RtlAcquireSRWLockExclusive.NTDLL(00000008), ref: 00432C29
RtlTryAcquireSRWLockExclusive.NTDLL(00000008), ref: 00432C84
RtlTryAcquireSRWLockExclusive.NTDLL(00000008), ref: 00432C9B

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 8f089e7040faa662b45679f060ee1b8a0f0adfff173fd46cb89089840a213128
Instruction ID: ee0d2db44a198d3d02c1eb3b1b0ff5a364ec90963e300245c4d31640e9e12550
Opcode Fuzzy Hash: 8f089e7040faa662b45679f060ee1b8a0f0adfff173fd46cb89089840a213128
Instruction Fuzzy Hash: B2415931900A0ADFCB20DF65CA8096EB3B4FF0C311F20692BD446D7650D7B8E986DB69

Function 00407350 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 158COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 0040750C
___std_exception_destroy.LIBVCRUNTIME ref: 00407522

Strings

[json.exception., xrefs: 004073A1
)@, xrefs: 00407502, 0040751C

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: )@$[json.exception.
API String ID: 4194217158-3378332251
Opcode ID: 74f1ced649a80f54c74698f2e3f1ef80366f2fbaef409b1663f26043a5eac72a
Instruction ID: d1fd1ad00dbeab1566b73d8112c34bc80c76f551163e59ed82d928a5322bc1a2
Opcode Fuzzy Hash: 74f1ced649a80f54c74698f2e3f1ef80366f2fbaef409b1663f26043a5eac72a
Instruction Fuzzy Hash: 8C51CFB1C046489BD710DFA8C905B9EBBB4FF15318F14426EE850A73C2E7B86A44C7A5

Function 00404900 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0040499F

Part of subcall function 004351FB: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,74D723A0,?,00431D09,?,005799D8,74D723A0,?,74D723A0,-00589880), ref: 0043525B

Strings

ios_base::failbit set, xrefs: 00404828, 00404941
ios_base::badbit set, xrefs: 00404937, 00404962
ios_base::eofbit set, xrefs: 00404946

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID: ExceptionIos_base_dtorRaisestd::ios_base::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1903096808-1866435925
Opcode ID: 5e8fcf04681b5496c91e096f1d273a5343178b8940b0c322b64de4dd1df32f3c
Instruction ID: 99c94d1e80f512c720ba00148ae48faeb0acee82eabb402b7e5943aa58dcc262
Opcode Fuzzy Hash: 5e8fcf04681b5496c91e096f1d273a5343178b8940b0c322b64de4dd1df32f3c
Instruction Fuzzy Hash: AC119CF2844644ABCB10DF688C03BAB37C8E744715F04463EFE58972C1EB399800C79A

Function 00448E9F Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(DDAEDC22,00000000,00000000,?), ref: 00448F02

Part of subcall function 0044EC55: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0044A862,?,00000000,-00000008), ref: 0044ECB6

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00449154
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0044919A
GetLastError.KERNEL32 ref: 0044923D

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: d46c0870a8277536d77cd1fa32924c999241811f2f15ebdbc3735bbe4b8907ba
Instruction ID: b6f9ea87837ca93654473fd2bae4ec290e60b55bc3ade45d2d9d29a5185f0d60
Opcode Fuzzy Hash: d46c0870a8277536d77cd1fa32924c999241811f2f15ebdbc3735bbe4b8907ba
Instruction Fuzzy Hash: 70D1BC75D00249AFDF14CFA8C880AAEBBB5FF09304F28456AE856EB351D734AD45CB54

Function 00456D32 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,00000000,?,?,00453DCE,?,00000001,?,?,?,00449291,?,00000000,00000000), ref: 00456D49
GetLastError.KERNEL32(?,00453DCE,?,00000001,?,?,?,00449291,?,00000000,00000000,?,?,?,0044986B,?), ref: 00456D55

Part of subcall function 00456D1B: CloseHandle.KERNEL32(FFFFFFFE,00456D65,?,00453DCE,?,00000001,?,?,?,00449291,?,00000000,00000000,?,?), ref: 00456D2B

___initconout.LIBCMT ref: 00456D65

Part of subcall function 00456CDD: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00456D0C,00453DBB,?,?,00449291,?,00000000,00000000,?), ref: 00456CF0

WriteConsoleW.KERNEL32(?,?,?,00000000,?,00453DCE,?,00000001,?,?,?,00449291,?,00000000,00000000,?), ref: 00456D7A

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 6d252f6c85546040703605b5d122fbb434f3c9b6b34be8e7cd3f73b3df330617
Instruction ID: b582005f90f2c4d159ccd48a3422ceca8e6e351b7b3b67145bbef734a6de3f3c
Opcode Fuzzy Hash: 6d252f6c85546040703605b5d122fbb434f3c9b6b34be8e7cd3f73b3df330617
Instruction Fuzzy Hash: F4F01C37500518BBCF221FD1DC18A8A3F76EB583A2B814415FE0D96231D6328928EB94

Function 004036E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 178COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00403819
___std_exception_destroy.LIBVCRUNTIME ref: 004038F0

Strings

)@, xrefs: 004037ED, 004038EA

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: )@
API String ID: 2970364248-4120265097
Opcode ID: ed1ac0f14267c2b8626e9d784d9228836504f476972db074cc70cf608e0aac1a
Instruction ID: 269ef50febfdc4b1c22cf7239a576f40f0b19685bcb009e1facc48eb6157c32a
Opcode Fuzzy Hash: ed1ac0f14267c2b8626e9d784d9228836504f476972db074cc70cf608e0aac1a
Instruction Fuzzy Hash: DD6169B1C00248DBDB10DF98C945B9EFFB5FF19324F14825EE814AB282D7B95A44CBA5

Function 004047F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 153COMMONLIBRARYCODE

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0040499F

Part of subcall function 004351FB: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,74D723A0,?,00431D09,?,005799D8,74D723A0,?,74D723A0,-00589880), ref: 0043525B

Strings

ios_base::failbit set, xrefs: 00404828
ios_base::badbit set, xrefs: 00404937, 00404962

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID: ExceptionIos_base_dtorRaisestd::ios_base::_
String ID: ios_base::badbit set$ios_base::failbit set
API String ID: 1903096808-1240500531
Opcode ID: 8193a8ffeaccef37eb783ff7fe0bdc902a64c2974526b8af49cedd0c2b6b92ef
Instruction ID: 59789774a96eacd1a5b8f49c51d8e497543063f0a2ed12b155596828dbf76f3a
Opcode Fuzzy Hash: 8193a8ffeaccef37eb783ff7fe0bdc902a64c2974526b8af49cedd0c2b6b92ef
Instruction Fuzzy Hash: E84124B2C00244ABCB04DF68C845BAEBBB8FB49710F14826EF554A73C1D7795A00CBA5

Function 00404040 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00404061
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 004040C4

Strings

bad locale name, xrefs: 004040E6

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 0039d2d2ea2786ef81fe116e8b864d57793cf36a19fa060d6cb0c255b1586cee
Instruction ID: 65c2995a4cce64452fc0e082f9126f7f9302ed92d60cad1113ce5137d9e79936
Opcode Fuzzy Hash: 0039d2d2ea2786ef81fe116e8b864d57793cf36a19fa060d6cb0c255b1586cee
Instruction Fuzzy Hash: DB112670805B84EED321CF69C50474BBFF0AF25714F10868DD09597781D3B9A604CB95

Function 00416590 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004165C9
___std_exception_copy.LIBVCRUNTIME ref: 004165FC

Strings

)@, xrefs: 004165BA, 004165ED

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID: ___std_exception_copy
String ID: )@
API String ID: 2659868963-4120265097
Opcode ID: ec459901e9a8c12f2536e06f4ce64afd8286d8aca2aa337d2d7da09c98386d96
Instruction ID: 79ebb971947c26e29da123751e765caa72f3f100f47198c89106861aa63fe252
Opcode Fuzzy Hash: ec459901e9a8c12f2536e06f4ce64afd8286d8aca2aa337d2d7da09c98386d96
Instruction Fuzzy Hash: F0112EB6910649EBCB11CF99C980B86FBF8FF09724F10876AE82497641E774A5448BA0

Function 00407A20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00407A5C
___std_exception_destroy.LIBVCRUNTIME ref: 00407A72

Strings

)@, xrefs: 00407A52, 00407A6C

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: )@
API String ID: 4194217158-4120265097
Opcode ID: 9ee8fa866bcea9d2c14fc14309fcadf8facde4318e0e6bb098ed358a1a235593
Instruction ID: 96290d15a7b89a27e7413382239de33ac52fdad5c525fa7f0e86a9c1871ea130
Opcode Fuzzy Hash: 9ee8fa866bcea9d2c14fc14309fcadf8facde4318e0e6bb098ed358a1a235593
Instruction Fuzzy Hash: 68F012B1805744DFC711DF98C90178DFFF8FB05728F50466AE855A3780E7B5660487A5

Function 0043361D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00433077,?,?,?,?,004C7E2F), ref: 00433655
GetSystemTimeAsFileTime.KERNEL32(?,DDAEDC22,00000000,?,00551382,000000FF,?,00433077,?,?,?,?,004C7E2F), ref: 00433659

Strings

`-@, xrefs: 0043364F

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID: `-@
API String ID: 743729956-3781167437
Opcode ID: a70e229828252f114f3dcb939b169fb3f53d7191ad82fa45b454faadf805d98c
Instruction ID: 3e04e591088ee8cc2650925c1d28f2227fba881fd4e87dc1a7d03300bd93dc66
Opcode Fuzzy Hash: a70e229828252f114f3dcb939b169fb3f53d7191ad82fa45b454faadf805d98c
Instruction Fuzzy Hash: 73F0A032904A54EFCB118F44DC11B59BBA8F708B21F004626EC12A3790DB34A9049F94

Function 0044B7F4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00000016,00000001,004389D2,00000001,00000016,00438BE1,?,?,?,?,?,00000000), ref: 0044B834

Strings

InitializeCriticalSectionEx, xrefs: 0044B804
`-@, xrefs: 0044B824

Memory Dump Source

Source File: 00000006.00000002.3251394989.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3251332321.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251629705.0000000000585000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251661958.000000000058A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251692500.0000000000596000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000598000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000731000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000733000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000735000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000737000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000739000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000073F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000741000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000747000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000074B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000757000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000759000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000075E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000762000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000768000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000076E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000770000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000772000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000774000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000776000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000778000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.000000000077A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.0000000000786000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3251722909.00000000007B0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3253400969.0000000000980000.00000020.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_MPGPH131.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$`-@
API String ID: 2593887523-3269949891
Opcode ID: 1f2253b5c78e33ee57fe7f30907939316c5faef6f9275bf3e632fad4f43c2f0e
Instruction ID: 5bcc12c1b0658f8dc7434a33690804c70bb56e7eadbb0958c8ec10a8e9d05d13
Opcode Fuzzy Hash: 1f2253b5c78e33ee57fe7f30907939316c5faef6f9275bf3e632fad4f43c2f0e
Instruction Fuzzy Hash: BDE09236581318BBCB212F92DC06DAE7F25EB24BA2F048022FD1956161C7768821BBD9

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AlCsIOd0pd.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\MPGPH131\MPGPH131.exe

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

Windows Analysis Report
AlCsIOd0pd.exe

Function 00409280 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382
libraryloadernetworkCOMMON

Function 004C7B00 Relevance: 18.3, APIs: 12, Instructions: 279
networksleepCOMMON

Function 004C8590 Relevance: 12.1, APIs: 8, Instructions: 92
networkCOMMON

Function 00449789 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMON

Function 00448DFF Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Function 0044251C Relevance: 3.1, APIs: 2, Instructions: 52
COMMON

Function 004032D0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMONLIBRARYCODE

Function 0044A65A Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Function 0044B094 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE