Edit tour

Windows Analysis Report
aO1TcEaxfW.exe

Overview

General Information

Sample name:	aO1TcEaxfW.exe renamed because original name is a hash value
Original sample name:	e00ad02b0b162b28aa86c99845253184960e5532f7f74091cfb5a8a677084347.exe
Analysis ID:	1532628
MD5:	479c1f5c983e8c2e0f2f3b9a9ebb6d53
SHA1:	c7c3bcf6fd11e394af0964072cf97f2f7bc5daa7
SHA256:	e00ad02b0b162b28aa86c99845253184960e5532f7f74091cfb5a8a677084347
Tags:	exeuser-Chainskilabs
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Machine Learning detection for sample

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE / OLE file has an invalid certificate

Program does not show much activity (idle)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

aO1TcEaxfW.exe (PID: 2636 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 5540 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 4396 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 1776 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 1264 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 2804 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 380 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 1396 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 6300 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 2128 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 1372 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 5420 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 5488 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 1680 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 6108 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 5756 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 1900 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 2860 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 5396 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 2704 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 4444 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 6692 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 3008 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 3332 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 5940 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 5860 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 768 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 6004 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 1440 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 432 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 6644 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 2876 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 528 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 6412 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 1020 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 6476 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 6160 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 1988 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

aO1TcEaxfW.exe (PID: 6584 cmdline: "C:\Users\user\Desktop\aO1TcEaxfW.exe" MD5: 479C1F5C983E8C2E0F2F3B9A9EBB6D53)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: aO1TcEaxfW.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: aO1TcEaxfW.exe	ReversingLabs: Detection: 63%
Source: aO1TcEaxfW.exe	Virustotal: Detection: 67%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Machine Learning detection for sample

Source: aO1TcEaxfW.exe

Joe Sandbox ML: detected

Source: aO1TcEaxfW.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: aO1TcEaxfW.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_004D9E7A FindFirstFileExW,		0_2_004D9E7A
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 2_2_004D9E7A FindFirstFileExW,		2_2_004D9E7A

Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_004D4023	0_2_004D4023
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_004D9144	0_2_004D9144
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_004F0210	0_2_004F0210
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_0050E35E	0_2_0050E35E
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_0050740B	0_2_0050740B
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_00503525	0_2_00503525
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_004CC6FE	0_2_004CC6FE
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_004DD875	0_2_004DD875
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_004CFBD0	0_2_004CFBD0
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_004FDBE0	0_2_004FDBE0
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_00507C09	0_2_00507C09
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_004C1CD2	0_2_004C1CD2
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_004F2DF0	0_2_004F2DF0
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_0050BDB3	0_2_0050BDB3
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_004FAE7F	0_2_004FAE7F
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_004DBEF1	0_2_004DBEF1
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_004C1F1A	0_2_004C1F1A
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_004C6F3C	0_2_004C6F3C
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_004F2FB0	0_2_004F2FB0
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 2_2_004DD875	2_2_004DD875
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 2_2_004D4023	2_2_004D4023
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 2_2_004D9144	2_2_004D9144
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 2_2_004CFBD0	2_2_004CFBD0
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 2_2_004C1CD2	2_2_004C1CD2
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 2_2_004CC6FE	2_2_004CC6FE
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 2_2_004DBEF1	2_2_004DBEF1
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 2_2_004C1F1A	2_2_004C1F1A
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 2_2_004C6F3C	2_2_004C6F3C

Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: String function: 004D36CA appears 34 times
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: String function: 004CB3D1 appears 32 times
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: String function: 004CD615 appears 42 times
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: String function: 004C7830 appears 104 times
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: String function: 004F5C20 appears 55 times

Source: aO1TcEaxfW.exe

Static PE information: invalid certificate

Source: aO1TcEaxfW.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: aO1TcEaxfW.exe

Static PE information: Section: .data ZLIB complexity 0.9963478649434317

Source: classification engine

Classification label: mal64.winEXE@16226/0@0/0

Source: aO1TcEaxfW.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\aO1TcEaxfW.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: aO1TcEaxfW.exe	ReversingLabs: Detection: 63%
Source: aO1TcEaxfW.exe	Virustotal: Detection: 67%

Source: unknown	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\aO1TcEaxfW.exe

Section loaded: apphelp.dll

Jump to behavior

Source: aO1TcEaxfW.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: aO1TcEaxfW.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: aO1TcEaxfW.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: aO1TcEaxfW.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: aO1TcEaxfW.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: aO1TcEaxfW.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: aO1TcEaxfW.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: aO1TcEaxfW.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: aO1TcEaxfW.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: aO1TcEaxfW.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: aO1TcEaxfW.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: aO1TcEaxfW.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: aO1TcEaxfW.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_004C2198 push eax; ret	0_2_004C2392
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_0051637D push esi; ret	0_2_00516386
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_004F55D3 push ecx; ret	0_2_004F55E6
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_004C6E4B push ecx; ret	0_2_004C6E5E
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 2_2_004C2198 push eax; ret	2_2_004C2392
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 2_2_004C6E4B push ecx; ret	2_2_004C6E5E

Source: C:\Users\user\Desktop\aO1TcEaxfW.exe

API coverage: 3.9 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_004D9E7A FindFirstFileExW,		0_2_004D9E7A
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 2_2_004D9E7A FindFirstFileExW,		2_2_004D9E7A

Source: C:\Users\user\Desktop\aO1TcEaxfW.exe

Code function: 0_2_004CD27F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_004CD27F

Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_004C2198 mov edi, dword ptr fs:[00000030h]	0_2_004C2198
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_0050703C mov eax, dword ptr fs:[00000030h]	0_2_0050703C
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_004FF396 mov ecx, dword ptr fs:[00000030h]	0_2_004FF396
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_004DAA07 mov eax, dword ptr fs:[00000030h]	0_2_004DAA07
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_004D0E59 mov ecx, dword ptr fs:[00000030h]	0_2_004D0E59
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 2_2_004C2198 mov edi, dword ptr fs:[00000030h]	2_2_004C2198
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 2_2_004DAA07 mov eax, dword ptr fs:[00000030h]	2_2_004DAA07
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 2_2_004D0E59 mov ecx, dword ptr fs:[00000030h]	2_2_004D0E59

Source: C:\Users\user\Desktop\aO1TcEaxfW.exe

Code function: 0_2_004DD006 GetProcessHeap,

0_2_004DD006

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_004CD27F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004CD27F
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_004C72B0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_004C72B0
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_004C75D8 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004C75D8
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 0_2_004C7765 SetUnhandledExceptionFilter,	0_2_004C7765
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 2_2_004CD27F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_004CD27F
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 2_2_004C72B0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_004C72B0
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 2_2_004C75D8 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_004C75D8
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: 2_2_004C7765 SetUnhandledExceptionFilter,	2_2_004C7765

Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: C:\Users\user\Desktop\aO1TcEaxfW.exe "C:\Users\user\Desktop\aO1TcEaxfW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\aO1TcEaxfW.exe

Code function: 0_2_004F56D0 cpuid

0_2_004F56D0

Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_004DC440
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: EnumSystemLocalesW,	0_2_004D3436
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: EnumSystemLocalesW,	0_2_004DC6E2
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: EnumSystemLocalesW,	0_2_004DC72D
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: EnumSystemLocalesW,	0_2_004DC7C8
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_004DC853
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: GetLocaleInfoW,	0_2_004D38E0
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: GetLocaleInfoW,	0_2_004DCAA6
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_004DCBCF
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: GetLocaleInfoW,	0_2_004DCCD5
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_004DCDA4
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_004DC853
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: GetLocaleInfoW,	2_2_004D38E0
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: GetLocaleInfoW,	2_2_004DCAA6
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_004DCBCF
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	2_2_004DC440
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: EnumSystemLocalesW,	2_2_004D3436
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: GetLocaleInfoW,	2_2_004DCCD5
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_004DCDA4
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: EnumSystemLocalesW,	2_2_004DC6E2
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: EnumSystemLocalesW,	2_2_004DC72D
Source: C:\Users\user\Desktop\aO1TcEaxfW.exe	Code function: EnumSystemLocalesW,	2_2_004DC7C8

Source: C:\Users\user\Desktop\aO1TcEaxfW.exe

Code function: 0_2_004C74D2 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_004C74D2

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Software Packing	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Process Injection	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	22 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
aO1TcEaxfW.exe	63%	ReversingLabs	Win32.Spyware.Lummastealer
aO1TcEaxfW.exe	67%	Virustotal		Browse
aO1TcEaxfW.exe	100%	Avira	HEUR/AGEN.1361748
aO1TcEaxfW.exe	100%	Joe Sandbox ML

Domains and IPs

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532628
Start date and time:	2024-10-13 19:16:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	aO1TcEaxfW.exe renamed because original name is a hash value
Original Sample Name:	e00ad02b0b162b28aa86c99845253184960e5532f7f74091cfb5a8a677084347.exe
Detection:	MAL
Classification:	mal64.winEXE@16226/0@0/0
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 65% Number of executed functions: 5 Number of non-executed functions: 106
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, login.live.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target aO1TcEaxfW.exe, PID 5540 because there are no executed function
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.

Joe Sandbox View / Context

TlsFree, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, GetFileSizeEx, SetFilePointerEx, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetProcessHeap, HeapSize, WriteConsoleW

Target ID:	0
Start time:	13:16:58
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:17:02
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:17:02
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:17:02
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:17:02
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:17:02
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:17:02
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:17:02
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:17:02
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:17:02
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:17:02
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:17:02
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:17:02
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:17:02
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	13:17:02
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	13:17:02
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	13:17:02
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	13:17:02
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:17:02
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:17:02
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:17:02
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	13:17:02
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	13:17:03
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	13:17:03
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	13:17:03
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	13:17:03
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	13:17:03
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	13:17:03
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	13:17:03
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	13:17:03
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	13:17:03
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	13:17:03
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	13:17:04
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	13:17:04
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	13:17:04
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	13:17:04
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	13:17:04
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	13:17:04
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	13:17:04
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\aO1TcEaxfW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aO1TcEaxfW.exe"
Imagebase:	0x4c0000
File size:	1'040'784 bytes
MD5 hash:	479C1F5C983E8C2E0F2F3B9A9EBB6D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.2%
Total number of Nodes:	254
Total number of Limit Nodes:	5

Executed Functions

Function 004C2198 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 205
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004C241E: _strlen.LIBCMT ref: 004C2436

_strlen.LIBCMT ref: 004C220C
VirtualProtect.KERNELBASE(005B4300,000004E4,00000040,?,004EAABC,00000000,IOanz UZA891nNAIUsy U(Ahy8*! ), ref: 004C2337

Part of subcall function 004C28E9: __EH_prolog3_catch.LIBCMT ref: 004C28F0
Part of subcall function 004C28E9: _strlen.LIBCMT ref: 004C2908

Part of subcall function 004C31CE: __EH_prolog3_catch.LIBCMT ref: 004C31D5

Strings

IOanz UZA891nNAIUsy U(Ahy8*! , xrefs: 004C21AB

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: _strlen$H_prolog3_catch$ProtectVirtual
String ID: IOanz UZA891nNAIUsy U(Ahy8*!
API String ID: 2874085908-4274611474
Opcode ID: 1e19a4f26aff960fcfa94ef71e80e1739f92dd7ef1120d71bf26d2ddac4356f7
Instruction ID: 439eebd7acef25890cc4937fd030bdbc0c86396af0106aacb30f77a88751d5cb
Opcode Fuzzy Hash: 1e19a4f26aff960fcfa94ef71e80e1739f92dd7ef1120d71bf26d2ddac4356f7
Instruction Fuzzy Hash: D551253AE10208AFDB04EAA5D945FEEB7B5EB48314F10813FF505A72D0DBBC58008B58

Function 004D8805 Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__freea.LIBCMT ref: 004D89B4

Part of subcall function 004D3E14: HeapAlloc.KERNEL32(00000000,00000000,?,?,004C78E5,?,?,?,?,?,004C11CC,?,00000001), ref: 004D3E46

__freea.LIBCMT ref: 004D89C9
__freea.LIBCMT ref: 004D89D9

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: __freea$AllocHeap
String ID:
API String ID: 85559729-0
Opcode ID: 8af9d88884d35ebe34b43ad3e29ef371c157cc707e79587109583041cd3a1db4
Instruction ID: 4e26d7fbcbfb3d2d06f33ed69dbacfbef018e0e94c771cc3fc464809aab155c3
Opcode Fuzzy Hash: 8af9d88884d35ebe34b43ad3e29ef371c157cc707e79587109583041cd3a1db4
Instruction Fuzzy Hash: DF51D5B2600106AFEF219E65CCA1EBB36A9EF44354B15016FFC44E7350EE39CD109B6A

Function 004DA761 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004DA291: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 004DA2BC

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,004DA5A8,?,00000000,?,?,?), ref: 004DA7C2
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,004DA5A8,?,00000000,?,?,?), ref: 004DA804

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 7c00dd80a1c5ec4addbc55db15c87d7e0e3ea370253d28ce18c1215639423ed1
Instruction ID: 5f66ea0674623ee5d015eac514368a3903ec55af1fa529d7b15a69dbd1e7916a
Opcode Fuzzy Hash: 7c00dd80a1c5ec4addbc55db15c87d7e0e3ea370253d28ce18c1215639423ed1
Instruction Fuzzy Hash: 81510370A002458EDB20DF26C8A56ABBBF5FF41304F18486FE48687352E67899569B4A

Function 004D3A1D Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,004D88F3,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 004D3A51
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,004D88F3,?,?,00000000,?,00000000), ref: 004D3A6F

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 2bb66d55ea816c32679566faafc008404ed496f354da25580c8e5796e86305a6
Instruction ID: 34d9478228c8db1fdaea8369d0beca5a6d320efab8dd239f5225d1538fa3cb42
Opcode Fuzzy Hash: 2bb66d55ea816c32679566faafc008404ed496f354da25580c8e5796e86305a6
Instruction Fuzzy Hash: CCF09D3210015ABBCF139F91DC19EEE3F66FF48766F054016FA1925220C736CA72AB96

Function 004DA365 Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,004DA5B4,004DA5A8,00000000), ref: 004DA397

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 25e6b3315d85c755cbfd6cfd8fbe79ec5220ffec3451c50d53336e9ef6cd8f56
Instruction ID: 07f4936cad8acc6373118f721efd4b9701e6ddb00717fe436bbcb70606b95414
Opcode Fuzzy Hash: 25e6b3315d85c755cbfd6cfd8fbe79ec5220ffec3451c50d53336e9ef6cd8f56
Instruction Fuzzy Hash: 1A517E715042589ADB218E28CD94AFA7BBCEB45304F2405EFE49AC7342D3789E46DF26

Non-executed Functions

Function 004DCDA4 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004D5215: GetLastError.KERNEL32(?,00000000,004CFB7F,?,?,?,?,00000003,004CC27B,?,?,?,?,00000000), ref: 004D5219
Part of subcall function 004D5215: SetLastError.KERNEL32(00000000,?,?,?,00000003,004CC27B,?,?,?,?,00000000), ref: 004D52BB

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 004DCEB0
IsValidCodePage.KERNEL32(00000000), ref: 004DCEF9
IsValidLocale.KERNEL32(?,00000001), ref: 004DCF08
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 004DCF50
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 004DCF6F

Strings

`uN, xrefs: 004DCE5D

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: `uN
API String ID: 415426439-1958408982
Opcode ID: 4136ec0ffed96aadd48030be4d299f4c56ee55b6273004dca2a27f35fd73d41f
Instruction ID: ab3995da11208ec982ff8b46df53e018dee085eaacc29865cbe77a5f666ca41c
Opcode Fuzzy Hash: 4136ec0ffed96aadd48030be4d299f4c56ee55b6273004dca2a27f35fd73d41f
Instruction Fuzzy Hash: 08517FB2A00206ABDF10DFA5CCD1ABF77B9AF04701F14456BE504EB391E7789A04CB69

Function 004DD875 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 004DDA59

Strings

1#SNAN, xrefs: 004DD981
1#QNAN, xrefs: 004DD988
1#INF, xrefs: 004DD9AB
1#IND, xrefs: 004DD97A

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: cb58271ccd5f7219ff65f5e5415f5b335f72a073dab08ca914a5d228c8a1a04b
Instruction ID: 164a472c0bfa04925de49170c95a2c77baf69f8bfe2deca39ef3c2aabd831399
Opcode Fuzzy Hash: cb58271ccd5f7219ff65f5e5415f5b335f72a073dab08ca914a5d228c8a1a04b
Instruction Fuzzy Hash: 74D21571E082298BDB65DE29CD50BEAB7B5EB44305F1441EBD40EE7340EB78AE818F45

Function 004DC440 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004D5215: GetLastError.KERNEL32(?,00000000,004CFB7F,?,?,?,?,00000003,004CC27B,?,?,?,?,00000000), ref: 004D5219
Part of subcall function 004D5215: SetLastError.KERNEL32(00000000,?,?,?,00000003,004CC27B,?,?,?,?,00000000), ref: 004D52BB

GetACP.KERNEL32(?,?,?,?,?,?,004D1773,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 004DC501
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,004D1773,?,?,?,00000055,?,-00000050,?,?), ref: 004DC52C
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 004DC68F

Strings

`uN, xrefs: 004DC4B7
utf8, xrefs: 004DC5FE

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: `uN$utf8
API String ID: 607553120-506889755
Opcode ID: 40ae614af944a7c5fd5864c8ef2d98dbad0911e66e79a14ac830152f60e99aba
Instruction ID: e10c6afdb8d472600e3057e28e639eeebca04d95dc7a0143f9f5e6de6bc069a7
Opcode Fuzzy Hash: 40ae614af944a7c5fd5864c8ef2d98dbad0911e66e79a14ac830152f60e99aba
Instruction Fuzzy Hash: 3671E271A00207AAD724AB76CCA6BBB73A8EF05714F14442BF505DB381EA79ED40C66D

Function 004DCBCF Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,004DCEED,00000002,00000000,?,?,?,004DCEED,?,00000000), ref: 004DCC68
GetLocaleInfoW.KERNEL32(?,20001004,004DCEED,00000002,00000000,?,?,?,004DCEED,?,00000000), ref: 004DCC91
GetACP.KERNEL32(?,?,004DCEED,?,00000000), ref: 004DCCA6

Strings

OCP, xrefs: 004DCC23
ACP, xrefs: 004DCBED

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 90078d3225666d6893302c9b37df74223b3f17fa29b9321d729125372d092dea
Instruction ID: f296d936602206417e0987f30810f53e2223810d259bb9dba5a9a94164e8b692
Opcode Fuzzy Hash: 90078d3225666d6893302c9b37df74223b3f17fa29b9321d729125372d092dea
Instruction Fuzzy Hash: B621CB32720102A6DB348F25C9A5A97B3A6EF50F61B568467E70ED7304E736DE41C35C

Function 004D4023 Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 004D40B0

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 17a8af3533a897e6e906cec53c923a3a22616cf0740b16545c45100316cc9468
Instruction ID: a16a4b82de38bc13296bbb2843f4eb647f8d769884c50436b4152a7a34eefb0e
Opcode Fuzzy Hash: 17a8af3533a897e6e906cec53c923a3a22616cf0740b16545c45100316cc9468
Instruction Fuzzy Hash: 61B15932A002859FDB15CF68C8A17FFBBE5EF95344F1581ABE804AB341D2389D01C769

Function 00503525 Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 005035B2

Memory Dump Source

Source File: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 2105af1ce281aa8cf08cd6a1838856530ae0e12a9ea78a25eca6150783de226d
Instruction ID: d426cee4e1eda2b2338a6667bfce5f27ae6ebc338a4c7499eda03c960587863e
Opcode Fuzzy Hash: 2105af1ce281aa8cf08cd6a1838856530ae0e12a9ea78a25eca6150783de226d
Instruction Fuzzy Hash: 21B139B29052469FDB258F68C8817EEBFA9FF55310F14816AE805AB382D375DF01C7A0

Function 004C75D8 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 004C75E4
IsDebuggerPresent.KERNEL32 ref: 004C76B0
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004C76C9
UnhandledExceptionFilter.KERNEL32(?), ref: 004C76D3

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: cc7343ddf99e75bdd7de30d84addadc0c0c9b906c1a45485dec29e488c02ec7d
Instruction ID: 31f8bddbacdf0e0be1122fd933de58efb82dfb38cd216efd3957938e8f53d13e
Opcode Fuzzy Hash: cc7343ddf99e75bdd7de30d84addadc0c0c9b906c1a45485dec29e488c02ec7d
Instruction Fuzzy Hash: 7C310779D052589BDB61DF64D989BCDBBB8BF08304F1041AAE40CAB250EB749B848F48

Function 004C1CD2 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 187COMMON

Download Yara Rule

APIs

Part of subcall function 004C3348: __EH_prolog3_catch.LIBCMT ref: 004C334F

_Deallocate.LIBCONCRT ref: 004C1EAD
_Deallocate.LIBCONCRT ref: 004C1EFA

Strings

Current val: %d, xrefs: 004C1E86

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: Deallocate$H_prolog3_catch
String ID: Current val: %d
API String ID: 1212816977-1825967858
Opcode ID: 0c5ece480e667c3aade1e7a2071629e511f587d41bc5a7464e326e17ed6afd97
Instruction ID: 290b1c11bd000a2843c6c844fa62112e16a5d9c403b9d44406169b4627206d3f
Opcode Fuzzy Hash: 0c5ece480e667c3aade1e7a2071629e511f587d41bc5a7464e326e17ed6afd97
Instruction Fuzzy Hash: 4C61DE7651C3818FC350DF2AD480A6BFBE0AFC9714F144A2EF9D593252D739E9048B9A

Function 004F0210 Relevance: 4.7, Strings: 2, Instructions: 2226COMMON

Download Yara Rule

Strings

p`C, xrefs: 004F1844
, xrefs: 004F16D2

Memory Dump Source

Source File: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID:
String ID: $p`C
API String ID: 0-4134204333
Opcode ID: 7c1bf759990cea01889fddccd937b28553c04d3b666f7c82e54e0ff48d564f50
Instruction ID: d5b23b84952c7e8b6affd0b02e411b2836e00269c54d9366f929cda272567d1c
Opcode Fuzzy Hash: 7c1bf759990cea01889fddccd937b28553c04d3b666f7c82e54e0ff48d564f50
Instruction Fuzzy Hash: 6CD2D127620A0A4BE31C9939CD523F6B686EBDA320F45433BFAA5D73F1D37948428745

Function 004DC853 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 004D5215: GetLastError.KERNEL32(?,00000000,004CFB7F,?,?,?,?,00000003,004CC27B,?,?,?,?,00000000), ref: 004D5219
Part of subcall function 004D5215: SetLastError.KERNEL32(00000000,?,?,?,00000003,004CC27B,?,?,?,?,00000000), ref: 004D52BB

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004DC8A7
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004DC8F1
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004DC9B7

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: dbf1b8ca590e669cba44b756787234759571e8161c24b68897877547ff49db60
Instruction ID: e0f4444a4909dd5058defdc8274c86b0592f4e976cedca55c313515433c7d463
Opcode Fuzzy Hash: dbf1b8ca590e669cba44b756787234759571e8161c24b68897877547ff49db60
Instruction Fuzzy Hash: 6B618F7195011B9BDB28DF29CCE2BAAB7A8EF04314F1041BBE905D6385EB38D945CF58

Function 004CD27F Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 004CD377
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 004CD381
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 004CD38E

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: b6de86447dc22fdf3f0768ecc2770519a26e1d95b3671cfd979757da6056f79f
Instruction ID: b0f04b2f1f4c51f1226533f8b055fedf788e79fa04d5f6f3cdb381c45b628a7b
Opcode Fuzzy Hash: b6de86447dc22fdf3f0768ecc2770519a26e1d95b3671cfd979757da6056f79f
Instruction Fuzzy Hash: 5F31F674901218ABCB61DF65DD89B9DBBB4BF08310F5041EAE41CA7261EB349F858F48

Function 004CFBD0 Relevance: 3.4, APIs: 2, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71130d6100ede6563424b8a4d7df45df7381647f619140e561abbae099e1f578
Instruction ID: bdb83a348c6a3ad334daa70ae6c0f2730875682c7ff582ed18ea900e36c080c6
Opcode Fuzzy Hash: 71130d6100ede6563424b8a4d7df45df7381647f619140e561abbae099e1f578
Instruction Fuzzy Hash: 7BF14E75E002199FDF14CF69D880BAEB7B2FF89314F15826EE815A7391D738AD058B84

Function 004FDBE0 Relevance: 3.4, APIs: 2, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddea241b9222524aa140a82a6791fc6d0ddcc5cf7be7707f7ebfe0d02a874e92
Instruction ID: 4749fb5482a93915d94f46e9b5283d9c5cddaed7c47accdafcae5bff39ddaf69
Opcode Fuzzy Hash: ddea241b9222524aa140a82a6791fc6d0ddcc5cf7be7707f7ebfe0d02a874e92
Instruction Fuzzy Hash: A7F15F71E002199FDF14CF69C880AAEB7B2FF89314F15826EE919AB394D7349D41CB94

Function 0050E35E Relevance: 2.9, APIs: 1, Instructions: 1436COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0050E542

Memory Dump Source

Source File: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: __floor_pentium4
String ID:
API String ID: 4168288129-0
Opcode ID: 942fe0f3c29f653e39a35ed8cb6196759c4aba01ded4976b721137ac199a4da5
Instruction ID: e869c025661fde07b22620491e8c02390c7cd1a50eba2c73c94adaba9b8b0d8e
Opcode Fuzzy Hash: 942fe0f3c29f653e39a35ed8cb6196759c4aba01ded4976b721137ac199a4da5
Instruction Fuzzy Hash: 7CD21871E082298FDB65CE28DD457EEBBB5FB44304F1445EAD44DA7280DB78AE858F40

Function 004D9144 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,004D913F,?,?,00000008,?,?,004E15B5,00000000), ref: 004D9371

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 2188581ec020ef70aa659af0711484c0219602e939d292b00e6279d26ee6ed55
Instruction ID: d90f45a6b3799db1d50b444b6bcc4603007d332cd4256627b65402fac74c67cc
Opcode Fuzzy Hash: 2188581ec020ef70aa659af0711484c0219602e939d292b00e6279d26ee6ed55
Instruction Fuzzy Hash: 3EB13D31610609DFD715CF28C496B657BA0FF49364F25869AE899CF3A1C339ED82CB44

Function 004C6F3C Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 004C6F52

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 1e34fa5ef17f28ef501dc7d6dc56b37adbc515efe23127b15979d9a6b2aac0ac
Instruction ID: f5367342cb083fc700ea652ef28f1ff84b5c04cc65be839b2468e593d042382c
Opcode Fuzzy Hash: 1e34fa5ef17f28ef501dc7d6dc56b37adbc515efe23127b15979d9a6b2aac0ac
Instruction Fuzzy Hash: ABA1CEB59046548FDB58CF69E8C27AABBF0FB88324F14812ED608EB351D3799940CF58

Function 004D9E7A Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 990b271d8729bb7eb1f16322a3715aa57dfe855deceacbad75902106d1e9bc2e
Instruction ID: eca71b1d0f87f51100dc2db0268d57e2166ff7dff81653a1be6bf26148984c05
Opcode Fuzzy Hash: 990b271d8729bb7eb1f16322a3715aa57dfe855deceacbad75902106d1e9bc2e
Instruction Fuzzy Hash: EB31F572900219AFCB20DFA9CC99DBBB77DEB84314F14455EF805D7344EA34AE408B68

Function 004DCAA6 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 004D5215: GetLastError.KERNEL32(?,00000000,004CFB7F,?,?,?,?,00000003,004CC27B,?,?,?,?,00000000), ref: 004D5219
Part of subcall function 004D5215: SetLastError.KERNEL32(00000000,?,?,?,00000003,004CC27B,?,?,?,?,00000000), ref: 004D52BB

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004DCAFA

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 1a29a6157bf3a44074cac694b557486bffd477a4bda642f4d6e6c471ab213b6b
Instruction ID: 90a08b531a7d47b484d8e42f6dee02664bafc12dca881ec4af90b9b322a36645
Opcode Fuzzy Hash: 1a29a6157bf3a44074cac694b557486bffd477a4bda642f4d6e6c471ab213b6b
Instruction Fuzzy Hash: 98216572A541075BDB149B16ECA2A7B73A8EB05714B10007FF905DA341EA78ED05CA58

Function 004FAE7F Relevance: 1.6, Strings: 1, Instructions: 314COMMON

Download Yara Rule

Strings

0, xrefs: 004FB009

Memory Dump Source

Source File: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 1632f8d23e9e32ab9f3a7bcd8b2446ae787a5851f4b5be5d31f7a579b1156ae9
Instruction ID: a58379157ae692600ae4a6791cd51f94e3683ab298b805b1ca37e2d330d50d36
Opcode Fuzzy Hash: 1632f8d23e9e32ab9f3a7bcd8b2446ae787a5851f4b5be5d31f7a579b1156ae9
Instruction Fuzzy Hash: F6B1B2B090060E8BCB24CF69C591ABFB7B1EB02304F14451FDB569B781DB399951CBAA

Function 004DC72D Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004D5215: GetLastError.KERNEL32(?,00000000,004CFB7F,?,?,?,?,00000003,004CC27B,?,?,?,?,00000000), ref: 004D5219
Part of subcall function 004D5215: SetLastError.KERNEL32(00000000,?,?,?,00000003,004CC27B,?,?,?,?,00000000), ref: 004D52BB

EnumSystemLocalesW.KERNEL32(004DC853,00000001,00000000,?,-00000050,?,004DCE84,00000000,?,?,?,00000055,?), ref: 004DC79F

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: fb71e3e76c764e9a1b710d1bf37203736dfa014efaca71995af44394ee71ac1a
Instruction ID: 1da83f696391be4185601f616f8d4e346bf359d4fe38b92b302860be4be201a1
Opcode Fuzzy Hash: fb71e3e76c764e9a1b710d1bf37203736dfa014efaca71995af44394ee71ac1a
Instruction Fuzzy Hash: 0B11293B6047025FDB18AF79C8E56BAB791FF80719B14442EE54647B40D775A902CF44

Function 004DCCD5 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 004D5215: GetLastError.KERNEL32(?,00000000,004CFB7F,?,?,?,?,00000003,004CC27B,?,?,?,?,00000000), ref: 004D5219
Part of subcall function 004D5215: SetLastError.KERNEL32(00000000,?,?,?,00000003,004CC27B,?,?,?,?,00000000), ref: 004D52BB

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,004DCA6F,00000000,00000000,?), ref: 004DCD01

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 425c2749ca9867c2b211bcf931d21a06dfe78f027f2b2106a52e783c116dc266
Instruction ID: b4189fb848c2528c50c4e5de393a95f34227e9162c21cac64e076fd869b4be4a
Opcode Fuzzy Hash: 425c2749ca9867c2b211bcf931d21a06dfe78f027f2b2106a52e783c116dc266
Instruction Fuzzy Hash: F1F0D6326101136BDF245A618CA5ABB7B69EB40754F14487BEC15A3340DA3CEE01CAD4

Function 004DC7C8 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004D5215: GetLastError.KERNEL32(?,00000000,004CFB7F,?,?,?,?,00000003,004CC27B,?,?,?,?,00000000), ref: 004D5219
Part of subcall function 004D5215: SetLastError.KERNEL32(00000000,?,?,?,00000003,004CC27B,?,?,?,?,00000000), ref: 004D52BB

EnumSystemLocalesW.KERNEL32(004DCAA6,00000001,?,?,-00000050,?,004DCE48,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 004DC812

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 6e67b2abeca06124506bf0138f98ce1c96050183a23b534522db67883969469e
Instruction ID: bf583f5bad2fcf58ac975ba9eca51e2f708483f71a4a2549ae62a2181301acb2
Opcode Fuzzy Hash: 6e67b2abeca06124506bf0138f98ce1c96050183a23b534522db67883969469e
Instruction Fuzzy Hash: E6F022323003065FCB246F7698D5A6ABB90FB80329B14406FF9058B780C7B5AC01DA58

Function 004D3436 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004CD5CD: EnterCriticalSection.KERNEL32(-005B5550,?,004D03E7,00000000,004EC430,0000000C,004D03AE,?,?,004D33C5,?,?,004D53B3,00000001,00000364,00000000), ref: 004CD5DC

EnumSystemLocalesW.KERNEL32(004D3429,00000001,004EC580,0000000C,004D37DC,00000000), ref: 004D346E

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 90e9c1c7093d4aec0733c2c94292fe5243dc58c19850d4951c62a48cd2de5e12
Instruction ID: e4a3e71f8f521c5872bd125c40e27129302946d930e69163f99f615fed2fd131
Opcode Fuzzy Hash: 90e9c1c7093d4aec0733c2c94292fe5243dc58c19850d4951c62a48cd2de5e12
Instruction Fuzzy Hash: ABF03776A00214EFD701EF99E842B9C77B0FB48726F10466BE410DB2A1D7799A04CF49

Function 004DC6E2 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004D5215: GetLastError.KERNEL32(?,00000000,004CFB7F,?,?,?,?,00000003,004CC27B,?,?,?,?,00000000), ref: 004D5219
Part of subcall function 004D5215: SetLastError.KERNEL32(00000000,?,?,?,00000003,004CC27B,?,?,?,?,00000000), ref: 004D52BB

EnumSystemLocalesW.KERNEL32(004DC63B,00000001,?,?,?,004DCEA6,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 004DC719

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: aac747fb310ab717d0d760d14ce24aeba695579884d4d77e870f3fefc1126d4f
Instruction ID: 05a95464563fb8e27b9269c38a75454ab22b04c02fcdcef1025d6cceb8edaccc
Opcode Fuzzy Hash: aac747fb310ab717d0d760d14ce24aeba695579884d4d77e870f3fefc1126d4f
Instruction Fuzzy Hash: 24F0E53A34020657CB04AF76D8A5B6BBF94EFC1754B0A409BEA098B391C679D943CB94

Function 004D38E0 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,004D22D9,?,20001004,00000000,00000002,?,?,004D18DB), ref: 004D3914

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 97d0c2a6f371a2a52f3782f1d85efd6bd697d01914b287f07674e2ca5d32aba4
Instruction ID: 1715acc850e0921878ddbffdb0a37565a2b36307bfcece00b8cc707df7192d8d
Opcode Fuzzy Hash: 97d0c2a6f371a2a52f3782f1d85efd6bd697d01914b287f07674e2ca5d32aba4
Instruction Fuzzy Hash: 1AE04F76500128BBCF126F61DC29AAE7F26EF44762F004027FD4566321CB758F21AADA

Function 004C7765 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00007771,004C6A67), ref: 004C776A

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8270c4a0000ae84dd4abe3c885c1597be9d987fbb291dab97f26bb99c455fbff
Instruction ID: b3db126ca7c25aca55b9a96ff612541ec48946d935621f4dd143b58c0543924c
Opcode Fuzzy Hash: 8270c4a0000ae84dd4abe3c885c1597be9d987fbb291dab97f26bb99c455fbff
Instruction Fuzzy Hash:

Function 004C1F1A Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Z81xbyuAua, xrefs: 004C203C

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID:
String ID: Z81xbyuAua
API String ID: 0-3121583705
Opcode ID: 3f30ecf3cfb6df1267f4d54dd9a80f8470a32b593f4005cb04432b11f827557a
Instruction ID: de43aef61e8653ed250779edc25eb52f8a4cd07af31b0ae0bab52831b52762a2
Opcode Fuzzy Hash: 3f30ecf3cfb6df1267f4d54dd9a80f8470a32b593f4005cb04432b11f827557a
Instruction Fuzzy Hash: BB414E76E1052B4BCB4CEEB9C9455AFBB65E746310B04427FDE11DB3D1E2748A01CAD4

Function 004DD006 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 004DD006

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 01ccc3dbc57af60c8b6c1beac5cc4dfb02e4c9973eabc1a9a69538856e8d4824
Instruction ID: 91b456c2fa7463f09550a271a91598e216dc4e0c3091552840b0c4f0d4f50588
Opcode Fuzzy Hash: 01ccc3dbc57af60c8b6c1beac5cc4dfb02e4c9973eabc1a9a69538856e8d4824
Instruction Fuzzy Hash: 0BA012301001008F43408F35594D30C77A45600181348C26A5000C5031E62445406F00

Function 00507C09 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a38eda1e5fe163a9d2d8931a55af3b0b8e09c8fe7de01bd8f0dbc5a1a148cf17
Instruction ID: 8a80d40a6afe9bf5cf60f7c7f0ae51077c61999a084cb7e2f69ae2c48cfd9810
Opcode Fuzzy Hash: a38eda1e5fe163a9d2d8931a55af3b0b8e09c8fe7de01bd8f0dbc5a1a148cf17
Instruction Fuzzy Hash: 6A322221E29F014ED7239634DC2233AAA48BFB73D4F55D737E819B59A6EF29C4934101

Function 0050BDB3 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5aa115f7b62961c69c6af82bb8e917d91efee6d1de70f3159456f9e0484eb9b
Instruction ID: a264b1514ffffc5874612e680ad18726d589637d9003df63e2905038a167b94d
Opcode Fuzzy Hash: f5aa115f7b62961c69c6af82bb8e917d91efee6d1de70f3159456f9e0484eb9b
Instruction Fuzzy Hash: 85B1F5356007029BDB38AF25CC96BBFBBA8FF45708F14456DEA83865C0E775A985CB10

Function 004DBEF1 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 6fa5cf44366eb58c23f911707b39be87179586595b347a651a772d7e55a6c6ae
Instruction ID: 5a02d764e8b908bf58fc2651efe6b4519ab3e069a8d2ba2edc564db959e4f7a0
Opcode Fuzzy Hash: 6fa5cf44366eb58c23f911707b39be87179586595b347a651a772d7e55a6c6ae
Instruction Fuzzy Hash: 5EB118355007429BDB349F65CCE2ABBB3E8EF44308F54456FE942C6781EB79A985CB08

Function 004CC6FE Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5304c0cad711593c9a311b51f9fcfb05ad03deacda0e06d56bf3f623eb1870d
Instruction ID: a171d8dc2ad720349a7c69a490599d2890f2849870b84d3650a65601410de531
Opcode Fuzzy Hash: c5304c0cad711593c9a311b51f9fcfb05ad03deacda0e06d56bf3f623eb1870d
Instruction Fuzzy Hash: F6B1DDB890060B8BCBA4CA6885D5FBFB7A1EB05304F14061FD45AA7791C739D942CB9E

Function 0050740B Relevance: .3, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66bd135522bfd48ef431717ac9a2d3ac4e718912ce61b150da326bc1aaae8d12
Instruction ID: e1f6f0c8a08dd956e7b84a8bd6d9694527a109c69dd75ee18b13d9fa827cf235
Opcode Fuzzy Hash: 66bd135522bfd48ef431717ac9a2d3ac4e718912ce61b150da326bc1aaae8d12
Instruction Fuzzy Hash: 1EB11F71A14609DFDB15CF2CC486A997FA0FF49364F258658E89ACF2E1C336E991CB40

Function 004F2FB0 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93b451423774f390a84f535dcfe3ba546839b42ee0b499e0766b2c7a98dc649c
Instruction ID: d07c145b4fb86bf32b275ddca0000d6174c1dae9ef55c472fb3c3c85e205dba9
Opcode Fuzzy Hash: 93b451423774f390a84f535dcfe3ba546839b42ee0b499e0766b2c7a98dc649c
Instruction Fuzzy Hash: DA51E6317116168FD708CF39C991A66F7E2FB98310F04876AE529CB281EB34E915CB94

Function 004F56D0 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96a2ba3aa580dc615e5e38e6a61e3a4296c942238419a14d8ec0a8789d2e52c4
Instruction ID: 2b2c74bd14e73b16252346f96c9974427fc8d5f1040df4b9b09b338a5ab63764
Opcode Fuzzy Hash: 96a2ba3aa580dc615e5e38e6a61e3a4296c942238419a14d8ec0a8789d2e52c4
Instruction Fuzzy Hash: 45518EB1E11A19CFDB18CF54E9857AABBF0FB48351F24953AD601EB390D378A900CB58

Function 004F2DF0 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c71e8a4d4c822c2af38b7bb403b9e2aeae5574d6a876ff0dc428173de2df168
Instruction ID: 72758cc61ff716e0d173fa98eada8b0fd66eb47900372df42d253c73173009bc
Opcode Fuzzy Hash: 8c71e8a4d4c822c2af38b7bb403b9e2aeae5574d6a876ff0dc428173de2df168
Instruction Fuzzy Hash: AF51B231711A168FD70CCF39C995AA6B7E1FB98310F148769E42ACB2D2DB34A914CB94

Function 0050703C Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa0ba1e5d9a22f7c6db1b863d068fd7604d8ca8b2c2046f773a74d09f23aaf89
Instruction ID: c9efd0c5340889ace06fd430962f9129261a3512b156de6d8b24c4e56b15ad79
Opcode Fuzzy Hash: fa0ba1e5d9a22f7c6db1b863d068fd7604d8ca8b2c2046f773a74d09f23aaf89
Instruction Fuzzy Hash: 40E04632915268EBCB24DB99892898AB6ACFB88B00B5145A6B501D3280C670EE00CBD0

Function 004DAA07 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 110e375efb2033e03ce8b70e48f77e8cdc524782d876c586b63fa1f672508759
Instruction ID: c74547eb0855e715a81899ed11ed0007a4db1acddf66b89d729d14bc3b00c7a0
Opcode Fuzzy Hash: 110e375efb2033e03ce8b70e48f77e8cdc524782d876c586b63fa1f672508759
Instruction Fuzzy Hash: 31E04672921228EBCB15DBC98A1498AB2ECEB44B44B11419BB501D3311C2B8DE00CBE5

Function 004FF396 Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eafc9afbd71d0c63c25bd700d152b00fba6a1b79f89aedc9458559ba3c3e83a7
Instruction ID: e68cd119ccdd460209cd76909c126991c8e0a903f27a7e10f9cd86c85a7f6d50
Opcode Fuzzy Hash: eafc9afbd71d0c63c25bd700d152b00fba6a1b79f89aedc9458559ba3c3e83a7
Instruction Fuzzy Hash: EFC08C3501590987CE298D1082753BE3358FBD1BC2F80049DCF024B783C91EAC8ADE90

Function 004D0E59 Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 352c58746815d872af4b3af9a2255c15039a5ed1f7fec551035c6ea349d431e8
Instruction ID: 724ad65489f929b6e8a62c2e80d49b6501006e724cec027844c7a480c8183072
Opcode Fuzzy Hash: 352c58746815d872af4b3af9a2255c15039a5ed1f7fec551035c6ea349d431e8
Instruction Fuzzy Hash: 10C08C3518094046CE298910C3713AA3354E3F67C3FC0088FC4030B752C62E9C86D709

Function 004F2A10 Relevance: 15.2, APIs: 10, Instructions: 191
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004F2A3C
std::_Lockit::_Lockit.LIBCPMT ref: 004F2A59
std::_Lockit::~_Lockit.LIBCPMT ref: 004F2A7D
std::_Lockit::~_Lockit.LIBCPMT ref: 004F2AA8
std::_Lockit::_Lockit.LIBCPMT ref: 004F2B1A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 004F2B6F
__Getctype.LIBCPMT ref: 004F2B86
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 004F2BC6
std::_Lockit::~_Lockit.LIBCPMT ref: 004F2C68
std::_Facet_Register.LIBCPMT ref: 004F2C6E

Memory Dump Source

Source File: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_GetctypeLocinfo_ctorLocinfo_dtorRegister
String ID:
API String ID: 103145292-0
Opcode ID: 0e92b9310a67500b865c09545a8f2bb56ed2792cd4dae89ee153d5d1402e315f
Instruction ID: 754d71f69a9f4de1ecace718964a9ab2f0b35a1bd4afc0f8869b24986ee826d1
Opcode Fuzzy Hash: 0e92b9310a67500b865c09545a8f2bb56ed2792cd4dae89ee153d5d1402e315f
Instruction Fuzzy Hash: F361B2B19043849FD720DF25D941B6BB7E4BF94304F04582EFA8997311EB78E944CB9A

Function 004F8888 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 004F89A7
___TypeMatch.LIBVCRUNTIME ref: 004F8AB5
_UnwindNestedFrames.LIBCMT ref: 004F8C07
CallUnexpected.LIBVCRUNTIME ref: 004F8C22

Strings

csm, xrefs: 004F89DE
csm, xrefs: 004F8932
csm, xrefs: 004F88C5

Memory Dump Source

Source File: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: bca48ede98bc9644994582ff637e3a37132db79052d9ea52617ab948eb45153a
Instruction ID: a804e3c725c2516a535762cce207620dec127af1e269e8481c79d6f40371706f
Opcode Fuzzy Hash: bca48ede98bc9644994582ff637e3a37132db79052d9ea52617ab948eb45153a
Instruction Fuzzy Hash: FCB156B180020DAFCF14DFA5C8819BEB7B5EF15314B14445FEA106F202DB78EA51CBAA

Function 004D768F Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 004D7908

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 75f8db5692d6d32213a861d6597d5b5989ce04d401f4f97b81a88f5f61dea488
Instruction ID: 1a98b4844ae0108cac7eef90246f0306295ac8079451f0927fb698838c8008e2
Opcode Fuzzy Hash: 75f8db5692d6d32213a861d6597d5b5989ce04d401f4f97b81a88f5f61dea488
Instruction Fuzzy Hash: E8B139B5E08205EFDB01DFA9C8A1BAE7BB1AF45314F14419BE40067391E7789E46CF29

Function 004CA278 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 004CA397
___TypeMatch.LIBVCRUNTIME ref: 004CA4A5
CallUnexpected.LIBVCRUNTIME ref: 004CA612

Strings

csm, xrefs: 004CA322
csm, xrefs: 004CA3CE
csm, xrefs: 004CA2B5

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: bd084257eb1abc2b7bf058a13017993e4ea80041defd002e1bc622ecf5c51fb8
Instruction ID: f3d325c2e5bfb8f6c2ba4a50cd6a363858344b7d3b86c2090f375d4f405ed108
Opcode Fuzzy Hash: bd084257eb1abc2b7bf058a13017993e4ea80041defd002e1bc622ecf5c51fb8
Instruction Fuzzy Hash: E7B1897980020DEFCF55DF95C885EAEBBB5AF04308B14805FE8006B252D739DE61CB9A

Function 00512215 Relevance: 10.7, APIs: 7, Instructions: 248
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__alloca_probe_16.LIBCMT ref: 00512376
__alloca_probe_16.LIBCMT ref: 00512405
__freea.LIBCMT ref: 00512450
__freea.LIBCMT ref: 00512456
__freea.LIBCMT ref: 0051248C
__freea.LIBCMT ref: 00512492
__freea.LIBCMT ref: 005124A2

Memory Dump Source

Source File: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: __freea$__alloca_probe_16
String ID:
API String ID: 3509577899-0
Opcode ID: 32b707187ff529a70b224748a92498d49adc66242394f2d30edada97c912442b
Instruction ID: aba792b74b199af272481673ee97d2f58fccbd5e0f2c924591a0ff2e69d823dc
Opcode Fuzzy Hash: 32b707187ff529a70b224748a92498d49adc66242394f2d30edada97c912442b
Instruction Fuzzy Hash: D47117769002099FFF219E94CC41FFE7FA9BF49310F140419EA54A7282DBB9DCA187A4

Function 004D35FF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,004D370C,?,?,00000000,00000000,?,?,004D38BA,00000021,FlsSetValue,004E69C8,004E69D0,00000000), ref: 004D36C0

Strings

api-ms-, xrefs: 004D3656
ext-ms-, xrefs: 004D366A

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: d6700ce3e451b604a4867f0e0fe22b7f03929138ff27007eda637ce6f1d88459
Instruction ID: 72d3798394d2c05a770bc98a5774bd461ebc9500fded15b62475ffdf1ac3ec19
Opcode Fuzzy Hash: d6700ce3e451b604a4867f0e0fe22b7f03929138ff27007eda637ce6f1d88459
Instruction Fuzzy Hash: 0021D531A01210BBCB319F219C68A5B3768AB41766F290627F915AB391D778EF01C6DA

Function 004C38EF Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004C38F6
std::_Lockit::_Lockit.LIBCPMT ref: 004C3900
int.LIBCPMT ref: 004C3917

Part of subcall function 004C16DA: std::_Lockit::_Lockit.LIBCPMT ref: 004C16EB
Part of subcall function 004C16DA: std::_Lockit::~_Lockit.LIBCPMT ref: 004C1705

codecvt.LIBCPMT ref: 004C393A
std::_Facet_Register.LIBCPMT ref: 004C3951
std::_Lockit::~_Lockit.LIBCPMT ref: 004C3971
Concurrency::cancel_current_task.LIBCPMT ref: 004C397E

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID:
API String ID: 2133458128-0
Opcode ID: 6d88e42c7a09896f35e96b7c4740e55817413cb387bc3717f3b5c62899afd113
Instruction ID: 0ef3de9ee907dfa1819455a810f662bd999492c43cb25d8419a0a09ee137b4f7
Opcode Fuzzy Hash: 6d88e42c7a09896f35e96b7c4740e55817413cb387bc3717f3b5c62899afd113
Instruction Fuzzy Hash: 7E01E1799001199BCB90EFA5C841FBE7771AF84726F14840FF4116B3A2CB78AE01CB88

Function 004F3919 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004F3920
std::_Lockit::_Lockit.LIBCPMT ref: 004F392A

Part of subcall function 004EF880: std::_Lockit::_Lockit.LIBCPMT ref: 004EF89C
Part of subcall function 004EF880: std::_Lockit::~_Lockit.LIBCPMT ref: 004EF8B9

codecvt.LIBCPMT ref: 004F3964
std::_Facet_Register.LIBCPMT ref: 004F397B
std::_Lockit::~_Lockit.LIBCPMT ref: 004F399B

Strings

dOC, xrefs: 004F3935

Memory Dump Source

Source File: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID: dOC
API String ID: 712880209-682359054
Opcode ID: 7fb8576a75b95fb445e58ecf22290f584e2f77657a518a4edd59b5f9bfd13557
Instruction ID: 5efd12f9fea9895eeb4060c1bf68c908c47d096bdb4c98b64e5b6f1e645c9211
Opcode Fuzzy Hash: 7fb8576a75b95fb445e58ecf22290f584e2f77657a518a4edd59b5f9bfd13557
Instruction Fuzzy Hash: 1001D671900619ABCB05EF65C845ABE7771AF84716F24041FE610AB391CFBC9F058B99

Function 004C3155 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004C3161
int.LIBCPMT ref: 004C3174

Part of subcall function 004C16DA: std::_Lockit::_Lockit.LIBCPMT ref: 004C16EB
Part of subcall function 004C16DA: std::_Lockit::~_Lockit.LIBCPMT ref: 004C1705

std::_Facet_Register.LIBCPMT ref: 004C31A7
std::_Lockit::~_Lockit.LIBCPMT ref: 004C31BD
Concurrency::cancel_current_task.LIBCPMT ref: 004C31C8

Strings

pO[, xrefs: 004C3155

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID: pO[
API String ID: 2081738530-552102644
Opcode ID: 86569a7a134f25fcfb986a2c94a421c4b17fbb95ce0c36c7f1ccb38182bb35f2
Instruction ID: f43b4d970b1d6a33a524819e581f5154951aef797a2443a49eae6758687d3567
Opcode Fuzzy Hash: 86569a7a134f25fcfb986a2c94a421c4b17fbb95ce0c36c7f1ccb38182bb35f2
Instruction Fuzzy Hash: 7401243A500114BFCB54AF51D805EEE77A8EF81728B14464EF80257392EF38AF01C788

Function 004C6751 Relevance: 9.2, APIs: 6, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 004C679A
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 004C6805
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004C6822
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 004C6861
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004C68C0
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 004C68E3

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 2781e9fcd670cc6f8c8640b8c949cf1656b92106863f7af17978584bb00a2e8a
Instruction ID: 6ead63d353c8ccd2243a5c0d5c157cc15e285738e4b881732e1e23d63ef8307c
Opcode Fuzzy Hash: 2781e9fcd670cc6f8c8640b8c949cf1656b92106863f7af17978584bb00a2e8a
Instruction Fuzzy Hash: B351D07A50120AABDF60AF55CC44FAB7BA9EF44754F16842EF905A6250DB39CD00CB68

Function 004C5019 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004C5020
std::_Lockit::_Lockit.LIBCPMT ref: 004C502A
int.LIBCPMT ref: 004C5041

Part of subcall function 004C16DA: std::_Lockit::_Lockit.LIBCPMT ref: 004C16EB
Part of subcall function 004C16DA: std::_Lockit::~_Lockit.LIBCPMT ref: 004C1705

std::_Facet_Register.LIBCPMT ref: 004C507B
std::_Lockit::~_Lockit.LIBCPMT ref: 004C509B
Concurrency::cancel_current_task.LIBCPMT ref: 004C50A8

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: a54284937665cc8ebb35aa83882acfc992958f5527ed38e600be172a067c2588
Instruction ID: a723adfbd55a5833b14b588e7a98e11e09915f0fde11a5082b96902081152ddb
Opcode Fuzzy Hash: a54284937665cc8ebb35aa83882acfc992958f5527ed38e600be172a067c2588
Instruction Fuzzy Hash: 9A11E139910618ABCB95EF66C805BAE77F4BF84325F50450FE401A7392DB78BE458B88

Function 004C9F0A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,004C9F01,004C80FB,004C77B5), ref: 004C9F18
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 004C9F26
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 004C9F3F
SetLastError.KERNEL32(00000000,004C9F01,004C80FB,004C77B5), ref: 004C9F91

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6049e0c36028fe846bff13b38c7cdc6490d067ce3ed2ca417a36132e90f88bfb
Instruction ID: 9f62e71f915faba16f617a64bbd84968c2bf2251352954619ec8f63695d7da83
Opcode Fuzzy Hash: 6049e0c36028fe846bff13b38c7cdc6490d067ce3ed2ca417a36132e90f88bfb
Instruction Fuzzy Hash: DB01D83A20C361BEA7A42A767CCEF672745FB01778724023FF1108A1E6EF5A4D01518D

Function 004D0E7B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,675816BD,?,?,00000000,004E2025,000000FF,?,004D0E0B,004D0F3B,?,004D0DDF,00000000), ref: 004D0EB0
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004D0EC2
FreeLibrary.KERNEL32(00000000,?,?,00000000,004E2025,000000FF,?,004D0E0B,004D0F3B,?,004D0DDF,00000000), ref: 004D0EE4

Strings

mscoree.dll, xrefs: 004D0EA9
CorExitProcess, xrefs: 004D0EBA

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: cfec1d245605b13d0896357a7a08d5c79a46e2d403c6255aedd0482c24b7bdd2
Instruction ID: 407de137f6f97285b02752e8bb5b6401058dc16e098bd96e2275aa5b0853b115
Opcode Fuzzy Hash: cfec1d245605b13d0896357a7a08d5c79a46e2d403c6255aedd0482c24b7bdd2
Instruction Fuzzy Hash: 4E01A731500659EFDB128F41DC49BAFBBB8FB04722F00052BE811A7391EB789900CA58

Function 00506DA1 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00506E28
__alloca_probe_16.LIBCMT ref: 00506EE9
__freea.LIBCMT ref: 00506F50
__freea.LIBCMT ref: 00506F65
__freea.LIBCMT ref: 00506F75

Memory Dump Source

Source File: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: __freea$__alloca_probe_16
String ID:
API String ID: 3509577899-0
Opcode ID: 2717c78738c49986ff27965d3fda623c27c661b0839ae79fd8e1837d9ca99192
Instruction ID: 30c05cfdd5a6c174b2c0a7aa98835d82f8f3c3ec844de710c1575c2f92c6f06a
Opcode Fuzzy Hash: 2717c78738c49986ff27965d3fda623c27c661b0839ae79fd8e1837d9ca99192
Instruction Fuzzy Hash: BE518C7260021BAFEF209F64DC85EBF3EA9FF44754B150529BE08D6191EA75DD2086A0

Function 004C25C5 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004C25D1
int.LIBCPMT ref: 004C25E4

Part of subcall function 004C16DA: std::_Lockit::_Lockit.LIBCPMT ref: 004C16EB
Part of subcall function 004C16DA: std::_Lockit::~_Lockit.LIBCPMT ref: 004C1705

std::_Facet_Register.LIBCPMT ref: 004C2617
std::_Lockit::~_Lockit.LIBCPMT ref: 004C262D
Concurrency::cancel_current_task.LIBCPMT ref: 004C2638

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: fbe851eac835b5899b5643f104823385747e5965bc840aa45ce505b18409e63d
Instruction ID: f4db926c12eec6af5535d89e0c4bdb0ae8e98fe8526e8fd0518bedefe8cd6d6d
Opcode Fuzzy Hash: fbe851eac835b5899b5643f104823385747e5965bc840aa45ce505b18409e63d
Instruction Fuzzy Hash: 3C01D43A600114BBCB55AB65C905EEE7768DF85724F11424FF802573A1EBB8AF028798

Function 004C4D9C Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004C4DA3
std::_Lockit::_Lockit.LIBCPMT ref: 004C4DAE
std::_Lockit::~_Lockit.LIBCPMT ref: 004C4E1C

Part of subcall function 004C4EFF: std::locale::_Locimp::_Locimp.LIBCPMT ref: 004C4F17

std::locale::_Setgloballocale.LIBCPMT ref: 004C4DC9
_Yarn.LIBCPMT ref: 004C4DDF

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: b3ab9adf7c49731727f0eaf465a1c5c043ab6a3c9a20d69b366f41cc45e0b8af
Instruction ID: 4518d22efc48399e02261a07613934fa03bd37a4f325e900abf7cb4e1bd4e9b5
Opcode Fuzzy Hash: b3ab9adf7c49731727f0eaf465a1c5c043ab6a3c9a20d69b366f41cc45e0b8af
Instruction Fuzzy Hash: 20019A79A001909BCB46EF61D995A7D77A1BB84315B16800FE81217392CB3C6E06DB89

Function 0050DD9D Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

__dosmaperr.LIBCMT ref: 0050DEB8
__dosmaperr.LIBCMT ref: 0050DED7
__dosmaperr.LIBCMT ref: 0050E07D

Strings

H, xrefs: 0050E002

Memory Dump Source

Source File: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: __dosmaperr
String ID: H
API String ID: 2332233096-2852464175
Opcode ID: f80aff05c03fc09639beafaa39d995decf8c3a4e6499cf810c1a49e9d87c7d5e
Instruction ID: 3fd62c6a5a1e300dddad871a5d8da6ea0b6055c1b2a50cf53bfc2b70fd5cf0e2
Opcode Fuzzy Hash: f80aff05c03fc09639beafaa39d995decf8c3a4e6499cf810c1a49e9d87c7d5e
Instruction Fuzzy Hash: 45A11532A145599FCF19AFA8DC96BAD3FB0BB46310F28015DF802DB2D1D7349812DB65

Function 004D6888 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 173COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004D6A20
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004D6A33

Strings

^hM, xrefs: 004D6929
^hM, xrefs: 004D6907

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: ^hM$^hM
API String ID: 885266447-1182382858
Opcode ID: 45b46c6b2c2186212d6ff6c47f8f5ca8bfd23470a37298ba18f8160f25da4a9b
Instruction ID: 011d7d848b220e993517c8d16e6758193a646962e2b5a5d96f27b63fc37fc775
Opcode Fuzzy Hash: 45b46c6b2c2186212d6ff6c47f8f5ca8bfd23470a37298ba18f8160f25da4a9b
Instruction Fuzzy Hash: C55191B1A00148AFCF14CF99C8A1AAEBBB2EF49350F15815BE895A7351D339ED42CF54

Function 004C28E9 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 126COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 004C28F0
_strlen.LIBCMT ref: 004C2908

Strings

xN[, xrefs: 004C294F
input string: , xrefs: 004C2903, 004C29CE

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: H_prolog3_catch_strlen
String ID: input string: $xN[
API String ID: 3133806014-4158660745
Opcode ID: 8d9fe5703f8e829ccf08b5ec7fd768545cff65b4d1467ccb19f041f2ba01df28
Instruction ID: 530fdb0df99ebb75456f6fe3a2f747d05f297172d9beb560d3abb8f6af535347
Opcode Fuzzy Hash: 8d9fe5703f8e829ccf08b5ec7fd768545cff65b4d1467ccb19f041f2ba01df28
Instruction Fuzzy Hash: 7F41B579B002008FCBA0DB69CAC0E6D77B1BB48734F29424FE415A73A2C6F5AC41CB59

Function 004CB052 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,004CB003,00000000,?,005B54C4,?,?,?,004CB1A6,00000004,InitializeCriticalSectionEx,004E4C70,InitializeCriticalSectionEx), ref: 004CB05F
GetLastError.KERNEL32(?,004CB003,00000000,?,005B54C4,?,?,?,004CB1A6,00000004,InitializeCriticalSectionEx,004E4C70,InitializeCriticalSectionEx,00000000,?,004CAF5D), ref: 004CB069
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 004CB091

Strings

api-ms-, xrefs: 004CB076

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 3b4bed5e43fbb8e18260c01669b98aa2e4aa05eadd58102deb05afa84dec4115
Instruction ID: 3fa1d5d944ec88fda4182c2850afaa244d7e92f9c382a351ba988cfd133321b0
Opcode Fuzzy Hash: 3b4bed5e43fbb8e18260c01669b98aa2e4aa05eadd58102deb05afa84dec4115
Instruction Fuzzy Hash: 70E01274640344B7DB211F72EC4AF1A3A54AB40B55F144076FA0CAD1E1D7659A5085CC

Function 004D582E Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(675816BD,00000000,00000000,?), ref: 004D5891

Part of subcall function 004D98E5: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,004D89AA,?,00000000,-00000008), ref: 004D9991

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 004D5AEC
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 004D5B34
GetLastError.KERNEL32 ref: 004D5BD7

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 376bea2b079986c3fd21da8065f4e56178424d44a7a334b16c85a8fc1e156455
Instruction ID: 8d9c77296adcd51c308c30d7adce332801e7059f6727de08bae5cc0b719456b0
Opcode Fuzzy Hash: 376bea2b079986c3fd21da8065f4e56178424d44a7a334b16c85a8fc1e156455
Instruction Fuzzy Hash: A8D18CB5D006589FCB05CFA8C890AADBBB5FF09314F28416BE456E7341EB34A946CF54

Function 004CA021 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 004CA0E8
___AdjustPointer.LIBCMT ref: 004CA10B
___AdjustPointer.LIBCMT ref: 004CA1A7

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: b07fb726297c6d7aa63ecfb1a985e229bcfc2ebf46f8a60382e72262c784082d
Instruction ID: f8a42183039e9f6e8ad5a29d6db9ca25d05c471e2c1f0b9d6a7e39d5156b8a7b
Opcode Fuzzy Hash: b07fb726297c6d7aa63ecfb1a985e229bcfc2ebf46f8a60382e72262c784082d
Instruction Fuzzy Hash: 4551E37960120AAFDB698F56C841F7A77A4EF00718F18412FE84147391DB39AC61DB9A

Function 004F8631 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 004F86F8
___AdjustPointer.LIBCMT ref: 004F871B
___AdjustPointer.LIBCMT ref: 004F87B7

Memory Dump Source

Source File: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: d95edfa48ed7d5b6bb91a825a2d964fdf8877f62f468544baf2dcb66ebf8e1e5
Instruction ID: f85f9e51757541913dae6893fa9e98c9e911181f780e23138e03c1bcbe60970e
Opcode Fuzzy Hash: d95edfa48ed7d5b6bb91a825a2d964fdf8877f62f468544baf2dcb66ebf8e1e5
Instruction Fuzzy Hash: 4C51D17160060AAFEB28AF11DD45B7A77E4EF04304F24442FEA158F291DB39ED41CB98

Function 004F851A Relevance: 6.1, APIs: 4, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 004F8536
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 004F854F

Memory Dump Source

Source File: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: f79783cf4e283788485e810e96ae3962078c34cc6f58696eba5703b373d9bdf3
Instruction ID: 12237f89a83c71778afd01c5ee149bff5287eb5ad235d1421212cb41a2b412db
Opcode Fuzzy Hash: f79783cf4e283788485e810e96ae3962078c34cc6f58696eba5703b373d9bdf3
Instruction Fuzzy Hash: AF01F53221D319BFDA692775BD8567726A4EB01378330223FF3149A2E1EF195C01968C

Function 004E0616 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConso.KERNEL32(00000000,00000000,?,00000000,00000000,?,004DF049,00000000,00000001,00000000,?,?,004D5C2B,?,00000000,00000000), ref: 004E062D
GetLastError.KERNEL32(?,004DF049,00000000,00000001,00000000,?,?,004D5C2B,?,00000000,00000000,?,?,?,004D61B2,00000000), ref: 004E0639

Part of subcall function 004E05FF: CloseHandle.KERNEL32(FFFFFFFE,004E0649,?,004DF049,00000000,00000001,00000000,?,?,004D5C2B,?,00000000,00000000,?,?), ref: 004E060F

___initconout.LIBCMT ref: 004E0649

Part of subcall function 004E05C1: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,004E05F0,004DF036,?,?,004D5C2B,?,00000000,00000000,?), ref: 004E05D4

WriteConso.KERNEL32(00000000,00000000,?,00000000,?,004DF049,00000000,00000001,00000000,?,?,004D5C2B,?,00000000,00000000,?), ref: 004E065E

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: ConsoWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 1327366883-0
Opcode ID: 6ff8b9b6e930565a6bb9a9dfd0105c9818d80cd778a287d3665571bfa8dcf1a3
Instruction ID: 93934a9356787c62b20f84325b131c10896ce8c0f73639908e311d7458e7f49d
Opcode Fuzzy Hash: 6ff8b9b6e930565a6bb9a9dfd0105c9818d80cd778a287d3665571bfa8dcf1a3
Instruction Fuzzy Hash: E0F03736400199BBCF125F97EC48E8A3F65FF48362B044569F9199A131C6718A60DF98

Function 0050AC9D Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 373COMMON

Download Yara Rule

Strings

AC, xrefs: 0050AFB0
AC, xrefs: 0050ACCB

Memory Dump Source

Source File: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID:
String ID: AC$ AC
API String ID: 0-2553023829
Opcode ID: cedf6b15ef201e08950a9590e3cc96283dc0a593f63901964313eeb3d6e4f466
Instruction ID: 13b5895934ec9191942d54aaeb7e57eb462298748d712da147d429f3f5537403
Opcode Fuzzy Hash: cedf6b15ef201e08950a9590e3cc96283dc0a593f63901964313eeb3d6e4f466
Instruction Fuzzy Hash: ABC112B6A40206ABDB20DEA8CC86FDE7BF8BB48700F144165FA05FB2C2D674D9419765

Function 004C263E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 187COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 004C2645
_strlen.LIBCMT ref: 004C265F

Strings

pO[, xrefs: 004C26AE

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: H_prolog3_catch_strlen
String ID: pO[
API String ID: 3133806014-552102644
Opcode ID: 3e8597b8314083715665bcefcdd1caccbcb09d2d4b06288dd44d082b74bdf497
Instruction ID: cb0539e37111b0a531ff75cf1df551e198b85516c1fafe135bf601d745433259
Opcode Fuzzy Hash: 3e8597b8314083715665bcefcdd1caccbcb09d2d4b06288dd44d082b74bdf497
Instruction Fuzzy Hash: 57716078E012058FCB64DF99D980EADB7F1BF48314B24825EE415AB392D7B8AD42CF54

Function 004F8320 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 004F835F
__IsNonwritableInCurrentImage.LIBCMT ref: 004F8413

Strings

csm, xrefs: 004F83FD

Memory Dump Source

Source File: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 73f2a96de005f1e6ec4b1510e602c753a631824e33d570dc704df2bb37d82237
Instruction ID: 82d8ef7a150593808c08cb1ba5be95eb1faf97b10a274c3e40f4b929e2d79cd7
Opcode Fuzzy Hash: 73f2a96de005f1e6ec4b1510e602c753a631824e33d570dc704df2bb37d82237
Instruction Fuzzy Hash: 2241B734A0010D9BCF10DF69C881AAE7BB0BF44314F14819AEE145F352DB39A915CB99

Function 004C9D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 004C9D4F
__IsNonwritableInCurrentImage.LIBCMT ref: 004C9E03

Strings

csm, xrefs: 004C9DED

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 427bb8b9c59822d2145f1adf9cd135c67b1e5b617d440f5eee92f3a9aa7a84f5
Instruction ID: 5a6075f1bb3929a43a19bd17cde543692e1711d423893af617633a9855f86066
Opcode Fuzzy Hash: 427bb8b9c59822d2145f1adf9cd135c67b1e5b617d440f5eee92f3a9aa7a84f5
Instruction Fuzzy Hash: 4941C638A00218ABCF50DF59C888F9EBBB1AF45318F14815FE8156B392D7399E11CB95

Function 004CA61D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 004CA642

Strings

RCC, xrefs: 004CA65C
MOC, xrefs: 004CA654

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 45d56c5c9a639abef8bb38956ac9f455838d8e473b16656e60d6e2e8d98527d2
Instruction ID: 877cc43cdc847d85da4bf6c1fdace910be984000e653ca669e3fc15e4d46042a
Opcode Fuzzy Hash: 45d56c5c9a639abef8bb38956ac9f455838d8e473b16656e60d6e2e8d98527d2
Instruction Fuzzy Hash: 1641473590020DAFCF16CF98CD85FAEBBB5BF48308F19405EF90466251D7399960DB5A

Function 004C693B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 004C72E3
___raise_securityfailure.LIBCMT ref: 004C73CB

Strings

`Q[, xrefs: 004C73C6

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: `Q[
API String ID: 3761405300-3901748827
Opcode ID: 09228daee5f0710627490194a0cd5330037726245915be5a6ad9e31a7db4cb2c
Instruction ID: cc20897adb86d7c0ebbd48e76711b00a73fe05f3e8181254e79fa2449b2609e9
Opcode Fuzzy Hash: 09228daee5f0710627490194a0cd5330037726245915be5a6ad9e31a7db4cb2c
Instruction Fuzzy Hash: E52125B8502B009BD799DF29F985704BBA4FB68300F54422AE5049B3B1F3B46989EF49

Function 004C73E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 004C73EB
___raise_securityfailure.LIBCMT ref: 004C74A8

Strings

`Q[, xrefs: 004C74A3

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: `Q[
API String ID: 3761405300-3901748827
Opcode ID: 1ba1338820687ad6800a1742a3ee74ea73f9eb03fcb4ff23fecaf11688f66fa7
Instruction ID: 6956842c869adc949f369f0e500d65e3bb2b7acb5701eb83606abc6077522c09
Opcode Fuzzy Hash: 1ba1338820687ad6800a1742a3ee74ea73f9eb03fcb4ff23fecaf11688f66fa7
Instruction Fuzzy Hash: BC11C3B8516B449BDB8ADF29F981744BBA4FB68300B04535AE9089B370F370694DEF45

Function 004C1605 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004C160C
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 004C1644

Part of subcall function 004C4E9A: _Yarn.LIBCPMT ref: 004C4EB9
Part of subcall function 004C4E9A: _Yarn.LIBCPMT ref: 004C4EDD

Strings

bad locale name, xrefs: 004C1652

Memory Dump Source

Source File: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: f05da5a036d7ccd16b7466ff5816ad52d35535dece5a10e40359ffd68c79ca9f
Instruction ID: 84514c555865795cd5b8bde9f2ca37c0846846fc85f46d95b794e10b63ab47ca
Opcode Fuzzy Hash: f05da5a036d7ccd16b7466ff5816ad52d35535dece5a10e40359ffd68c79ca9f
Instruction Fuzzy Hash: 72F017B5506B909E83709FBB8581947FBE4BE29311394CA2FE1DEC3A11D734A504CB6E

Function 004F39AE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004F39B5

Strings

pdB, xrefs: 004F39F1
JRB, xrefs: 004F39B0

Memory Dump Source

Source File: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: H_prolog3
String ID: JRB$pdB
API String ID: 431132790-4236282298
Opcode ID: 73ce1e61eeabf46a09a1e5cf8c5bfbef05ff3b583e132448a225ea9f7212eaca
Instruction ID: b28e40d75a35f46d5e2b310363485234f208446f6dad3fa67c814476f4e91699
Opcode Fuzzy Hash: 73ce1e61eeabf46a09a1e5cf8c5bfbef05ff3b583e132448a225ea9f7212eaca
Instruction Fuzzy Hash: BE01D6B4A00619CFC761DF28C540A6ABBF0BF08304B51896EE5C9DB711D7B5EA40CF58

Function 004EF6F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004EF72C

Strings

4/C, xrefs: 004EF700, 004EF704
HPC, xrefs: 004EF724, 004EF72B

Memory Dump Source

Source File: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: ___std_exception_copy
String ID: 4/C$HPC
API String ID: 2659868963-744383018
Opcode ID: 9d0356c4336352dee0926bcbf3281c68f0182bfbb42950667dd02130b88f9e35
Instruction ID: c5e7dd0d85913dc107d306dec19027d4e87af5f1d071d73adba1ff5112de981e
Opcode Fuzzy Hash: 9d0356c4336352dee0926bcbf3281c68f0182bfbb42950667dd02130b88f9e35
Instruction Fuzzy Hash: 47E092B19102149BC604FF64D80198AB3E89E54714B50C92FF684D3105F7B4D9488768

Function 004EF880 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004EF89C
std::_Lockit::~_Lockit.LIBCPMT ref: 004EF8B9

Strings

HPC, xrefs: 004EF8B5

Memory Dump Source

Source File: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: HPC
API String ID: 593203224-3567667220
Opcode ID: ff915995972932a6eddaed0ea957f7cf20ef5995c47567fe176cbd0ea19bccae
Instruction ID: c6c15dd740b0432d6d32ba622311d6237db9242b5d9217ec3522b5d1f06e7996
Opcode Fuzzy Hash: ff915995972932a6eddaed0ea957f7cf20ef5995c47567fe176cbd0ea19bccae
Instruction Fuzzy Hash: 15F03035914205DFD728EF19E8427A977E0BB94701F40087FE5D947390DB746988CB8A

Function 004F3A20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004F3A27
std::locale::_Init.LIBCPMT ref: 004F3A48

Part of subcall function 004F369A: __EH_prolog3.LIBCMT ref: 004F36A1
Part of subcall function 004F369A: std::_Lockit::_Lockit.LIBCPMT ref: 004F36AC
Part of subcall function 004F369A: std::locale::_Setgloballocale.LIBCPMT ref: 004F36C7
Part of subcall function 004F369A: _Yarn.LIBCPMT ref: 004F36DD
Part of subcall function 004F369A: std::_Lockit::~_Lockit.LIBCPMT ref: 004F371D

Strings

gRB, xrefs: 004F3A22

Memory Dump Source

Source File: 00000000.00000002.3235692029.00000000004EE000.00000004.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.3235638100.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235654169.00000000004C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235676527.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235742736.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235757154.00000000005B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3235769472.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: H_prolog3Lockitstd::_std::locale::_$InitLockit::_Lockit::~_SetgloballocaleYarn
String ID: gRB
API String ID: 3152668004-2726697949
Opcode ID: 6379a8a037087f08d6e289ffdf4a874cfc4f3d5eaffd94999f4a30d221e1aac3
Instruction ID: 1336acd993eca032d1c5a82056fd9cac8da6a8b8f0724ff65aa27397fc3eabdd
Opcode Fuzzy Hash: 6379a8a037087f08d6e289ffdf4a874cfc4f3d5eaffd94999f4a30d221e1aac3
Instruction Fuzzy Hash: EFE0D832A05A15A7D3106F5A510233DB281AF40715F55501FF7019B3C1CFFC4D00478D

Analysis Process: aO1TcEaxfW.exePID: 5540, Parent PID: 2636COMMON

Non-executed Functions

Function 004DCDA4 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183COMMON

Download Yara Rule

APIs

Part of subcall function 004D5215: GetLastError.KERNEL32(?,00000000,004CFB7F,?,?,?,?,00000003,004CC27B,?,?,?,?,00000000), ref: 004D5219
Part of subcall function 004D5215: SetLastError.KERNEL32(00000000,?,?,?,00000003,004CC27B,?,?,?,?,00000000), ref: 004D52BB

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 004DCEB0
IsValidCodePage.KERNEL32(00000000), ref: 004DCEF9
IsValidLocale.KERNEL32(?,00000001), ref: 004DCF08
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 004DCF50
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 004DCF6F

Strings

`uN, xrefs: 004DCE5D

Memory Dump Source

Source File: 00000002.00000002.2066068405.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000002.00000002.2066041307.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066112606.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066133134.00000000004EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066199717.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: `uN
API String ID: 415426439-1958408982
Opcode ID: 4136ec0ffed96aadd48030be4d299f4c56ee55b6273004dca2a27f35fd73d41f
Instruction ID: ab3995da11208ec982ff8b46df53e018dee085eaacc29865cbe77a5f666ca41c
Opcode Fuzzy Hash: 4136ec0ffed96aadd48030be4d299f4c56ee55b6273004dca2a27f35fd73d41f
Instruction Fuzzy Hash: 08517FB2A00206ABDF10DFA5CCD1ABF77B9AF04701F14456BE504EB391E7789A04CB69

Function 004DC440 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

Part of subcall function 004D5215: GetLastError.KERNEL32(?,00000000,004CFB7F,?,?,?,?,00000003,004CC27B,?,?,?,?,00000000), ref: 004D5219
Part of subcall function 004D5215: SetLastError.KERNEL32(00000000,?,?,?,00000003,004CC27B,?,?,?,?,00000000), ref: 004D52BB

GetACP.KERNEL32(?,?,?,?,?,?,004D1773,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 004DC501
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,004D1773,?,?,?,00000055,?,-00000050,?,?), ref: 004DC52C
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 004DC68F

Strings

`uN, xrefs: 004DC4B7
utf8, xrefs: 004DC5FE

Memory Dump Source

Source File: 00000002.00000002.2066068405.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000002.00000002.2066041307.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066112606.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066133134.00000000004EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066199717.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: `uN$utf8
API String ID: 607553120-506889755
Opcode ID: 40ae614af944a7c5fd5864c8ef2d98dbad0911e66e79a14ac830152f60e99aba
Instruction ID: e10c6afdb8d472600e3057e28e639eeebca04d95dc7a0143f9f5e6de6bc069a7
Opcode Fuzzy Hash: 40ae614af944a7c5fd5864c8ef2d98dbad0911e66e79a14ac830152f60e99aba
Instruction Fuzzy Hash: 3671E271A00207AAD724AB76CCA6BBB73A8EF05714F14442BF505DB381EA79ED40C66D

Function 004DCBCF Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,004DCEED,00000002,00000000,?,?,?,004DCEED,?,00000000), ref: 004DCC68
GetLocaleInfoW.KERNEL32(?,20001004,004DCEED,00000002,00000000,?,?,?,004DCEED,?,00000000), ref: 004DCC91
GetACP.KERNEL32(?,?,004DCEED,?,00000000), ref: 004DCCA6

Strings

ACP, xrefs: 004DCBED
OCP, xrefs: 004DCC23

Memory Dump Source

Source File: 00000002.00000002.2066068405.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000002.00000002.2066041307.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066112606.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066133134.00000000004EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066199717.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 90078d3225666d6893302c9b37df74223b3f17fa29b9321d729125372d092dea
Instruction ID: f296d936602206417e0987f30810f53e2223810d259bb9dba5a9a94164e8b692
Opcode Fuzzy Hash: 90078d3225666d6893302c9b37df74223b3f17fa29b9321d729125372d092dea
Instruction Fuzzy Hash: B621CB32720102A6DB348F25C9A5A97B3A6EF50F61B568467E70ED7304E736DE41C35C

Function 004D4023 Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 004D40B0

Memory Dump Source

Source File: 00000002.00000002.2066068405.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000002.00000002.2066041307.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066112606.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066133134.00000000004EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066199717.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 17a8af3533a897e6e906cec53c923a3a22616cf0740b16545c45100316cc9468
Instruction ID: a16a4b82de38bc13296bbb2843f4eb647f8d769884c50436b4152a7a34eefb0e
Opcode Fuzzy Hash: 17a8af3533a897e6e906cec53c923a3a22616cf0740b16545c45100316cc9468
Instruction Fuzzy Hash: 61B15932A002859FDB15CF68C8A17FFBBE5EF95344F1581ABE804AB341D2389D01C769

Function 004C75D8 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 004C75E4
IsDebuggerPresent.KERNEL32 ref: 004C76B0
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004C76C9
UnhandledExceptionFilter.KERNEL32(?), ref: 004C76D3

Memory Dump Source

Source File: 00000002.00000002.2066068405.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000002.00000002.2066041307.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066112606.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066133134.00000000004EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066199717.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: cc7343ddf99e75bdd7de30d84addadc0c0c9b906c1a45485dec29e488c02ec7d
Instruction ID: 31f8bddbacdf0e0be1122fd933de58efb82dfb38cd216efd3957938e8f53d13e
Opcode Fuzzy Hash: cc7343ddf99e75bdd7de30d84addadc0c0c9b906c1a45485dec29e488c02ec7d
Instruction Fuzzy Hash: 7C310779D052589BDB61DF64D989BCDBBB8BF08304F1041AAE40CAB250EB749B848F48

Function 004C1CD2 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 187COMMON

Download Yara Rule

APIs

Part of subcall function 004C3348: __EH_prolog3_catch.LIBCMT ref: 004C334F

_Deallocate.LIBCONCRT ref: 004C1EAD
_Deallocate.LIBCONCRT ref: 004C1EFA

Strings

Current val: %d, xrefs: 004C1E86

Memory Dump Source

Source File: 00000002.00000002.2066068405.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000002.00000002.2066041307.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066112606.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066133134.00000000004EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066199717.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: Deallocate$H_prolog3_catch
String ID: Current val: %d
API String ID: 1212816977-1825967858
Opcode ID: 0c5ece480e667c3aade1e7a2071629e511f587d41bc5a7464e326e17ed6afd97
Instruction ID: 290b1c11bd000a2843c6c844fa62112e16a5d9c403b9d44406169b4627206d3f
Opcode Fuzzy Hash: 0c5ece480e667c3aade1e7a2071629e511f587d41bc5a7464e326e17ed6afd97
Instruction Fuzzy Hash: 4C61DE7651C3818FC350DF2AD480A6BFBE0AFC9714F144A2EF9D593252D739E9048B9A

Function 004C38EF Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004C38F6
std::_Lockit::_Lockit.LIBCPMT ref: 004C3900
int.LIBCPMT ref: 004C3917

Part of subcall function 004C16DA: std::_Lockit::_Lockit.LIBCPMT ref: 004C16EB
Part of subcall function 004C16DA: std::_Lockit::~_Lockit.LIBCPMT ref: 004C1705

codecvt.LIBCPMT ref: 004C393A
std::_Facet_Register.LIBCPMT ref: 004C3951
std::_Lockit::~_Lockit.LIBCPMT ref: 004C3971
Concurrency::cancel_current_task.LIBCPMT ref: 004C397E

Strings

O[, xrefs: 004C390B

Memory Dump Source

Source File: 00000002.00000002.2066068405.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000002.00000002.2066041307.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066112606.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066133134.00000000004EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066199717.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID: O[
API String ID: 2133458128-1280590916
Opcode ID: 6d88e42c7a09896f35e96b7c4740e55817413cb387bc3717f3b5c62899afd113
Instruction ID: 0ef3de9ee907dfa1819455a810f662bd999492c43cb25d8419a0a09ee137b4f7
Opcode Fuzzy Hash: 6d88e42c7a09896f35e96b7c4740e55817413cb387bc3717f3b5c62899afd113
Instruction Fuzzy Hash: 7E01E1799001199BCB90EFA5C841FBE7771AF84726F14840FF4116B3A2CB78AE01CB88

Function 004D768F Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298COMMON

Download Yara Rule

Strings

, xrefs: 004D7908

Memory Dump Source

Source File: 00000002.00000002.2066068405.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000002.00000002.2066041307.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066112606.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066133134.00000000004EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066199717.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 75f8db5692d6d32213a861d6597d5b5989ce04d401f4f97b81a88f5f61dea488
Instruction ID: 1a98b4844ae0108cac7eef90246f0306295ac8079451f0927fb698838c8008e2
Opcode Fuzzy Hash: 75f8db5692d6d32213a861d6597d5b5989ce04d401f4f97b81a88f5f61dea488
Instruction Fuzzy Hash: E8B139B5E08205EFDB01DFA9C8A1BAE7BB1AF45314F14419BE40067391E7789E46CF29

Function 004C5019 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004C5020
std::_Lockit::_Lockit.LIBCPMT ref: 004C502A
int.LIBCPMT ref: 004C5041

Part of subcall function 004C16DA: std::_Lockit::_Lockit.LIBCPMT ref: 004C16EB
Part of subcall function 004C16DA: std::_Lockit::~_Lockit.LIBCPMT ref: 004C1705

std::_Facet_Register.LIBCPMT ref: 004C507B
std::_Lockit::~_Lockit.LIBCPMT ref: 004C509B
Concurrency::cancel_current_task.LIBCPMT ref: 004C50A8

Strings

<O[, xrefs: 004C5035

Memory Dump Source

Source File: 00000002.00000002.2066068405.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000002.00000002.2066041307.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066112606.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066133134.00000000004EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066199717.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID: <O[
API String ID: 55977855-1499995728
Opcode ID: a54284937665cc8ebb35aa83882acfc992958f5527ed38e600be172a067c2588
Instruction ID: a723adfbd55a5833b14b588e7a98e11e09915f0fde11a5082b96902081152ddb
Opcode Fuzzy Hash: a54284937665cc8ebb35aa83882acfc992958f5527ed38e600be172a067c2588
Instruction Fuzzy Hash: 9A11E139910618ABCB95EF66C805BAE77F4BF84325F50450FE401A7392DB78BE458B88

Function 004C3155 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004C3161
int.LIBCPMT ref: 004C3174

Part of subcall function 004C16DA: std::_Lockit::_Lockit.LIBCPMT ref: 004C16EB
Part of subcall function 004C16DA: std::_Lockit::~_Lockit.LIBCPMT ref: 004C1705

std::_Facet_Register.LIBCPMT ref: 004C31A7
std::_Lockit::~_Lockit.LIBCPMT ref: 004C31BD
Concurrency::cancel_current_task.LIBCPMT ref: 004C31C8

Strings

DO[, xrefs: 004C316C
pO[, xrefs: 004C3155

Memory Dump Source

Source File: 00000002.00000002.2066068405.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000002.00000002.2066041307.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066112606.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066133134.00000000004EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066199717.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID: DO[$pO[
API String ID: 2081738530-1813791736
Opcode ID: 86569a7a134f25fcfb986a2c94a421c4b17fbb95ce0c36c7f1ccb38182bb35f2
Instruction ID: f43b4d970b1d6a33a524819e581f5154951aef797a2443a49eae6758687d3567
Opcode Fuzzy Hash: 86569a7a134f25fcfb986a2c94a421c4b17fbb95ce0c36c7f1ccb38182bb35f2
Instruction Fuzzy Hash: 7401243A500114BFCB54AF51D805EEE77A8EF81728B14464EF80257392EF38AF01C788

Function 004CA278 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303COMMON

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 004CA397
___TypeMatch.LIBVCRUNTIME ref: 004CA4A5
CallUnexpected.LIBVCRUNTIME ref: 004CA612

Strings

csm, xrefs: 004CA322
csm, xrefs: 004CA2B5
csm, xrefs: 004CA3CE

Memory Dump Source

Source File: 00000002.00000002.2066068405.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000002.00000002.2066041307.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066112606.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066133134.00000000004EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066199717.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: bd084257eb1abc2b7bf058a13017993e4ea80041defd002e1bc622ecf5c51fb8
Instruction ID: f3d325c2e5bfb8f6c2ba4a50cd6a363858344b7d3b86c2090f375d4f405ed108
Opcode Fuzzy Hash: bd084257eb1abc2b7bf058a13017993e4ea80041defd002e1bc622ecf5c51fb8
Instruction Fuzzy Hash: E7B1897980020DEFCF55DF95C885EAEBBB5AF04308B14805FE8006B252D739DE61CB9A

Function 004D35FF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,004D370C,?,?,00000000,00000000,?,?,004D38BA,00000021,FlsSetValue,004E69C8,004E69D0,00000000), ref: 004D36C0

Strings

api-ms-, xrefs: 004D3656
ext-ms-, xrefs: 004D366A

Memory Dump Source

Source File: 00000002.00000002.2066068405.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000002.00000002.2066041307.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066112606.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066133134.00000000004EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066199717.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: d6700ce3e451b604a4867f0e0fe22b7f03929138ff27007eda637ce6f1d88459
Instruction ID: 72d3798394d2c05a770bc98a5774bd461ebc9500fded15b62475ffdf1ac3ec19
Opcode Fuzzy Hash: d6700ce3e451b604a4867f0e0fe22b7f03929138ff27007eda637ce6f1d88459
Instruction Fuzzy Hash: 0021D531A01210BBCB319F219C68A5B3768AB41766F290627F915AB391D778EF01C6DA

Function 004C25C5 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004C25D1
int.LIBCPMT ref: 004C25E4

Part of subcall function 004C16DA: std::_Lockit::_Lockit.LIBCPMT ref: 004C16EB
Part of subcall function 004C16DA: std::_Lockit::~_Lockit.LIBCPMT ref: 004C1705

std::_Facet_Register.LIBCPMT ref: 004C2617
std::_Lockit::~_Lockit.LIBCPMT ref: 004C262D
Concurrency::cancel_current_task.LIBCPMT ref: 004C2638

Strings

HO[, xrefs: 004C25DC

Memory Dump Source

Source File: 00000002.00000002.2066068405.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000002.00000002.2066041307.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066112606.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066133134.00000000004EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066199717.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID: HO[
API String ID: 2081738530-177266396
Opcode ID: fbe851eac835b5899b5643f104823385747e5965bc840aa45ce505b18409e63d
Instruction ID: f4db926c12eec6af5535d89e0c4bdb0ae8e98fe8526e8fd0518bedefe8cd6d6d
Opcode Fuzzy Hash: fbe851eac835b5899b5643f104823385747e5965bc840aa45ce505b18409e63d
Instruction Fuzzy Hash: 3C01D43A600114BBCB55AB65C905EEE7768DF85724F11424FF802573A1EBB8AF028798

Function 004C6751 Relevance: 9.2, APIs: 6, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 004C679A
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 004C6805
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004C6822
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 004C6861
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004C68C0
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 004C68E3

Memory Dump Source

Source File: 00000002.00000002.2066068405.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000002.00000002.2066041307.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066112606.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066133134.00000000004EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066199717.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 2781e9fcd670cc6f8c8640b8c949cf1656b92106863f7af17978584bb00a2e8a
Instruction ID: 6ead63d353c8ccd2243a5c0d5c157cc15e285738e4b881732e1e23d63ef8307c
Opcode Fuzzy Hash: 2781e9fcd670cc6f8c8640b8c949cf1656b92106863f7af17978584bb00a2e8a
Instruction Fuzzy Hash: B351D07A50120AABDF60AF55CC44FAB7BA9EF44754F16842EF905A6250DB39CD00CB68

Function 004C9F0A Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,004C9F01,004C80FB,004C77B5), ref: 004C9F18
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 004C9F26
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 004C9F3F
SetLastError.KERNEL32(00000000,004C9F01,004C80FB,004C77B5), ref: 004C9F91

Memory Dump Source

Source File: 00000002.00000002.2066068405.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000002.00000002.2066041307.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066112606.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066133134.00000000004EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066199717.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6049e0c36028fe846bff13b38c7cdc6490d067ce3ed2ca417a36132e90f88bfb
Instruction ID: 9f62e71f915faba16f617a64bbd84968c2bf2251352954619ec8f63695d7da83
Opcode Fuzzy Hash: 6049e0c36028fe846bff13b38c7cdc6490d067ce3ed2ca417a36132e90f88bfb
Instruction Fuzzy Hash: DB01D83A20C361BEA7A42A767CCEF672745FB01778724023FF1108A1E6EF5A4D01518D

Function 004D0E7B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,004E2025,000000FF,?,004D0E0B,004D0F3B,?,004D0DDF,00000000), ref: 004D0EB0
GetProcAddress.KERNEL32(00000000,CorExitProcess,?,?,00000000,004E2025,000000FF,?,004D0E0B,004D0F3B,?,004D0DDF,00000000), ref: 004D0EC2
FreeLibrary.KERNEL32(00000000,?,?,00000000,004E2025,000000FF,?,004D0E0B,004D0F3B,?,004D0DDF,00000000), ref: 004D0EE4

Strings

CorExitProcess, xrefs: 004D0EBA
mscoree.dll, xrefs: 004D0EA9

Memory Dump Source

Source File: 00000002.00000002.2066068405.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000002.00000002.2066041307.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066112606.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066133134.00000000004EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066199717.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: cfec1d245605b13d0896357a7a08d5c79a46e2d403c6255aedd0482c24b7bdd2
Instruction ID: 407de137f6f97285b02752e8bb5b6401058dc16e098bd96e2275aa5b0853b115
Opcode Fuzzy Hash: cfec1d245605b13d0896357a7a08d5c79a46e2d403c6255aedd0482c24b7bdd2
Instruction Fuzzy Hash: 4E01A731500659EFDB128F41DC49BAFBBB8FB04722F00052BE811A7391EB789900CA58

Function 004C4D9C Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004C4DA3
std::_Lockit::_Lockit.LIBCPMT ref: 004C4DAE
std::_Lockit::~_Lockit.LIBCPMT ref: 004C4E1C

Part of subcall function 004C4EFF: std::locale::_Locimp::_Locimp.LIBCPMT ref: 004C4F17

std::locale::_Setgloballocale.LIBCPMT ref: 004C4DC9
_Yarn.LIBCPMT ref: 004C4DDF

Memory Dump Source

Source File: 00000002.00000002.2066068405.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000002.00000002.2066041307.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066112606.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066133134.00000000004EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066199717.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: b3ab9adf7c49731727f0eaf465a1c5c043ab6a3c9a20d69b366f41cc45e0b8af
Instruction ID: 4518d22efc48399e02261a07613934fa03bd37a4f325e900abf7cb4e1bd4e9b5
Opcode Fuzzy Hash: b3ab9adf7c49731727f0eaf465a1c5c043ab6a3c9a20d69b366f41cc45e0b8af
Instruction Fuzzy Hash: 20019A79A001909BCB46EF61D995A7D77A1BB84315B16800FE81217392CB3C6E06DB89

Function 004D6888 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 173COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004D6A20
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004D6A33

Strings

^hM, xrefs: 004D6907
^hM, xrefs: 004D6929

Memory Dump Source

Source File: 00000002.00000002.2066068405.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000002.00000002.2066041307.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066112606.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066133134.00000000004EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066199717.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: ^hM$^hM
API String ID: 885266447-1182382858
Opcode ID: 45b46c6b2c2186212d6ff6c47f8f5ca8bfd23470a37298ba18f8160f25da4a9b
Instruction ID: 011d7d848b220e993517c8d16e6758193a646962e2b5a5d96f27b63fc37fc775
Opcode Fuzzy Hash: 45b46c6b2c2186212d6ff6c47f8f5ca8bfd23470a37298ba18f8160f25da4a9b
Instruction Fuzzy Hash: C55191B1A00148AFCF14CF99C8A1AAEBBB2EF49350F15815BE895A7351D339ED42CF54

Function 004C28E9 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 126COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 004C28F0
_strlen.LIBCMT ref: 004C2908

Strings

input string: , xrefs: 004C2903, 004C29CE
xN[, xrefs: 004C294F

Memory Dump Source

Source File: 00000002.00000002.2066068405.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000002.00000002.2066041307.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066112606.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066133134.00000000004EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066199717.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: H_prolog3_catch_strlen
String ID: input string: $xN[
API String ID: 3133806014-4158660745
Opcode ID: 8d9fe5703f8e829ccf08b5ec7fd768545cff65b4d1467ccb19f041f2ba01df28
Instruction ID: 530fdb0df99ebb75456f6fe3a2f747d05f297172d9beb560d3abb8f6af535347
Opcode Fuzzy Hash: 8d9fe5703f8e829ccf08b5ec7fd768545cff65b4d1467ccb19f041f2ba01df28
Instruction Fuzzy Hash: 7F41B579B002008FCBA0DB69CAC0E6D77B1BB48734F29424FE415A73A2C6F5AC41CB59

Function 004CB052 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,004CB003,00000000,?,005B54C4,?,?,?,004CB1A6,00000004,InitializeCriticalSectionEx,004E4C70,InitializeCriticalSectionEx), ref: 004CB05F
GetLastError.KERNEL32(?,004CB003,00000000,?,005B54C4,?,?,?,004CB1A6,00000004,InitializeCriticalSectionEx,004E4C70,InitializeCriticalSectionEx,00000000,?,004CAF5D), ref: 004CB069
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 004CB091

Strings

api-ms-, xrefs: 004CB076

Memory Dump Source

Source File: 00000002.00000002.2066068405.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000002.00000002.2066041307.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066112606.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066133134.00000000004EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066199717.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 3b4bed5e43fbb8e18260c01669b98aa2e4aa05eadd58102deb05afa84dec4115
Instruction ID: 3fa1d5d944ec88fda4182c2850afaa244d7e92f9c382a351ba988cfd133321b0
Opcode Fuzzy Hash: 3b4bed5e43fbb8e18260c01669b98aa2e4aa05eadd58102deb05afa84dec4115
Instruction Fuzzy Hash: 70E01274640344B7DB211F72EC4AF1A3A54AB40B55F144076FA0CAD1E1D7659A5085CC

Function 004D582E Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 004D5891

Part of subcall function 004D98E5: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,004D89AA,?,00000000,-00000008), ref: 004D9991

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 004D5AEC
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 004D5B34
GetLastError.KERNEL32 ref: 004D5BD7

Memory Dump Source

Source File: 00000002.00000002.2066068405.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000002.00000002.2066041307.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066112606.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066133134.00000000004EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066199717.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 376bea2b079986c3fd21da8065f4e56178424d44a7a334b16c85a8fc1e156455
Instruction ID: 8d9c77296adcd51c308c30d7adce332801e7059f6727de08bae5cc0b719456b0
Opcode Fuzzy Hash: 376bea2b079986c3fd21da8065f4e56178424d44a7a334b16c85a8fc1e156455
Instruction Fuzzy Hash: A8D18CB5D006589FCB05CFA8C890AADBBB5FF09314F28416BE456E7341EB34A946CF54

Function 004CA021 Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 004CA0E8
___AdjustPointer.LIBCMT ref: 004CA10B
___AdjustPointer.LIBCMT ref: 004CA1A7

Memory Dump Source

Source File: 00000002.00000002.2066068405.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000002.00000002.2066041307.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066112606.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066133134.00000000004EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066199717.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: b07fb726297c6d7aa63ecfb1a985e229bcfc2ebf46f8a60382e72262c784082d
Instruction ID: f8a42183039e9f6e8ad5a29d6db9ca25d05c471e2c1f0b9d6a7e39d5156b8a7b
Opcode Fuzzy Hash: b07fb726297c6d7aa63ecfb1a985e229bcfc2ebf46f8a60382e72262c784082d
Instruction Fuzzy Hash: 4551E37960120AAFDB698F56C841F7A77A4EF00718F18412FE84147391DB39AC61DB9A

Function 004E0616 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConso.KERNEL32(00000000,00000000,?,00000000,00000000,?,004DF049,00000000,00000001,00000000,?,?,004D5C2B,?,00000000,00000000), ref: 004E062D
GetLastError.KERNEL32(?,004DF049,00000000,00000001,00000000,?,?,004D5C2B,?,00000000,00000000,?,?,?,004D61B2,00000000), ref: 004E0639

Part of subcall function 004E05FF: CloseHandle.KERNEL32(FFFFFFFE,004E0649,?,004DF049,00000000,00000001,00000000,?,?,004D5C2B,?,00000000,00000000,?,?), ref: 004E060F

___initconout.LIBCMT ref: 004E0649

Part of subcall function 004E05C1: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,004E05F0,004DF036,?,?,004D5C2B,?,00000000,00000000,?), ref: 004E05D4

WriteConso.KERNEL32(00000000,00000000,?,00000000,?,004DF049,00000000,00000001,00000000,?,?,004D5C2B,?,00000000,00000000,?), ref: 004E065E

Memory Dump Source

Source File: 00000002.00000002.2066068405.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000002.00000002.2066041307.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066112606.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066133134.00000000004EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066199717.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: ConsoWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 1327366883-0
Opcode ID: 6ff8b9b6e930565a6bb9a9dfd0105c9818d80cd778a287d3665571bfa8dcf1a3
Instruction ID: 93934a9356787c62b20f84325b131c10896ce8c0f73639908e311d7458e7f49d
Opcode Fuzzy Hash: 6ff8b9b6e930565a6bb9a9dfd0105c9818d80cd778a287d3665571bfa8dcf1a3
Instruction Fuzzy Hash: E0F03736400199BBCF125F97EC48E8A3F65FF48362B044569F9199A131C6718A60DF98

Function 004C263E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 187COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 004C2645
_strlen.LIBCMT ref: 004C265F

Strings

pO[, xrefs: 004C26AE

Memory Dump Source

Source File: 00000002.00000002.2066068405.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000002.00000002.2066041307.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066112606.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066133134.00000000004EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066199717.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: H_prolog3_catch_strlen
String ID: pO[
API String ID: 3133806014-552102644
Opcode ID: 3e8597b8314083715665bcefcdd1caccbcb09d2d4b06288dd44d082b74bdf497
Instruction ID: cb0539e37111b0a531ff75cf1df551e198b85516c1fafe135bf601d745433259
Opcode Fuzzy Hash: 3e8597b8314083715665bcefcdd1caccbcb09d2d4b06288dd44d082b74bdf497
Instruction Fuzzy Hash: 57716078E012058FCB64DF99D980EADB7F1BF48314B24825EE415AB392D7B8AD42CF54

Function 004C9D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 004C9D4F
__IsNonwritableInCurrentImage.LIBCMT ref: 004C9E03

Strings

csm, xrefs: 004C9DED

Memory Dump Source

Source File: 00000002.00000002.2066068405.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000002.00000002.2066041307.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066112606.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066133134.00000000004EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066199717.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 427bb8b9c59822d2145f1adf9cd135c67b1e5b617d440f5eee92f3a9aa7a84f5
Instruction ID: 5a6075f1bb3929a43a19bd17cde543692e1711d423893af617633a9855f86066
Opcode Fuzzy Hash: 427bb8b9c59822d2145f1adf9cd135c67b1e5b617d440f5eee92f3a9aa7a84f5
Instruction Fuzzy Hash: 4941C638A00218ABCF50DF59C888F9EBBB1AF45318F14815FE8156B392D7399E11CB95

Function 004CA61D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 004CA642

Strings

MOC, xrefs: 004CA654
RCC, xrefs: 004CA65C

Memory Dump Source

Source File: 00000002.00000002.2066068405.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000002.00000002.2066041307.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066112606.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066133134.00000000004EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066199717.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 45d56c5c9a639abef8bb38956ac9f455838d8e473b16656e60d6e2e8d98527d2
Instruction ID: 877cc43cdc847d85da4bf6c1fdace910be984000e653ca669e3fc15e4d46042a
Opcode Fuzzy Hash: 45d56c5c9a639abef8bb38956ac9f455838d8e473b16656e60d6e2e8d98527d2
Instruction Fuzzy Hash: 1641473590020DAFCF16CF98CD85FAEBBB5BF48308F19405EF90466251D7399960DB5A

Function 004C693B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 004C72E3
___raise_securityfailure.LIBCMT ref: 004C73CB

Strings

`Q[, xrefs: 004C73C6

Memory Dump Source

Source File: 00000002.00000002.2066068405.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000002.00000002.2066041307.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066112606.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066133134.00000000004EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066199717.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: `Q[
API String ID: 3761405300-3901748827
Opcode ID: 09228daee5f0710627490194a0cd5330037726245915be5a6ad9e31a7db4cb2c
Instruction ID: cc20897adb86d7c0ebbd48e76711b00a73fe05f3e8181254e79fa2449b2609e9
Opcode Fuzzy Hash: 09228daee5f0710627490194a0cd5330037726245915be5a6ad9e31a7db4cb2c
Instruction Fuzzy Hash: E52125B8502B009BD799DF29F985704BBA4FB68300F54422AE5049B3B1F3B46989EF49

Function 004C73E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 004C73EB
___raise_securityfailure.LIBCMT ref: 004C74A8

Strings

`Q[, xrefs: 004C74A3

Memory Dump Source

Source File: 00000002.00000002.2066068405.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000002.00000002.2066041307.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066112606.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066133134.00000000004EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066199717.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: `Q[
API String ID: 3761405300-3901748827
Opcode ID: 1ba1338820687ad6800a1742a3ee74ea73f9eb03fcb4ff23fecaf11688f66fa7
Instruction ID: 6956842c869adc949f369f0e500d65e3bb2b7acb5701eb83606abc6077522c09
Opcode Fuzzy Hash: 1ba1338820687ad6800a1742a3ee74ea73f9eb03fcb4ff23fecaf11688f66fa7
Instruction Fuzzy Hash: BC11C3B8516B449BDB8ADF29F981744BBA4FB68300B04535AE9089B370F370694DEF45

Function 004C1605 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004C160C
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 004C1644

Part of subcall function 004C4E9A: _Yarn.LIBCPMT ref: 004C4EB9
Part of subcall function 004C4E9A: _Yarn.LIBCPMT ref: 004C4EDD

Strings

bad locale name, xrefs: 004C1652

Memory Dump Source

Source File: 00000002.00000002.2066068405.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000002.00000002.2066041307.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066112606.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066133134.00000000004EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2066199717.00000000005B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c0000_aO1TcEaxfW.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: f05da5a036d7ccd16b7466ff5816ad52d35535dece5a10e40359ffd68c79ca9f
Instruction ID: 84514c555865795cd5b8bde9f2ca37c0846846fc85f46d95b794e10b63ab47ca
Opcode Fuzzy Hash: f05da5a036d7ccd16b7466ff5816ad52d35535dece5a10e40359ffd68c79ca9f
Instruction Fuzzy Hash: 72F017B5506B909E83709FBB8581947FBE4BE29311394CA2FE1DEC3A11D734A504CB6E

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.892174570871243
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	aO1TcEaxfW.exe
File size:	1'040'784 bytes
MD5:	479c1f5c983e8c2e0f2f3b9a9ebb6d53
SHA1:	c7c3bcf6fd11e394af0964072cf97f2f7bc5daa7
SHA256:	e00ad02b0b162b28aa86c99845253184960e5532f7f74091cfb5a8a677084347
SHA512:	4a4e6bf9c882ed51306d83de5328b66c0f89cd6b1f4daf551a5f76a45a3ecce9a62e712c486bd3d5a4f78a0592b71f1faa474c31a26aabddc677b9f99a1e1c8c
SSDEEP:	12288:8ZKj8X7/WmBgjKCI1izUgcPl0zVYMuPqiSCCx20mPM05o14SUUniAWhI4Dz+Ke7s:DjIQjKx+YMuSi80pkUUUUnFWhbyCEQ
TLSH:	BE2512517084C033DA62283106F4D9B56E3D7AE10E91A9DF23E5AB7E0F613C1E631A6E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........a.............U.......U...,...U.......U.......................................................Rich...........................

Entrypoint:	0x406bf0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6709730D [Fri Oct 11 18:48:45 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2bf5d9e2e4bbff197e62f5db8f2f3336

Signature Valid:	false
Signature Issuer:	CN=Microsoft Code Signing PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	19/10/2023 21:51:12 16/10/2024 21:51:12
Subject Chain	CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	2169E18183DAF704160A117E905BFDA4
Thumbprint SHA-1:	CB9C4FBEA1D87D2D468AC5A9CAAB0163F6AD8401
Thumbprint SHA-256:	C4405F06DFB035F3AD360D29D27D434E004E054B6FB18FA3A5566A9F9AFA8296
Serial:	3300000557CF90DDC7D1C0888C000000000557

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2c960	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf8000	0x10	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xf92c8	0x4ec8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xf6000	0x1bf8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2ac48	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ab88	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x128	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2116b	0x21200	ead13d05d0a1674cd36c1409f0dc8b44	False	0.5804908608490567	data	6.6405903593922675	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0xa004	0xa200	d0ff5210149f4d4d00f32d30ac0d4eea	False	0.4287229938271605	data	4.917050456898412	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2e000	0xc7d54	0xc6e00	41072ea328a99b1378ccbe2db3543dfc	False	0.9963478649434317	DOS executable (block device driver \377\377\377\377)	7.998247362969363	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0xf6000	0x1bf8	0x1c00	6c4305c17e9b7059ead3dd6ffecd73f8	False	0.7600446428571429	data	6.53867085985248	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0xf8000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report aO1TcEaxfW.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: aO1TcEaxfW.exePID: 2636, Parent PID: 1028

General

Chronological Activities

Analysis Process: aO1TcEaxfW.exePID: 5540, Parent PID: 2636

General

Chronological Activities

Analysis Process: aO1TcEaxfW.exePID: 4396, Parent PID: 2636

General

Chronological Activities

Analysis Process: aO1TcEaxfW.exePID: 1776, Parent PID: 2636

General

Chronological Activities

Windows Analysis Report
aO1TcEaxfW.exe