Edit tour

Windows Analysis Report
1213af0.exe

Overview

General Information

Sample name:1213af0.exe
(renamed file extension from msi to exe)
Original sample name:1213af0.msi
Analysis ID:1671108
MD5:46a1aeeb49d480d439c5949621e00d4c
SHA1:4e4023baff17477450cc2d99f95ccf0c53264feb
SHA256:f42ff9ee5c70707c85832f3158d0dd2c9c38418e6f0d4c3c2c6c91f675883a06
Infos:

Detection

Score:52
Range:0 - 100
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected BatToExe compiled binary
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
PE file contains sections with non-standard names
Sample execution stops while process was sleeping (likely an evasion)
Uses code obfuscation techniques (call, push, ret)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
  • System is w10x64
  • 1213af0.exe (PID: 7972 cmdline: "C:\Users\user\Desktop\1213af0.exe" MD5: 46A1AEEB49D480D439C5949621E00D4C)
    • cmd.exe (PID: 8012 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\1\1213af0.bat" C:\Users\user\Desktop\1213af0.exe " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 8020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup
No configs have been found
SourceRuleDescriptionAuthorStrings
00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmpJoeSecurity_BatToExeYara detected BatToExe compiled binaryJoe Security
    00000000.00000002.1150907265.000000000050C000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_BatToExeYara detected BatToExe compiled binaryJoe Security
      Process Memory Space: 1213af0.exe PID: 7972JoeSecurity_BatToExeYara detected BatToExe compiled binaryJoe Security
        SourceRuleDescriptionAuthorStrings
        0.2.1213af0.exe.140000000.0.unpackJoeSecurity_BatToExeYara detected BatToExe compiled binaryJoe Security
          No Sigma rule has matched
          No Suricata rule has matched

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Source: 1213af0.exeVirustotal: Detection: 23%Perma Link
          Source: C:\Users\user\Desktop\1213af0.exeCode function: 0_2_00000001400042D4 strlen,strlen,RtlAllocateHeap,_mbscpy,_mbscat,_mbscat,FindFirstFileA,GetLastError,HeapFree,0_2_00000001400042D4
          Source: C:\Users\user\Desktop\1213af0.exeCode function: 0_2_0000000140011628 FindFirstFileA,CoInitialize,0_2_0000000140011628
          Source: C:\Users\user\Desktop\1213af0.exeCode function: 0_2_000000014000325C NtdllDefWindowProc_A,GetWindowLongPtrA,GetWindowTextLengthA,RtlAllocateHeap,GetWindowTextA,EnableWindow,DestroyWindow,UnregisterClassA,0_2_000000014000325C
          Source: C:\Users\user\Desktop\1213af0.exeCode function: 0_2_00000001400116E8 NtdllDefWindowProc_A,0_2_00000001400116E8
          Source: C:\Users\user\Desktop\1213af0.exeCode function: 0_2_0000000140009FF00_2_0000000140009FF0
          Source: C:\Users\user\Desktop\1213af0.exeCode function: 0_2_00000001400096000_2_0000000140009600
          Source: C:\Users\user\Desktop\1213af0.exeCode function: 0_2_00000001400092000_2_0000000140009200
          Source: C:\Users\user\Desktop\1213af0.exeCode function: 0_2_0000000140007CBF0_2_0000000140007CBF
          Source: C:\Users\user\Desktop\1213af0.exeCode function: 0_2_0000000140008EE00_2_0000000140008EE0
          Source: C:\Users\user\Desktop\1213af0.exeCode function: 0_2_00000001400074F10_2_00000001400074F1
          Source: C:\Users\user\Desktop\1213af0.exeCode function: 0_2_00000001400059100_2_0000000140005910
          Source: C:\Users\user\Desktop\1213af0.exeCode function: 0_2_00000001400073730_2_0000000140007373
          Source: C:\Users\user\Desktop\1213af0.exeCode function: 0_2_00000001400079AA0_2_00000001400079AA
          Source: C:\Users\user\Desktop\1213af0.exeCode function: 0_2_00000001400033BC0_2_00000001400033BC
          Source: classification engineClassification label: mal52.evad.winEXE@5/1@0/0
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8020:120:WilError_03
          Source: C:\Users\user\Desktop\1213af0.exeFile created: C:\Users\user\AppData\Local\Temp\1Jump to behavior
          Source: C:\Users\user\Desktop\1213af0.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\1\1213af0.bat" C:\Users\user\Desktop\1213af0.exe "
          Source: C:\Users\user\Desktop\1213af0.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
          Source: C:\Users\user\Desktop\1213af0.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: 1213af0.exeVirustotal: Detection: 23%
          Source: C:\Users\user\Desktop\1213af0.exeFile read: C:\Users\user\Desktop\1213af0.exeJump to behavior
          Source: unknownProcess created: C:\Users\user\Desktop\1213af0.exe "C:\Users\user\Desktop\1213af0.exe"
          Source: C:\Users\user\Desktop\1213af0.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\1\1213af0.bat" C:\Users\user\Desktop\1213af0.exe "
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\1213af0.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\1\1213af0.bat" C:\Users\user\Desktop\1213af0.exe "Jump to behavior
          Source: C:\Users\user\Desktop\1213af0.exeSection loaded: apphelp.dllJump to behavior
          Source: C:\Users\user\Desktop\1213af0.exeSection loaded: winmm.dllJump to behavior
          Source: C:\Users\user\Desktop\1213af0.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Users\user\Desktop\1213af0.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Users\user\Desktop\1213af0.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Users\user\Desktop\1213af0.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Users\user\Desktop\1213af0.exeSection loaded: propsys.dllJump to behavior
          Source: C:\Users\user\Desktop\1213af0.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Users\user\Desktop\1213af0.exeSection loaded: edputil.dllJump to behavior
          Source: C:\Users\user\Desktop\1213af0.exeSection loaded: urlmon.dllJump to behavior
          Source: C:\Users\user\Desktop\1213af0.exeSection loaded: iertutil.dllJump to behavior
          Source: C:\Users\user\Desktop\1213af0.exeSection loaded: srvcli.dllJump to behavior
          Source: C:\Users\user\Desktop\1213af0.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Users\user\Desktop\1213af0.exeSection loaded: windows.staterepositoryps.dllJump to behavior
          Source: C:\Users\user\Desktop\1213af0.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Users\user\Desktop\1213af0.exeSection loaded: wintypes.dllJump to behavior
          Source: C:\Users\user\Desktop\1213af0.exeSection loaded: appresolver.dllJump to behavior
          Source: C:\Users\user\Desktop\1213af0.exeSection loaded: bcp47langs.dllJump to behavior
          Source: C:\Users\user\Desktop\1213af0.exeSection loaded: slc.dllJump to behavior
          Source: C:\Users\user\Desktop\1213af0.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Users\user\Desktop\1213af0.exeSection loaded: sppc.dllJump to behavior
          Source: C:\Users\user\Desktop\1213af0.exeSection loaded: onecorecommonproxystub.dllJump to behavior
          Source: C:\Users\user\Desktop\1213af0.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
          Source: C:\Users\user\Desktop\1213af0.exeSection loaded: pcacli.dllJump to behavior
          Source: C:\Users\user\Desktop\1213af0.exeSection loaded: mpr.dllJump to behavior
          Source: C:\Users\user\Desktop\1213af0.exeSection loaded: sfc_os.dllJump to behavior
          Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
          Source: C:\Users\user\Desktop\1213af0.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
          Source: 1213af0.exeStatic PE information: Image base 0x140000000 > 0x60000000

          Data Obfuscation

          barindex
          Source: Yara matchFile source: 0.2.1213af0.exe.140000000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.1150907265.000000000050C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: 1213af0.exe PID: 7972, type: MEMORYSTR
          Source: C:\Users\user\Desktop\1213af0.exeCode function: 0_2_00000001400040FC GetTempPathA,LoadLibraryA,GetProcAddress,GetLongPathNameA,FreeLibrary,0_2_00000001400040FC
          Source: 1213af0.exeStatic PE information: section name: UPX2
          Source: C:\Users\user\Desktop\1213af0.exeCode function: 0_2_000000014000F99E push rbx; ret 0_2_000000014000F99F
          Source: initial sampleStatic PE information: section name: UPX0
          Source: initial sampleStatic PE information: section name: UPX1
          Source: C:\Users\user\Desktop\1213af0.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\1213af0.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Users\user\Desktop\1213af0.exeCode function: 0_2_00000001400042D4 strlen,strlen,RtlAllocateHeap,_mbscpy,_mbscat,_mbscat,FindFirstFileA,GetLastError,HeapFree,0_2_00000001400042D4
          Source: C:\Users\user\Desktop\1213af0.exeCode function: 0_2_0000000140011628 FindFirstFileA,CoInitialize,0_2_0000000140011628
          Source: C:\Users\user\Desktop\1213af0.exeCode function: 0_2_00000001400040FC GetTempPathA,LoadLibraryA,GetProcAddress,GetLongPathNameA,FreeLibrary,0_2_00000001400040FC
          Source: C:\Users\user\Desktop\1213af0.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\1\1213af0.bat" C:\Users\user\Desktop\1213af0.exe "Jump to behavior
          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity Information1
          Scripting
          Valid Accounts1
          Native API
          1
          Scripting
          11
          Process Injection
          1
          Software Packing
          OS Credential Dumping2
          File and Directory Discovery
          Remote Services1
          Archive Collected Data
          1
          Encrypted Channel
          Exfiltration Over Other Network MediumAbuse Accessibility Features
          CredentialsDomainsDefault AccountsScheduled Task/Job1
          DLL Side-Loading
          1
          DLL Side-Loading
          11
          Process Injection
          LSASS Memory1
          System Information Discovery
          Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
          Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
          DLL Side-Loading
          Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
          Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
          Obfuscated Files or Information
          NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 signatures2 2 Behavior Graph ID: 1671108 Sample: 1213af0.msi Startdate: 22/04/2025 Architecture: WINDOWS Score: 52 13 Multi AV Scanner detection for submitted file 2->13 15 Yara detected BatToExe compiled binary 2->15 7 1213af0.exe 3 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        process5 11 conhost.exe 9->11         started       

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand
          SourceDetectionScannerLabelLink
          1213af0.exe2%ReversingLabs
          1213af0.exe23%VirustotalBrowse
          No Antivirus matches
          No Antivirus matches
          No Antivirus matches
          No Antivirus matches
          No contacted domains info
          No contacted IP infos
          Joe Sandbox version:42.0.0 Malachite
          Analysis ID:1671108
          Start date and time:2025-04-22 16:44:36 +02:00
          Joe Sandbox product:CloudBasic
          Overall analysis duration:0h 1m 49s
          Hypervisor based Inspection enabled:false
          Report type:full
          Cookbook file name:default.jbs
          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
          Number of analysed new started processes analysed:4
          Number of new started drivers analysed:0
          Number of existing processes analysed:0
          Number of existing drivers analysed:0
          Number of injected processes analysed:0
          Technologies:
          • HCA enabled
          • EGA enabled
          • AMSI enabled
          Analysis Mode:default
          Analysis stop reason:Timeout
          Sample name:1213af0.exe
          (renamed file extension from msi to exe)
          Original Sample Name:1213af0.msi
          Detection:MAL
          Classification:mal52.evad.winEXE@5/1@0/0
          EGA Information:
          • Successful, ratio: 100%
          HCA Information:
          • Successful, ratio: 98%
          • Number of executed functions: 23
          • Number of non-executed functions: 18
          Cookbook Comments:
          • Stop behavior analysis, all processes terminated
          • Exclude process from analysis (whitelisted): svchost.exe
          • Not all processes where analyzed, report is missing behavior information
          • Report size getting too big, too many NtOpenKeyEx calls found.
          • Report size getting too big, too many NtQueryValueKey calls found.
          No simulations
          No context
          No context
          No context
          No context
          No context
          Process:C:\Users\user\Desktop\1213af0.exe
          File Type:DOS batch file, ASCII text, with CRLF line terminators
          Category:dropped
          Size (bytes):194
          Entropy (8bit):5.074091625588317
          Encrypted:false
          SSDEEP:3:mKDDFNnnzKL6qwKbWFHQZE9ckQs0tmK/tdM2tRKVa8HE9ckQs0tmK/tdM2NRrHlU:hD8zC9mS0tme3rRBeS0tme3LRrFZ2v
          MD5:F0563EDF1141D0C6355B5B4F88780B88
          SHA1:13FEC136077D6E08AD64C01A7E76B865501D9BAD
          SHA-256:1EFAC00635647067F7FE305FA7A324082D68A47A52BC768A5636E48FC6C6BD7E
          SHA-512:0B01A7B14C78D42EC2C92D4FD7D7A981F340A051CC69129CB4850FE4EF14C97BE9B6AC002DE615B1E48C38D369347487E00E99BBFD5F9CA63A2273387E0CC498
          Malicious:false
          Reputation:low
          Preview:@echo off..shift /0..@echo on..@ECHO off....@IF EXIST "%ProgramFiles%\Autodesk\Desktop Connect\forever\stopall.cmd" CALL "%ProgramFiles%\Autodesk\Desktop Connect\forever\Stopall.cmd" & SLEEP 1..
          File type:PE32+ executable (GUI) x86-64, for MS Windows
          Entropy (8bit):7.869927523713553
          TrID:
          • Win64 Executable GUI (202006/5) 81.25%
          • UPX compressed Win32 Executable (30571/9) 12.30%
          • Win64 Executable (generic) (12005/4) 4.83%
          • Generic Win/DOS Executable (2004/3) 0.81%
          • DOS Executable Generic (2002/1) 0.81%
          File name:1213af0.exe
          File size:34'928 bytes
          MD5:46a1aeeb49d480d439c5949621e00d4c
          SHA1:4e4023baff17477450cc2d99f95ccf0c53264feb
          SHA256:f42ff9ee5c70707c85832f3158d0dd2c9c38418e6f0d4c3c2c6c91f675883a06
          SHA512:5dd1f94b48bfb326610bfcb67db5461337a98bc16c412ce88b7a1bee9293d551bdb7112b93cc04eb3d27981cfed8da9c83332d37ca5017f71dff796599459fec
          SSDEEP:768:KvW4uetZHkukfX9bGy3gUwMnmfRhoKPXQZ4:yxLt1kTdzoMmf4sXy4
          TLSH:B7F2DFBBA53AF6F9C83740311E97288577B1F821A261FB33169530F78CA72615D649C3
          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....=U........../....2.............E.........@.............................p.............................................
          Icon Hash:90cececece8e8eb0
          Entrypoint:0x1400145b0
          Entrypoint Section:UPX1
          Digitally signed:false
          Imagebase:0x140000000
          Subsystem:windows gui
          Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE
          DLL Characteristics:
          Time Stamp:0x553DFCBE [Mon Apr 27 09:09:18 2015 UTC]
          TLS Callbacks:
          CLR (.Net) Version:
          OS Version Major:4
          OS Version Minor:0
          File Version Major:4
          File Version Minor:0
          Subsystem Version Major:4
          Subsystem Version Minor:0
          Import Hash:4e30e4681de5e2c764f2f11fed7c44b9
          Instruction
          push ebx
          push esi
          push edi
          push ebp
          dec eax
          lea esi, dword ptr [FFFF8A6Ah]
          dec eax
          lea edi, dword ptr [esi-0000C025h]
          push edi
          mov eax, 00012784h
          push eax
          dec eax
          mov ecx, esp
          dec eax
          mov edx, edi
          dec eax
          mov edi, esi
          mov esi, 00007580h
          push ebp
          dec eax
          mov ebp, esp
          inc esp
          mov ecx, dword ptr [ecx]
          dec ecx
          mov eax, edx
          dec eax
          mov edx, esi
          dec eax
          lea esi, dword ptr [edi+02h]
          push esi
          mov al, byte ptr [edi]
          dec edx
          mov cl, al
          and al, 07h
          shr cl, 00000003h
          dec eax
          mov ebx, FFFFFD00h
          dec eax
          shl ebx, cl
          mov cl, al
          dec eax
          lea ebx, dword ptr [esp+ebx*2-00000E78h]
          dec eax
          and ebx, FFFFFFC0h
          push 00000000h
          dec eax
          cmp esp, ebx
          jne 00007FA2C8521ADBh
          push ebx
          dec eax
          lea edi, dword ptr [ebx+08h]
          mov cl, byte ptr [esi-01h]
          dec edx
          mov byte ptr [edi+02h], al
          mov al, cl
          shr cl, 00000004h
          mov byte ptr [edi+01h], cl
          and al, 0Fh
          mov byte ptr [edi], al
          dec eax
          lea ecx, dword ptr [edi-04h]
          push eax
          inc ecx
          push edi
          dec eax
          lea eax, dword ptr [edi+04h]
          inc ebp
          xor edi, edi
          inc ecx
          push esi
          inc ecx
          mov esi, 00000001h
          inc ecx
          push ebp
          inc ebp
          xor ebp, ebp
          inc ecx
          push esp
          push ebp
          push ebx
          dec eax
          mov dword ptr [esp-10h], ecx
          dec eax
          mov dword ptr [esp-28h], eax
          mov eax, 00000001h
          dec eax
          mov dword ptr [esp-08h], esi
          dec esp
          mov dword ptr [esp-18h], eax
          mov ebx, eax
          inc esp
          mov dword ptr [esp-1Ch], ecx
          movzx ecx, byte ptr [edi+02h]
          shl ebx, cl
          mov ecx, ebx
          dec eax
          mov ebx, dword ptr [esp+38h]
          NameVirtual AddressVirtual Size Is in Section
          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
          IMAGE_DIRECTORY_ENTRY_IMPORT0x160000x2b8UPX2
          IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
          IMAGE_DIRECTORY_ENTRY_EXCEPTION0xc0000x750UPX0
          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
          IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
          IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
          IMAGE_DIRECTORY_ENTRY_IAT0x00x0
          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
          NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
          UPX00x10000xc0000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
          UPX10xd0000x90000x820091e73181aae1d191aedc713dedc7b7b1False0.9621694711538461data7.957983066607965IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
          UPX20x160000x10000x400c3bc6ef13cd011f51873d500ed0becd7False0.326171875data2.8497766926646224IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
          DLLImport
          KERNEL32.DLLLoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
          COMCTL32.DLLInitCommonControlsEx
          GDI32.DLLGetStockObject
          msvcrt.dllfree
          OLE32.DLLCoInitialize
          SHELL32.DLLShellExecuteExA
          SHLWAPI.DLLPathQuoteSpacesA
          USER32.DLLSetFocus
          WINMM.DLLtimeBeginPeriod
          No network behavior found
          02468s020406080100

          Click to jump to process

          Click to jump to process

          Target ID:0
          Start time:10:45:30
          Start date:22/04/2025
          Path:C:\Users\user\Desktop\1213af0.exe
          Wow64 process (32bit):false
          Commandline:"C:\Users\user\Desktop\1213af0.exe"
          Imagebase:0x140000000
          File size:34'928 bytes
          MD5 hash:46A1AEEB49D480D439C5949621E00D4C
          Has elevated privileges:true
          Has administrator privileges:true
          Programmed in:C, C++ or other language
          Yara matches:
          • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
          • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 00000000.00000002.1150907265.000000000050C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
          Reputation:low
          Has exited:true
          There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
          There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
          There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
          There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
          There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
          There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
          There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

          Target ID:1
          Start time:10:45:30
          Start date:22/04/2025
          Path:C:\Windows\System32\cmd.exe
          Wow64 process (32bit):false
          Commandline:C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\1\1213af0.bat" C:\Users\user\Desktop\1213af0.exe "
          Imagebase:0x7ff7eb930000
          File size:289'792 bytes
          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
          Has elevated privileges:true
          Has administrator privileges:true
          Programmed in:C, C++ or other language
          Reputation:high
          Has exited:true

          Target ID:2
          Start time:10:45:30
          Start date:22/04/2025
          Path:C:\Windows\System32\conhost.exe
          Wow64 process (32bit):false
          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Imagebase:0x7ff62fc20000
          File size:862'208 bytes
          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
          Has elevated privileges:true
          Has administrator privileges:true
          Programmed in:C, C++ or other language
          Reputation:high
          Has exited:true

          Execution Graph

          Execution Coverage

          Dynamic/Packed Code Coverage

          Signature Coverage

          Execution Coverage:12.8%
          Dynamic/Decrypted Code Coverage:0%
          Signature Coverage:12.2%
          Total number of Nodes:664
          Total number of Limit Nodes:8
          Show Legend
          Hide Nodes/Edges
          execution_graph 3469 1400038e4 GetWindowThreadProcessId GetCurrentThreadId 3470 140003975 3469->3470 3471 140003905 IsWindowVisible 3469->3471 3471->3470 3472 140003912 3471->3472 3473 1400065dc RtlAllocateHeap 3472->3473 3474 140003923 GetCurrentThreadId GetWindowLongPtrA 3473->3474 3475 14000394a 3474->3475 3476 14000394e GetForegroundWindow 3474->3476 3475->3476 3476->3470 3477 140003959 IsWindowEnabled 3476->3477 3477->3470 3478 140003966 EnableWindow 3477->3478 3478->3470 3479 1400058f0 3480 140005901 3479->3480 3481 1400058f9 memset 3479->3481 3481->3480 3530 140003230 3531 14000323d EnableWindow 3530->3531 3532 14000324f 3530->3532 3531->3532 3533 140004430 3534 14000444b 3533->3534 3535 14000446f 3534->3535 3536 14000445e FindNextFileA 3534->3536 3536->3535 3537 140004630 3538 140006354 3 API calls 3537->3538 3539 14000466a 3538->3539 3540 140004677 CreateFileA 3539->3540 3541 1400046af 3539->3541 3542 140004768 3540->3542 3544 1400046b5 CreateFileA 3541->3544 3547 1400046f3 3541->3547 3543 1400047e6 3542->3543 3549 140004778 3542->3549 3546 1400047d9 3543->3546 3550 140006420 HeapFree 3543->3550 3544->3542 3547->3542 3548 14000470b CreateFileA 3547->3548 3548->3542 3551 14000473d CreateFileA 3548->3551 3552 1400047a1 3549->3552 3553 140004789 RtlAllocateHeap 3549->3553 3550->3546 3551->3542 3552->3546 3554 1400047c8 SetFilePointer 3552->3554 3553->3552 3554->3546 3555 140008d30 3557 140008d48 3555->3557 3560 140008d9d 3555->3560 3556 140008dee memcpy memcpy 3558 140008e20 3556->3558 3557->3556 3557->3560 3559 140008e8b memcpy 3558->3559 3558->3560 3559->3560 3482 1400074f1 3485 1400074f6 3482->3485 3484 140007b92 3486 140007451 3485->3486 3487 140007763 memcpy 3485->3487 3486->3484 3488 1400071b0 3486->3488 3487->3486 3489 1400071dd 3488->3489 3490 14000723a memcpy 3489->3490 3491 14000721f memcpy 3489->3491 3492 1400071f7 3489->3492 3490->3492 3493 14000725b memcpy 3490->3493 3491->3492 3492->3484 3493->3492 3597 140007373 3598 14000737b 3597->3598 3599 1400071b0 3 API calls 3598->3599 3600 140007b92 3598->3600 3599->3600 3601 140003874 3602 1400033bc 49 API calls 3601->3602 3603 140003885 3602->3603 3494 1400086f6 3495 140007b2b 3494->3495 3495->3494 3496 1400071b0 3 API calls 3495->3496 3497 140007b92 3495->3497 3496->3497 3664 1400086ba 3665 1400086c3 3664->3665 3666 140007b2b 3664->3666 3667 1400071b0 3 API calls 3666->3667 3668 140007b92 3666->3668 3667->3668 3669 140007cbf 3671 140007987 3669->3671 3670 1400071b0 3 API calls 3672 140007b92 3670->3672 3671->3670 3671->3671 3671->3672 2928 140001000 2929 14000101d 2928->2929 3072 1400069a0 HeapCreate RtlAllocateHeap 2929->3072 2931 14000104a 3073 140004600 2931->3073 2935 140001059 3077 140003b04 2935->3077 2939 140001063 3084 140002417 2939->3084 2943 140001086 3100 140003b4c 2943->3100 2945 14000109d 2946 140006a30 2 API calls 2945->2946 2947 1400010ae 2946->2947 3104 140003f78 2947->3104 2949 1400010cc 2950 140006a30 2 API calls 2949->2950 2951 1400010dd 2950->2951 3109 140003f84 2951->3109 2953 1400010f4 2954 140006a30 2 API calls 2953->2954 2955 140001105 2954->2955 2956 140003f84 2 API calls 2955->2956 2957 140001135 2956->2957 2958 140006a30 2 API calls 2957->2958 2959 140001146 2958->2959 3113 140004b70 2959->3113 2961 140001167 3123 140004cf0 2961->3123 2966 140006a30 2 API calls 2967 1400011c4 2966->2967 3146 140006af0 2967->3146 2970 140001351 2972 140004cf0 2 API calls 2970->2972 2971 1400011ea 2973 140004cf0 2 API calls 2971->2973 2974 140001367 2972->2974 2975 140001200 2973->2975 3150 140004e50 2974->3150 2977 140004d50 19 API calls 2975->2977 2979 140001236 2977->2979 2978 140001376 2982 140004e50 2 API calls 2978->2982 2980 140006a30 2 API calls 2979->2980 2981 140001247 2980->2981 3239 1400033bc 2981->3239 2984 1400013a9 2982->2984 3155 140004eb0 2984->3155 2986 140006a30 2 API calls 2987 14000129f 2986->2987 2988 140006af0 strcmp 2987->2988 2994 1400012ae 2988->2994 2990 1400013df 3162 140004560 2990->3162 2992 1400013ee 2995 140006af0 strcmp 2992->2995 2993 1400018be 3238 140006a00 HeapFree HeapDestroy 2993->3238 3008 140001343 2994->3008 3277 1400056c0 2994->3277 2996 1400013fd 2995->2996 3004 140001422 2996->3004 3288 140002000 2996->3288 3001 1400018c8 HeapDestroy ExitProcess 3002 140006af0 strcmp 3003 140001319 3002->3003 3005 140001348 3003->3005 3006 14000131e 3003->3006 3170 140002557 3004->3170 3005->2974 3281 14000388c 3006->3281 3008->2993 3011 140006a30 2 API calls 3012 1400014de 3011->3012 3189 140003fe4 3012->3189 3018 14000151c 3019 140004f30 6 API calls 3018->3019 3020 140001538 3019->3020 3021 140004f30 6 API calls 3020->3021 3022 140001554 3021->3022 3213 140005020 3022->3213 3024 140001574 3025 140004560 4 API calls 3024->3025 3026 140001583 3025->3026 3027 140003fe4 SetCurrentDirectoryA 3026->3027 3028 14000159b PathAddBackslashA 3027->3028 3029 140003b4c 2 API calls 3028->3029 3030 1400015c8 3029->3030 3220 140003c24 3030->3220 3033 140003b4c 2 API calls 3034 140001629 3033->3034 3035 140003f78 2 API calls 3034->3035 3036 140001643 3035->3036 3037 140003c24 SetEnvironmentVariableA 3036->3037 3038 140001670 3037->3038 3039 140003b4c 2 API calls 3038->3039 3040 1400016a4 3039->3040 3223 140004000 3040->3223 3043 140003c24 SetEnvironmentVariableA 3044 1400016eb 3043->3044 3045 140003b4c 2 API calls 3044->3045 3046 14000170c 3045->3046 3047 140006a30 2 API calls 3046->3047 3048 14000171d PathQuoteSpacesA 3047->3048 3229 140006b50 3048->3229 3050 14000173f 3051 140006b50 RtlReAllocateHeap 3050->3051 3052 140001756 3051->3052 3053 140006b50 RtlReAllocateHeap 3052->3053 3054 14000176a 3053->3054 3055 140006a30 2 API calls 3054->3055 3056 14000177b 3055->3056 3057 140006b50 RtlReAllocateHeap 3056->3057 3058 140001791 3057->3058 3059 140006b50 RtlReAllocateHeap 3058->3059 3060 1400017a5 3059->3060 3061 140006a30 2 API calls 3060->3061 3062 1400017b6 ShellExecuteEx 3061->3062 3063 14000181a 3062->3063 3064 140001829 GetExitCodeProcess 3063->3064 3065 140001857 3063->3065 3064->3063 3066 140006b50 RtlReAllocateHeap 3065->3066 3067 14000187b 3066->3067 3068 140006b50 RtlReAllocateHeap 3067->3068 3069 14000188f 3068->3069 3233 1400040d8 3069->3233 3072->2931 3302 140006460 RtlAllocateHeap RtlAllocateHeap 3073->3302 3075 140001054 3076 140003e40 HeapCreate 3075->3076 3076->2935 3303 1400064e0 RtlAllocateHeap 3077->3303 3081 140003b30 RtlInitializeCriticalSection 3082 14000105e 3081->3082 3083 1400031f4 memset 00007FFCB9742D00 CoInitialize 3082->3083 3083->2939 3086 140002439 3084->3086 3085 1400024f7 3087 140006b50 RtlReAllocateHeap 3085->3087 3086->3085 3094 140006b50 RtlReAllocateHeap 3086->3094 3095 140006a30 RtlAllocateHeap RtlReAllocateHeap 3086->3095 3309 140003db8 3086->3309 3088 14000250b 3087->3088 3306 140006c30 3088->3306 3092 140006c30 HeapFree 3093 140001075 3092->3093 3096 140006a30 3093->3096 3094->3086 3095->3086 3097 140006a83 RtlReAllocateHeap 3096->3097 3098 140006a5e RtlAllocateHeap 3096->3098 3099 140006aae 3097->3099 3098->3099 3099->2943 3101 140006c60 RtlReAllocateHeap 3100->3101 3102 140003b69 GetModuleFileNameA 3101->3102 3103 140003b90 3102->3103 3103->2945 3105 140003ea4 3104->3105 3106 140006c60 RtlReAllocateHeap 3105->3106 3107 140003f3d 3106->3107 3108 140003f4e strncpy 3107->3108 3108->2949 3110 140006c60 RtlReAllocateHeap 3109->3110 3111 140003fa1 GetCurrentDirectoryA 3110->3111 3112 140003fb6 3111->3112 3112->2953 3323 140006354 3113->3323 3116 140004bce 3117 140004bd3 3116->3117 3119 140004c33 3116->3119 3120 140004bf6 3117->3120 3121 140004bde RtlAllocateHeap 3117->3121 3118 140004c48 3118->2961 3119->3118 3331 140006420 3119->3331 3120->2961 3121->3120 3125 140004d0a 3123->3125 3124 14000117d 3129 140004d50 3124->3129 3125->3124 3126 140004d2f SetFilePointer 3125->3126 3341 140004510 3125->3341 3126->3124 3128 140004d21 3128->3126 3130 140004d89 3129->3130 3131 1400011b3 3130->3131 3132 140004db1 3130->3132 3133 140004dcd 3130->3133 3131->2966 3356 1400050b0 RtlAllocateHeap 3132->3356 3344 1400052b0 RtlAllocateHeap 3133->3344 3138 140004dd7 3138->3131 3371 14000ae00 3138->3371 3139 140004dee 3139->3131 3142 140006c60 RtlReAllocateHeap 3139->3142 3144 140004de9 3142->3144 3143 140004dc8 3145 140004e21 HeapFree 3143->3145 3144->3145 3145->3131 3147 140006b06 strcmp 3146->3147 3149 1400011e1 3147->3149 3149->2970 3149->2971 3153 140004e65 3150->3153 3151 140004ea4 3151->2978 3152 140004e82 GetFileSize 3152->2978 3153->3151 3153->3152 3154 140004510 WriteFile 3153->3154 3154->3152 3157 140004ed7 3155->3157 3156 140004f18 3156->2990 3157->3156 3158 140004ee6 3157->3158 3159 140004efe ReadFile 3157->3159 3160 140005490 5 API calls 3158->3160 3159->3156 3161 140004ef1 3160->3161 3161->2990 3164 140004580 3162->3164 3169 14000456f 3162->3169 3163 1400045d6 3163->2992 3164->3163 3165 1400045be CloseHandle 3164->3165 3166 140004510 WriteFile 3164->3166 3167 140006420 HeapFree 3165->3167 3168 1400045ab HeapFree 3166->3168 3167->3163 3168->3165 3169->2992 3385 1400040fc 3170->3385 3172 140002589 3173 140006a30 2 API calls 3172->3173 3178 140002598 3173->3178 3174 140006b50 RtlReAllocateHeap 3174->3178 3176 140006a30 2 API calls 3176->3178 3178->3174 3178->3176 3179 14000261d 3178->3179 3392 1400031a0 3178->3392 3395 1400042d4 3178->3395 3417 140004290 3178->3417 3412 14000448c 3179->3412 3183 140006b50 RtlReAllocateHeap 3184 14000264f 3183->3184 3185 140006c30 HeapFree 3184->3185 3186 14000267d 3185->3186 3187 140006c30 HeapFree 3186->3187 3188 1400014cd 3187->3188 3188->3011 3190 1400014ea 3189->3190 3191 140003fed SetCurrentDirectoryA 3189->3191 3192 140004960 3190->3192 3191->3190 3193 140006354 3 API calls 3192->3193 3194 140004992 CreateFileA 3193->3194 3195 1400049c9 CreateFileA 3194->3195 3196 1400049fa 3194->3196 3195->3196 3200 140004a4a 3195->3200 3197 1400049ff 3196->3197 3196->3200 3198 140004a0a RtlAllocateHeap 3197->3198 3199 140001500 3197->3199 3198->3199 3202 140004f30 3199->3202 3200->3199 3201 140006420 HeapFree 3200->3201 3201->3199 3203 140004f54 3202->3203 3204 140005010 3203->3204 3208 140004f98 WriteFile 3203->3208 3209 140004f7f 3203->3209 3211 140004f92 3203->3211 3204->3018 3205 140004fe9 WriteFile 3205->3018 3206 140004fce 3207 1400055c0 4 API calls 3206->3207 3212 140004fd6 3207->3212 3208->3211 3424 1400055c0 3209->3424 3211->3205 3211->3206 3212->3018 3214 140005040 3213->3214 3215 140005094 3213->3215 3214->3215 3216 140005081 WriteFile 3214->3216 3217 140005065 3214->3217 3215->3024 3216->3215 3218 1400055c0 4 API calls 3217->3218 3219 14000506d 3218->3219 3219->3024 3221 1400015f5 3220->3221 3222 140003c30 SetEnvironmentVariableA 3220->3222 3221->3033 3222->3221 3224 14000401f 3223->3224 3225 140006c60 RtlReAllocateHeap 3224->3225 3226 14000405f 3225->3226 3227 1400016be 3226->3227 3228 140004079 strncpy 3226->3228 3227->3043 3228->3227 3230 140006b61 3229->3230 3231 140006b7e 3229->3231 3232 140006c60 RtlReAllocateHeap 3230->3232 3231->3050 3232->3231 3234 1400040a4 3233->3234 3235 1400018a8 RemoveDirectoryA 3234->3235 3236 1400040c2 DeleteFileA 3234->3236 3237 1400040b7 SetFileAttributesA 3234->3237 3235->2993 3236->3235 3237->3236 3238->3001 3433 14000334c 3239->3433 3242 14000334c 3 API calls 3243 1400033ff 3242->3243 3244 14000334c 3 API calls 3243->3244 3245 14000340a 3244->3245 3246 140003416 GetStockObject 3245->3246 3247 140003427 LoadIconA LoadCursorA RegisterClassExA 3245->3247 3246->3247 3437 140003988 3247->3437 3252 1400034b5 IsWindowEnabled 3253 1400034d9 3252->3253 3254 1400034c2 EnableWindow 3252->3254 3255 140003a84 3 API calls 3253->3255 3254->3253 3256 1400034e5 GetSystemMetrics GetSystemMetrics CreateWindowExA 3255->3256 3257 140003561 6 API calls 3256->3257 3258 1400037fe 3256->3258 3259 140003671 SendMessageA strlen strlen SendMessageA 3257->3259 3260 1400036b2 CreateWindowExA SendMessageA CreateAcceleratorTableA SetForegroundWindow BringWindowToTop 3257->3260 3261 140003811 HeapFree 3258->3261 3262 140003823 3258->3262 3259->3260 3263 1400037b0 3260->3263 3261->3262 3266 140003828 HeapFree 3262->3266 3267 14000383a 3262->3267 3264 140003772 GetMessageA 3263->3264 3265 1400037b9 3263->3265 3264->3265 3268 140003788 TranslateAccelerator 3264->3268 3271 1400037c7 3265->3271 3272 1400037be DestroyAcceleratorTable 3265->3272 3266->3267 3269 14000128e 3267->3269 3270 14000383f HeapFree 3267->3270 3268->3263 3273 14000379c TranslateMessage DispatchMessageA 3268->3273 3269->2986 3270->3269 3271->3258 3274 1400037d0 strlen 3271->3274 3272->3271 3273->3263 3275 140006c60 RtlReAllocateHeap 3274->3275 3276 1400037df _mbscpy HeapFree 3275->3276 3276->3258 3278 1400056e4 3277->3278 3279 140006c60 RtlReAllocateHeap 3278->3279 3280 1400012f3 3279->3280 3280->3002 3282 140003988 7 API calls 3281->3282 3283 1400038ae 3282->3283 3284 140003a84 3 API calls 3283->3284 3285 1400038b3 MessageBoxA 3284->3285 3286 140003988 7 API calls 3285->3286 3287 1400038cf 3286->3287 3287->3008 3289 14000201b 3288->3289 3289->3289 3451 140006bc0 3289->3451 3291 140002046 3454 140006668 3291->3454 3293 140002075 3294 140006668 4 API calls 3293->3294 3295 1400020a9 3294->3295 3296 140006c30 HeapFree 3295->3296 3297 1400023e1 3296->3297 3459 140006828 3297->3459 3300 140006828 2 API calls 3301 140002405 3300->3301 3301->3004 3302->3075 3304 140003b15 3303->3304 3305 140006460 RtlAllocateHeap RtlAllocateHeap 3304->3305 3305->3081 3307 140006c41 HeapFree 3306->3307 3308 140002539 3306->3308 3307->3308 3308->3092 3310 140003ddc 3309->3310 3315 140003c64 3310->3315 3322 1400064dc 3315->3322 3317 140003c87 GetCommandLineA 3318 140003c9f 3317->3318 3319 140006c60 3318->3319 3320 140003dfa strncpy 3319->3320 3321 140006c97 RtlReAllocateHeap 3319->3321 3320->3086 3321->3320 3322->3317 3324 14000637a 3323->3324 3325 14000636a 3323->3325 3327 1400063a9 3324->3327 3328 140006380 RtlReAllocateHeap 3324->3328 3335 1400065dc RtlAllocateHeap 3325->3335 3329 1400063c4 RtlAllocateHeap 3327->3329 3330 140004b94 CreateFileA 3327->3330 3328->3327 3329->3330 3330->3116 3330->3119 3332 14000642c 3331->3332 3334 140006458 3332->3334 3337 140006620 3332->3337 3334->3118 3336 1400065ff 3335->3336 3336->3330 3338 14000662c HeapFree 3337->3338 3340 140011598 3338->3340 3342 140004524 WriteFile 3341->3342 3343 140004556 3341->3343 3342->3128 3343->3128 3347 1400052fa 3344->3347 3348 140004dd2 3344->3348 3345 140005339 ReadFile 3345->3347 3347->3345 3347->3348 3349 1400053d7 3347->3349 3350 140005384 RtlReAllocateHeap 3347->3350 3375 140005490 3347->3375 3348->3138 3348->3139 3349->3348 3351 1400053fb 3349->3351 3352 14000540f ReadFile 3349->3352 3350->3347 3354 140005490 5 API calls 3351->3354 3353 140005409 3352->3353 3353->3348 3355 14000543a SetFilePointer 3353->3355 3354->3353 3355->3348 3357 140004db6 3356->3357 3364 1400050fc 3356->3364 3357->3131 3368 14000ac70 WideCharToMultiByte 3357->3368 3358 140005142 ReadFile 3358->3364 3359 1400051e4 3359->3357 3361 140005224 3359->3361 3362 14000523a ReadFile 3359->3362 3360 140005490 5 API calls 3360->3364 3365 140005490 5 API calls 3361->3365 3366 140005232 3362->3366 3363 14000518f RtlReAllocateHeap 3363->3364 3364->3357 3364->3358 3364->3359 3364->3360 3364->3363 3365->3366 3366->3357 3367 140005268 SetFilePointer 3366->3367 3367->3357 3369 140006c60 RtlReAllocateHeap 3368->3369 3370 14000acdb WideCharToMultiByte 3369->3370 3370->3143 3372 14000ae40 3371->3372 3373 140006c60 RtlReAllocateHeap 3372->3373 3374 14000ae4e 3373->3374 3374->3144 3376 1400054b9 3375->3376 3377 1400054b4 3375->3377 3378 1400054d5 3376->3378 3379 140005529 3376->3379 3380 140004510 WriteFile 3377->3380 3381 140005505 3378->3381 3382 1400054ef memcpy 3378->3382 3383 140005571 ReadFile memcpy 3379->3383 3384 140005557 ReadFile 3379->3384 3380->3376 3381->3347 3382->3381 3383->3381 3384->3381 3386 140006c60 RtlReAllocateHeap 3385->3386 3387 14000411e GetTempPathA LoadLibraryA 3386->3387 3388 140004143 GetProcAddress 3387->3388 3389 14000416e 3387->3389 3390 140004165 FreeLibrary 3388->3390 3391 140004158 GetLongPathNameA 3388->3391 3389->3172 3390->3389 3391->3390 3393 140006c60 RtlReAllocateHeap 3392->3393 3394 1400031be 3393->3394 3396 140004314 strlen strlen RtlAllocateHeap 3395->3396 3397 140004300 3395->3397 3400 140004411 3396->3400 3401 14000436f _mbscpy 3396->3401 3423 140006460 RtlAllocateHeap RtlAllocateHeap 3397->3423 3400->3178 3402 140004398 _mbscat 3401->3402 3403 14000437f 3401->3403 3405 140006354 3 API calls 3402->3405 3403->3402 3404 140004389 _mbscat 3403->3404 3404->3402 3406 1400043b2 FindFirstFileA 3405->3406 3407 1400043cb HeapFree 3406->3407 3408 1400043d0 GetLastError 3406->3408 3407->3400 3408->3407 3410 1400043e7 3408->3410 3410->3407 3411 140006420 HeapFree 3410->3411 3411->3407 3413 140004498 strncpy strlen 3412->3413 3414 140002627 3412->3414 3415 1400044eb CreateDirectoryA 3413->3415 3416 1400044cc 3413->3416 3414->3183 3415->3414 3416->3415 3418 1400042a8 3417->3418 3419 1400042cb 3418->3419 3420 1400042b3 FindClose 3418->3420 3421 1400042bc 3418->3421 3419->3178 3420->3421 3422 140006420 HeapFree 3421->3422 3422->3419 3423->3396 3425 1400055e6 SetFilePointer 3424->3425 3426 14000560a 3424->3426 3425->3426 3427 140005611 3426->3427 3428 140004510 WriteFile 3426->3428 3429 140005631 3427->3429 3432 140005694 memcpy 3427->3432 3430 14000564e 3428->3430 3429->3211 3430->3427 3431 14000565a WriteFile 3430->3431 3431->3211 3432->3429 3434 14000338e 3433->3434 3435 14000335e strlen RtlAllocateHeap 3433->3435 3434->3242 3435->3434 3436 14000337e _mbscpy 3435->3436 3436->3434 3438 14000399b EnumWindows 3437->3438 3439 1400039ff 3437->3439 3440 1400039bb GetCurrentThreadId 3438->3440 3444 1400034a4 3438->3444 3441 140003a0b GetCurrentThreadId 3439->3441 3439->3444 3445 140003a1f EnableWindow 3439->3445 3446 140003a34 SetWindowPos 3439->3446 3447 140006620 HeapFree 3439->3447 3442 1400039c9 3440->3442 3441->3439 3442->3440 3443 1400039cf SetWindowPos 3442->3443 3442->3444 3443->3442 3448 140003a84 GetForegroundWindow 3444->3448 3445->3439 3446->3439 3447->3439 3449 1400034a9 3448->3449 3450 140003a9e GetWindowThreadProcessId GetCurrentProcessId 3448->3450 3449->3252 3449->3253 3450->3449 3452 140006bd6 strlen RtlAllocateHeap 3451->3452 3453 140006c1e 3451->3453 3452->3453 3453->3291 3455 140006828 2 API calls 3454->3455 3456 14000669e RtlAllocateHeap 3455->3456 3457 1400066c2 memset 3456->3457 3458 1400066f9 3456->3458 3457->3458 3458->3293 3460 1400023f3 3459->3460 3462 14000682d 3459->3462 3460->3300 3461 14000686c HeapFree 3461->3460 3462->3461 3464 14000a6f8 3462->3464 3467 14000a712 3464->3467 3465 14000a82f 3465->3462 3466 140006c30 HeapFree 3466->3467 3467->3465 3467->3466 3468 14000a6f8 HeapFree 3467->3468 3468->3467 3498 140008a00 3499 140008a1a 3498->3499 3500 140008a59 3498->3500 3499->3500 3501 140008a2f memcpy memcpy 3499->3501 3501->3500 3604 140004a80 3605 140006354 3 API calls 3604->3605 3606 140004aa4 CreateFileA 3605->3606 3607 140004b43 3606->3607 3608 140004ade 3606->3608 3610 140004b58 3607->3610 3613 140006420 HeapFree 3607->3613 3608->3607 3609 140004ae3 3608->3609 3611 140004b06 3609->3611 3612 140004aee RtlAllocateHeap 3609->3612 3612->3611 3613->3610 3614 14000ae80 3618 14000af30 3614->3618 3617 14000aedf 3619 14000aeb9 malloc 3618->3619 3619->3617 3673 14000abc0 MultiByteToWideChar 3674 14000ac1a 3673->3674 3675 14000ac41 malloc 3674->3675 3676 14000ac22 MultiByteToWideChar 3674->3676 3677 14000ac4e 3675->3677 3676->3677 3678 140008ec2 3679 140008ecb free 3678->3679 3680 140008e51 3678->3680 3681 140011548 3679->3681 3682 140008e8b memcpy 3680->3682 3683 140008dd6 3680->3683 3682->3683 3561 140006745 3564 14000677b 3561->3564 3562 140006668 4 API calls 3563 1400067d0 3562->3563 3564->3562 3564->3564 3684 140003ac8 3685 140003ae0 3684->3685 3686 140003ae5 CloseHandle 3685->3686 3687 140003afd 3685->3687 3688 140006420 HeapFree 3686->3688 3688->3687 3689 140003bc8 GetEnvironmentVariableA 3690 140003bed 3689->3690 3691 140006c60 RtlReAllocateHeap 3690->3691 3692 140003bf8 GetEnvironmentVariableA 3691->3692 3565 140003c4c 3566 140003c55 SetEnvironmentVariableA 3565->3566 3567 140003c5d 3565->3567 3566->3567 3693 1400023cf 3694 1400023d2 3693->3694 3695 140006c30 HeapFree 3694->3695 3696 1400023e1 3695->3696 3697 140006828 2 API calls 3696->3697 3698 1400023f3 3697->3698 3699 140006828 2 API calls 3698->3699 3700 140002405 3699->3700 3620 140008a90 3622 140008ac6 3620->3622 3623 140008ab2 3620->3623 3621 1400071b0 3 API calls 3621->3622 3623->3621 3623->3622 3624 140004194 3625 1400041b6 3624->3625 3626 1400041ca 3625->3626 3627 1400041be strlen 3625->3627 3628 140006c60 RtlReAllocateHeap 3626->3628 3627->3626 3629 1400041d3 3628->3629 3630 1400041e6 3629->3630 3631 1400041da _mbscpy 3629->3631 3631->3630 3632 140007595 3635 14000759a 3632->3635 3633 1400071b0 3 API calls 3634 140007b92 3633->3634 3636 140007763 memcpy 3635->3636 3637 140007773 3635->3637 3636->3637 3637->3633 3637->3634 3502 140002519 3503 14000252a 3502->3503 3504 140006c30 HeapFree 3503->3504 3505 140002539 3504->3505 3506 140006c30 HeapFree 3505->3506 3507 14000254b 3506->3507 3568 14000325c 3569 140003277 3568->3569 3570 14000331b UnregisterClassA 3568->3570 3571 140003284 NtdllDefWindowProc_A 3569->3571 3572 14000328f 3569->3572 3577 14000329b 3569->3577 3575 140003339 3570->3575 3571->3575 3576 1400032a5 GetWindowLongPtrA GetWindowTextLengthA RtlAllocateHeap GetWindowTextA 3572->3576 3572->3577 3573 1400032f7 EnableWindow 3574 140003309 3573->3574 3578 140003988 7 API calls 3574->3578 3576->3577 3577->3573 3577->3574 3577->3575 3579 140003310 DestroyWindow 3578->3579 3579->3575 3638 14000339c 3639 1400033a5 HeapFree 3638->3639 3640 1400033b7 3638->3640 3639->3640 3701 140007bde 3702 140007bed 3701->3702 3703 140007cb3 3702->3703 3704 140007c79 memcpy 3702->3704 3705 140007b2b 3702->3705 3704->3703 3706 1400071b0 3 API calls 3705->3706 3707 140007b92 3705->3707 3706->3707 3514 140004820 3515 140006354 3 API calls 3514->3515 3516 140004857 CreateFileA 3515->3516 3518 1400048d5 3516->3518 3519 1400048a6 CreateFileA 3516->3519 3520 140004928 3518->3520 3521 1400048da 3518->3521 3519->3518 3519->3520 3523 140004903 3520->3523 3524 140006420 HeapFree 3520->3524 3522 1400048eb RtlAllocateHeap 3521->3522 3521->3523 3522->3523 3524->3523 3525 14000ad20 malloc 3526 14000ad6d 3525->3526 3529 14000addc 3525->3529 3527 14000ad72 malloc 3526->3527 3526->3529 3528 14000ad89 MultiByteToWideChar WideCharToMultiByte 3527->3528 3527->3529 3528->3529 3586 140004c60 3588 140004c88 3586->3588 3587 140004ce0 3588->3587 3589 140004510 WriteFile 3588->3589 3591 140004ca1 SetFilePointer 3588->3591 3589->3591 3591->3587 3592 140003d60 3593 140003c64 GetCommandLineA 3592->3593 3594 140003d7f 3593->3594 3595 140006c60 RtlReAllocateHeap 3594->3595 3596 140003d8d strncpy 3595->3596 3641 1400068a0 3642 1400068c5 3641->3642 3649 140006969 3641->3649 3643 140006900 3642->3643 3644 140006668 4 API calls 3642->3644 3642->3649 3645 14000690b memcpy 3643->3645 3646 140006927 3643->3646 3644->3643 3645->3646 3647 140006937 3646->3647 3648 14000696b memcpy 3646->3648 3646->3649 3647->3649 3651 14000a83c 3647->3651 3648->3649 3652 14000abb2 3651->3652 3654 14000a845 3651->3654 3652->3647 3653 14000abad memcpy 3653->3652 3655 14000ab5b memcpy 3654->3655 3656 14000ab90 3654->3656 3657 140006c30 HeapFree 3654->3657 3658 140006bc0 2 API calls 3654->3658 3659 14000a83c strlen RtlAllocateHeap HeapFree 3654->3659 3655->3654 3656->3652 3656->3653 3657->3654 3658->3654 3659->3654

          Executed Functions

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 177 1400042d4-1400042fe 178 14000431b-14000432c 177->178 179 140004300-140004314 call 140006460 177->179 181 140004332 178->181 182 14000432e-140004330 178->182 179->178 184 140004339-140004369 strlen * 2 RtlAllocateHeap 181->184 182->181 182->184 185 140004411-14000442c 184->185 186 14000436f-14000437d _mbscpy 184->186 187 140004398-1400043c9 _mbscat call 140006354 FindFirstFileA 186->187 188 14000437f-140004387 186->188 192 1400043cb-1400043ce 187->192 193 1400043d0-1400043d9 GetLastError 187->193 188->187 189 140004389-140004393 _mbscat 188->189 189->187 194 1400043e2-1400043e5 192->194 195 1400043e7-1400043eb 193->195 196 1400043db 193->196 197 1400043ff-14000440b HeapFree 194->197 198 1400043fc 195->198 199 1400043ed-1400043f7 call 140006420 195->199 196->194 197->185 198->197 199->198
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID: Heap$Allocate$_mbscatstrlen$ErrorFileFindFirstFreeLast_mbscpy
          • String ID: *.*
          • API String ID: 2072382655-438819550
          • Opcode ID: dad5505d66d68d635c09a4be0f70fc775f2be8beeb30020080957bc747345de2
          • Instruction ID: c1e98c885cd190155ab0f22ee41d5605b9e77d882581dec1dcd68e58a7b5833b
          • Opcode Fuzzy Hash: dad5505d66d68d635c09a4be0f70fc775f2be8beeb30020080957bc747345de2
          • Instruction Fuzzy Hash: F1317CF0601B8085EB1ADB13B9403E963A1BB8DBE4F484225BF290B7F6DF38C1458300

          Control-flow Graph

          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID: LibraryPath$AddressAllocateFreeHeapLoadLongNameProcTemp
          • String ID: GetLongPathNameA$Kernel32.DLL
          • API String ID: 752937943-822094646
          • Opcode ID: 6bed9b5ea6ae1960b3c571ce66d99edc56793c3ff038fdb91a17c29e9bee5cae
          • Instruction ID: b9df7a051d4c63841da7d32b83d1efc4fc2f69cc63f269a04613c2ae465835d9
          • Opcode Fuzzy Hash: 6bed9b5ea6ae1960b3c571ce66d99edc56793c3ff038fdb91a17c29e9bee5cae
          • Instruction Fuzzy Hash: 9C015E7170574086EF45DF27B8843DA6695ABCDBC0F584439BB4E4B766DE39C8818344

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 0 140001000-1400011e4 call 140003000 call 140003006 call 14000300c call 1400069a0 call 1400067ec call 140004600 call 140003e40 call 140003b04 call 1400031f4 call 140002417 call 140006a30 call 140003b4c call 140006a30 call 140003f78 call 140006a30 call 140003f84 call 140006a30 call 140006e49 call 140003f84 call 140006a30 call 140004b70 call 140004cf0 call 140004d50 call 140006a30 call 140006af0 51 140001351-140001362 call 140004cf0 0->51 52 1400011ea-1400012b1 call 140004cf0 call 140004d50 call 140006a30 call 1400033bc call 140006a30 call 140006af0 0->52 55 140001367-140001400 call 140004e50 call 140003e70 call 140004e50 call 140003e70 call 140004eb0 call 140004560 call 140006af0 51->55 77 1400012b7-14000131c call 140003060 call 1400056c0 call 140006af0 52->77 78 14000134a 52->78 89 140001422-140001813 call 140003e70 call 140006e60 call 140003e90 call 140002557 call 140006a30 call 140003fe4 call 140004960 call 140004f30 * 3 call 140005020 call 140004560 call 140003e90 call 140003fe4 PathAddBackslashA call 140003b4c call 140003c24 call 140003b4c call 140003f78 call 140003c24 call 140003b4c call 140004000 call 140003c24 call 140003b4c call 140006a30 PathQuoteSpacesA call 140006b50 * 3 call 140006a30 call 140006b50 * 2 call 140006a30 ShellExecuteEx 55->89 90 140001402-14000141d call 140002000 55->90 100 140001348-14000134f 77->100 101 14000131e-140001343 call 14000388c 77->101 82 1400018be-1400018db call 1400018e0 call 140006a00 HeapDestroy ExitProcess 78->82 164 14000181a-140001845 call 14000302c GetExitCodeProcess 89->164 90->89 100->55 101->82 167 140001847-140001855 164->167 168 140001859 164->168 167->168 169 140001857-1400018b9 call 140006b50 * 2 call 1400040d8 RemoveDirectoryA 167->169 168->164 169->82
          APIs
            • Part of subcall function 00000001400069A0: HeapCreate.KERNEL32 ref: 00000001400069AE
            • Part of subcall function 00000001400069A0: RtlAllocateHeap.NTDLL ref: 00000001400069E1
            • Part of subcall function 0000000140003E40: HeapCreate.KERNEL32 ref: 0000000140003E4E
            • Part of subcall function 00000001400031F4: memset.MSVCRT ref: 0000000140003203
            • Part of subcall function 00000001400031F4: 00007FFCB9742D00.COMCTL32 ref: 000000014000321D
            • Part of subcall function 00000001400031F4: CoInitialize.OLE32 ref: 0000000140003225
            • Part of subcall function 0000000140006A30: RtlAllocateHeap.NTDLL ref: 0000000140006A73
            • Part of subcall function 0000000140003B4C: GetModuleFileNameA.KERNEL32 ref: 0000000140003B79
            • Part of subcall function 0000000140006A30: RtlReAllocateHeap.NTDLL ref: 0000000140006AA0
            • Part of subcall function 0000000140003F78: strncpy.MSVCRT ref: 0000000140003F5A
            • Part of subcall function 0000000140003F84: GetCurrentDirectoryA.KERNEL32 ref: 0000000140003FA9
            • Part of subcall function 0000000140004B70: CreateFileA.KERNEL32 ref: 0000000140004BBF
            • Part of subcall function 0000000140004B70: RtlAllocateHeap.NTDLL ref: 0000000140004BEA
            • Part of subcall function 0000000140004CF0: SetFilePointer.KERNEL32 ref: 0000000140004D3E
            • Part of subcall function 0000000140004D50: HeapFree.KERNEL32 ref: 0000000140004E2A
            • Part of subcall function 0000000140006AF0: strcmp.MSVCRT ref: 0000000140006B30
            • Part of subcall function 00000001400033BC: GetStockObject.GDI32 ref: 000000014000341A
            • Part of subcall function 00000001400033BC: LoadIconA.USER32 ref: 0000000140003456
            • Part of subcall function 00000001400033BC: LoadCursorA.USER32 ref: 0000000140003467
            • Part of subcall function 00000001400033BC: RegisterClassExA.USER32 ref: 0000000140003490
            • Part of subcall function 00000001400033BC: IsWindowEnabled.USER32 ref: 00000001400034B8
            • Part of subcall function 00000001400033BC: EnableWindow.USER32 ref: 00000001400034CB
            • Part of subcall function 00000001400033BC: GetSystemMetrics.USER32 ref: 00000001400034EA
            • Part of subcall function 00000001400033BC: GetSystemMetrics.USER32 ref: 00000001400034FA
            • Part of subcall function 00000001400033BC: CreateWindowExA.USER32 ref: 000000014000354F
          • PathAddBackslashA.SHLWAPI ref: 00000001400015A2
            • Part of subcall function 000000014000388C: MessageBoxA.USER32 ref: 00000001400038BF
          • HeapDestroy.KERNEL32 ref: 00000001400018CF
          • ExitProcess.KERNEL32 ref: 00000001400018DB
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID: Heap$AllocateCreate$FileWindow$LoadMetricsSystem$00007B9742BackslashClassCurrentCursorDestroyDirectoryEnableEnabledExitFreeIconInitializeMessageModuleNameObjectPathPointerProcessRegisterStockmemsetstrcmpstrncpy
          • String ID: .bat$@echo off$@echo on$Enter Password$Enter the password to decrypt this application.$Error$Wrong password!$b2eprogramfilename$b2eprogramname$b2eprogrampathname$open$shift /0
          • API String ID: 1900390488-3205135111
          • Opcode ID: 5270816ad1e09a5a9841e884017363122efac0c77ac2b45045e93d34688a6f5d
          • Instruction ID: d5a4d8459b1727f3299770305887dff01a67b745a1f46ca6c093fb7620490223
          • Opcode Fuzzy Hash: 5270816ad1e09a5a9841e884017363122efac0c77ac2b45045e93d34688a6f5d
          • Instruction Fuzzy Hash: 04220BF6A1164494FB0BEBA7F8927E92662A79C7C5F444025FF0D1B3B3DE7A80958700

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 210 1400052b0-1400052f4 RtlAllocateHeap 211 140005465 210->211 212 1400052fa-140005305 210->212 214 140005468-140005482 211->214 213 140005308-14000530c 212->213 215 14000531a-140005323 213->215 216 14000530e-140005311 213->216 219 140005325-14000532e call 140005490 215->219 220 140005339-140005352 ReadFile 215->220 217 1400053d7-1400053da 216->217 218 140005317 216->218 221 1400053dc-1400053e0 217->221 222 14000544f-140005463 217->222 218->215 227 140005333-140005337 219->227 224 140005356-14000535f 220->224 225 1400053e2-1400053e5 221->225 226 1400053e7-1400053eb 221->226 222->214 224->217 228 140005361-140005364 224->228 225->222 226->222 229 1400053ed-1400053f9 226->229 227->224 230 140005372-140005382 228->230 231 140005366-14000536f 228->231 234 1400053fb-14000540d call 140005490 229->234 235 14000540f-140005422 ReadFile 229->235 232 1400053b4-1400053b7 230->232 233 140005384-1400053b1 RtlReAllocateHeap 230->233 231->230 232->217 237 1400053b9-1400053bc 232->237 233->232 236 140005428-14000542d 234->236 235->236 236->222 239 14000542f-140005433 236->239 237->213 240 1400053c2-1400053c6 237->240 242 140005435-140005438 239->242 243 14000543a-140005449 SetFilePointer 239->243 240->221 244 1400053c8-1400053cc 240->244 242->222 243->222 244->213 245 1400053d2-1400053d5 244->245 245->222
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID: File$AllocateHeapRead$Pointermemcpy
          • String ID:
          • API String ID: 391342951-0
          • Opcode ID: 8f6005a951ab13507c0ec3007d0faf149045a544bdee8496309f059288bec76f
          • Instruction ID: a8433d53bf91d8fc46634ca8bcbd734504388bedf75d5e75e5ecf2a0d826e658
          • Opcode Fuzzy Hash: 8f6005a951ab13507c0ec3007d0faf149045a544bdee8496309f059288bec76f
          • Instruction Fuzzy Hash: 6741067132568085EB62EB23F5007EF66A0F38ABD6F081511FF9A07BE5DB79C5818B00

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 246 140005490-1400054b2 247 1400054c4-1400054d3 246->247 248 1400054b4-1400054c0 call 140004510 246->248 249 1400054d5-1400054e2 247->249 250 140005529-140005555 call 14000af1a 247->250 248->247 252 1400054e4-1400054e7 249->252 253 14000551f-140005527 249->253 262 140005571-1400055a2 ReadFile memcpy 250->262 263 140005557-14000556f ReadFile 250->263 256 140005511-14000551a 252->256 257 1400054e9-1400054ed 252->257 258 1400055a4 253->258 256->258 260 140005505-14000550c 257->260 261 1400054ef-140005500 memcpy 257->261 264 1400055a7-1400055b9 258->264 260->258 261->258 262->258 263->264
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID: FileWritememcpy
          • String ID:
          • API String ID: 4212128793-0
          • Opcode ID: 8d8023ff9bff1732a90f135ac97920f7baf079c708704b19040aa2e85c9fa458
          • Instruction ID: 58b3d84b1d6faae5f2f2caa3b20ea8505ef394dafae3a337b59a9868149f2447
          • Opcode Fuzzy Hash: 8d8023ff9bff1732a90f135ac97920f7baf079c708704b19040aa2e85c9fa458
          • Instruction Fuzzy Hash: E231A2B2215A80CADB15DF66FA503AEB7A2EB49FC6F044015FB4847B69DB78C541CB40

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 265 1400055c0-1400055e4 266 1400055e6-140005607 SetFilePointer 265->266 267 14000560a-14000560f 265->267 266->267 268 140005611-140005621 267->268 269 140005646-140005658 call 140004510 267->269 271 140005623-140005625 268->271 272 14000563f-140005644 268->272 277 140005689-140005690 269->277 278 14000565a-140005688 WriteFile 269->278 274 140005637-14000563d 271->274 275 140005627-14000562a 271->275 276 14000569c-1400056b1 272->276 274->276 279 140005631-140005635 275->279 280 14000562c-14000562f 275->280 281 140005694-140005697 memcpy 277->281 279->276 280->281 281->276
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID: FilePointermemcpy
          • String ID:
          • API String ID: 1104741977-0
          • Opcode ID: fb3bddb520603c13571690ccbb6f284b750ff962e86fb30746183f6b7f99c1cf
          • Instruction ID: e810eafc85dd60b90c1d56082cde7ef78f1e04df92615828c93f2d83c3597ebf
          • Opcode Fuzzy Hash: fb3bddb520603c13571690ccbb6f284b750ff962e86fb30746183f6b7f99c1cf
          • Instruction Fuzzy Hash: 023171B620464087EB15DF2AF14036EB7A1F78EBC9F648411EF8947B69CB3AC941CB10

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 282 140004960-1400049c7 call 140006354 CreateFileA 285 1400049c9-1400049f8 CreateFileA 282->285 286 1400049fa-1400049fd 282->286 285->286 287 140004a4a-140004a4e 285->287 286->287 288 1400049ff-140004a08 286->288 291 140004a5f 287->291 292 140004a50-140004a5a call 140006420 287->292 289 140004a22 288->289 290 140004a0a-140004a20 RtlAllocateHeap 288->290 293 140004a26-140004a48 289->293 290->293 295 140004a62-140004a7c 291->295 292->291 293->295
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID: CreateFile$AllocateHeap
          • String ID:
          • API String ID: 2813278966-0
          • Opcode ID: 7cfb3a44710dd259845fdf450aa5ade60144e499f07f8567e3f6540263e407ae
          • Instruction ID: f12faca4dfe9548aeaadcc6aca3cbc7ee145a694e8fef06fa150483c253647fb
          • Opcode Fuzzy Hash: 7cfb3a44710dd259845fdf450aa5ade60144e499f07f8567e3f6540263e407ae
          • Instruction Fuzzy Hash: 43313A71604B8085E711CF12B90479AB6A5F38CBF4F044314EBB94BBEADB79C450CB04

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 296 14000448c-140004496 297 140004498-1400044ca strncpy strlen 296->297 298 1400044ff 296->298 300 1400044eb-1400044fd CreateDirectoryA 297->300 301 1400044cc-1400044d4 297->301 299 140004501-140004508 298->299 300->299 302 1400044d6-1400044d8 301->302 303 1400044de-1400044e9 301->303 302->303 304 1400044da-1400044dc 302->304 303->300 303->301 304->300 304->303
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID: CreateDirectorystrlenstrncpy
          • String ID:
          • API String ID: 2535372781-0
          • Opcode ID: bfd90d5c206f4d4b6bab77da4d271f723a0b407260c15bde4bee53c1d179b055
          • Instruction ID: 623cb7ea88a2ef4f2b57c0a9af384cefa1577016a6e760b15b729e0c940c8da6
          • Opcode Fuzzy Hash: bfd90d5c206f4d4b6bab77da4d271f723a0b407260c15bde4bee53c1d179b055
          • Instruction Fuzzy Hash: B80162F52055C086EB76DA16F0543E95791B39D784FC44121E7CD07AE6DA3DC249C705

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 305 1400031f4-14000322f memset 00007FFCB9742D00 CoInitialize
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID: 00007B9742Initializememset
          • String ID:
          • API String ID: 2526712687-0
          • Opcode ID: e7cbeafd76eda13b81a8387381c71cc695152dbd1642cea6a2d709ce1816d735
          • Instruction ID: 1c63595f239abd19c0e8682cbce60e970c2ee4bfd1c3c6e2781d85ccc80ba2b1
          • Opcode Fuzzy Hash: e7cbeafd76eda13b81a8387381c71cc695152dbd1642cea6a2d709ce1816d735
          • Instruction Fuzzy Hash: 5CE0EC7163658082D789AB12E4557DDB660F7C8744F846005F24746595CF39C559CB00

          Control-flow Graph

          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID: AllocateFileHeapModuleName
          • String ID: \\?\
          • API String ID: 2274142570-4282027825
          • Opcode ID: 63f8167060e937c968297ffa6e7834fc6b2b3110de9688d3781fad177db72df9
          • Instruction ID: 59fe90699410800cf49180e0545085182f0a131fd02209bbdf9f45e692dab8c6
          • Opcode Fuzzy Hash: 63f8167060e937c968297ffa6e7834fc6b2b3110de9688d3781fad177db72df9
          • Instruction Fuzzy Hash: D9F0C8B170464142FB06DB67F8803EA6696E7CDBC0F045125FB59877A6DF7CC8428340

          Control-flow Graph

          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID: File$Write$Pointermemcpy
          • String ID:
          • API String ID: 1234937475-0
          • Opcode ID: 0f903214641bd45d09bc4150cb91c46bf9ff6b562ad44a34d2c78863f8cc1190
          • Instruction ID: 4601f4c694b48fbcb5b23fc22dd3d7bb6826afdd47ab7c3ba001c9b209219bab
          • Opcode Fuzzy Hash: 0f903214641bd45d09bc4150cb91c46bf9ff6b562ad44a34d2c78863f8cc1190
          • Instruction Fuzzy Hash: 8E21A1B660578486E712DF26F4003AEB391E789BE1F484222BF5947BE5CF38D881C740

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 333 140004b70-140004bcc call 140006354 CreateFileA 336 140004c33-140004c37 333->336 337 140004bce-140004bd1 333->337 339 140004c48-140004c59 336->339 340 140004c39-140004c43 call 140006420 336->340 337->336 338 140004bd3-140004bdc 337->338 341 140004bf6 338->341 342 140004bde-140004bf4 RtlAllocateHeap 338->342 340->339 344 140004bfe-140004c32 341->344 342->344
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID: AllocateCreateFileHeap
          • String ID:
          • API String ID: 3125202945-0
          • Opcode ID: 73196a91eadcd4833a73155a1319dfcbb1ce6d8efdfe380e89cbe8ffe170476a
          • Instruction ID: b1b5dee882654e4700a18c4b48e5e42c72043cfab3b7752d082f2d4a5312caf1
          • Opcode Fuzzy Hash: 73196a91eadcd4833a73155a1319dfcbb1ce6d8efdfe380e89cbe8ffe170476a
          • Instruction Fuzzy Hash: 54216AB1605A8082E751CF12F94039AA3A1B38C7F4F488724EF7D4B7EADBB9C4958740

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 345 1400040d8-1400040da 347 1400040b2-1400040b5 345->347 348 1400040cf 345->348 349 1400040c2-1400040cd DeleteFileA 347->349 350 1400040b7-1400040bc SetFileAttributesA 347->350 351 1400040d1-1400040d6 348->351 349->351 350->349
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID: File$AttributesDelete
          • String ID:
          • API String ID: 2910425767-0
          • Opcode ID: c4b36442c09ebf94dd0d90e2cba2c2395c49e84ae0e8ca04bb33877837da8054
          • Instruction ID: f45b1c88ae9f88a953fbd199c1f18e9db5489403303d158b66ba053dfe76e94c
          • Opcode Fuzzy Hash: c4b36442c09ebf94dd0d90e2cba2c2395c49e84ae0e8ca04bb33877837da8054
          • Instruction Fuzzy Hash: 45E017F4B01902C2FB6ED7A368563E502426FCC7D1E188220AB471B6B3E93D449A5205

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 352 1400069a0-1400069f2 HeapCreate RtlAllocateHeap
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID: Heap$AllocateCreate
          • String ID:
          • API String ID: 2875408731-0
          • Opcode ID: a6dc4bad871210014d672cd4e9371ea6f0a33ee9a3b3430ed71bc47bae36fcf6
          • Instruction ID: ecaf37daf3e9b52cd840fad7375579c967ff8445700b47e8a15ce5fb647f4215
          • Opcode Fuzzy Hash: a6dc4bad871210014d672cd4e9371ea6f0a33ee9a3b3430ed71bc47bae36fcf6
          • Instruction Fuzzy Hash: 2BE07E34611B4481F74BDB23AC153D622A2B78D7C8F804619EA8A4B672DF7E8065C740

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 353 140006a00-140006a2b HeapFree HeapDestroy
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID: Heap$DestroyFree
          • String ID:
          • API String ID: 2061148462-0
          • Opcode ID: c5e929955ac8d022cae065ff3c4ecda4fce314964a86f25db4084cfb04facc03
          • Instruction ID: 121f7cc2064b1d145717b45861d4892f3d969119c1a93a656e428d1554a49edf
          • Opcode Fuzzy Hash: c5e929955ac8d022cae065ff3c4ecda4fce314964a86f25db4084cfb04facc03
          • Instruction Fuzzy Hash: 9DD0C534A11944C1EB0AEB27EC953D42263BBCDBC9F804512AA4E5B633CE3A85A58700
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID: CloseFreeHandleHeap
          • String ID:
          • API String ID: 1642312469-0
          • Opcode ID: 18c06eda20792f688df7fc84d7ee7a38506ab250fc35aacca174ba31533f6c7a
          • Instruction ID: fc4cd00d8714b217d1bc6255cd3d1ce7ef12140f4fdbd4bc49fca0528c389bc4
          • Opcode Fuzzy Hash: 18c06eda20792f688df7fc84d7ee7a38506ab250fc35aacca174ba31533f6c7a
          • Instruction Fuzzy Hash: E0011DB1611A4181EB16D763B8543E65392ABCCBE5F085211FF2A4B3F7DE39C0A0C344
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID: AllocateHeap
          • String ID:
          • API String ID: 1279760036-0
          • Opcode ID: 23677b92e33d4dc16f56007f0bb122038a8c8e7bfd047719fe3137b5036b4c72
          • Instruction ID: 7b8ac50a1835a0134d54c1968f67c6b7e931344d4d9828404a8e0a13f4939bdf
          • Opcode Fuzzy Hash: 23677b92e33d4dc16f56007f0bb122038a8c8e7bfd047719fe3137b5036b4c72
          • Instruction Fuzzy Hash: 1C11C975609B4086EA62CB1AF88136577A1FB8C7C8F400626FB8D87736DB3DC120CB04
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID: FileReadmemcpy
          • String ID:
          • API String ID: 1163090680-0
          • Opcode ID: 3316aea52ac140736968f7c0db9c205fb4a6b68515e93051c46b443d5adc5435
          • Instruction ID: 38d043a69fbecbe175a8c1ca14803bc333cb6030923ab2cca417d270858f9e23
          • Opcode Fuzzy Hash: 3316aea52ac140736968f7c0db9c205fb4a6b68515e93051c46b443d5adc5435
          • Instruction Fuzzy Hash: 49F049B6608A8081EB11DB52F1453AAE7A0E78DBD8F594125EF4C47BBACA3DC0848A00
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID: FileWrite
          • String ID:
          • API String ID: 3934441357-0
          • Opcode ID: 396dda29a8aedc59ecf90b8a29f5d156feeea142cc5461bc6a9192dd055af7e4
          • Instruction ID: 19d0aa3851267fdd46c077b2e8730747bb0a70cb71947072f027f8d6b0a0e10c
          • Opcode Fuzzy Hash: 396dda29a8aedc59ecf90b8a29f5d156feeea142cc5461bc6a9192dd055af7e4
          • Instruction Fuzzy Hash: A6F01CB6621A54CBCB14CF2AE00126A73B0F349B89F244415EF5847724DB36C952CF10
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID: File$PointerWrite
          • String ID:
          • API String ID: 539440098-0
          • Opcode ID: 89b36acef64b6aca8395823e02004ddd93fa1b9bfcb33fc51804c0346ccf588a
          • Instruction ID: 212c5817c76bd9cbe0ba0710156effd099fa55a9845edb5be8ba1c15ed2b6420
          • Opcode Fuzzy Hash: 89b36acef64b6aca8395823e02004ddd93fa1b9bfcb33fc51804c0346ccf588a
          • Instruction Fuzzy Hash: F0F030B161164182EF56DB27F4543DA67A1EB8CBC8F085015FB0A4B7B7DE79C494CB40
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID: EnvironmentVariable
          • String ID:
          • API String ID: 1431749950-0
          • Opcode ID: 31b8238a24a9bbea982b99c751700ad81d183de4f1830206abc2c945c0c943c5
          • Instruction ID: 9f44809619b440d249240930366b38bf01ce0c0561bf5d60b2bed53c819f96ea
          • Opcode Fuzzy Hash: 31b8238a24a9bbea982b99c751700ad81d183de4f1830206abc2c945c0c943c5
          • Instruction Fuzzy Hash: EEC08CE0B03B00C2FE0FD34BB8683C062A22F487C1EC060299A0D0B321EA3C80144700
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID: CurrentDirectory
          • String ID:
          • API String ID: 1611563598-0
          • Opcode ID: 5507860356b1d972b774933e63c23d795b4acd9bc5d07da4d0264650b46d9573
          • Instruction ID: 84006a5cf4669430e64a67b434cac7823ac459100ae4cb43fb52f5cf3273ced7
          • Opcode Fuzzy Hash: 5507860356b1d972b774933e63c23d795b4acd9bc5d07da4d0264650b46d9573
          • Instruction Fuzzy Hash: 57C09264E63402C9EB5FA3A328523F550A81F8C3D1F904630AB06821B0CA6E55EB0600
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID: CreateHeap
          • String ID:
          • API String ID: 10892065-0
          • Opcode ID: 64c0f74e4745a11b7fcca07ad7729239f18fe3ba77a1bd3ddd02d5761a2e98ba
          • Instruction ID: 401dbe61f65694f036fad51b3da286ed4fa3327a80dd5c96b531c520c0925b95
          • Opcode Fuzzy Hash: 64c0f74e4745a11b7fcca07ad7729239f18fe3ba77a1bd3ddd02d5761a2e98ba
          • Instruction Fuzzy Hash: 1DC02B38711B90C2E34E63326C033892061B38D3C0FD01114E64202720CE3E80638B00

          Non-executed Functions

          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID: Window$Message$CreateHeapSend$Freestrlen$Accelerator$LoadMetricsSystemTableTranslate_mbscpy$AllocateBringClassCursorDestroyDispatchEnableEnabledFocusForegroundIconLongObjectRegisterStock
          • String ID: BUTTON$C$EDIT$P$STATIC$n
          • API String ID: 950307240-1690119102
          • Opcode ID: 0cca8375064e7bad55e597636c368e52001238d9c9a04b45c57ff836e5a838c4
          • Instruction ID: 12fec50574c267b47f1acef99c09151e5334ac2d43cc84101bdb8cffba641136
          • Opcode Fuzzy Hash: 0cca8375064e7bad55e597636c368e52001238d9c9a04b45c57ff836e5a838c4
          • Instruction Fuzzy Hash: 58D1F675605B4086EB1ADFA2F8547D977A5F78DBC8F000129EF4A4BBAADF39C1498700
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID: Window$ClassDestroyEnableNtdllProc_Unregister
          • String ID:
          • API String ID: 1396861415-0
          • Opcode ID: ebd01d174fd4e83e2e1580bedf064f9323874d874ffa3dc38d5a3f11ac3743ee
          • Instruction ID: 7bf7e6c3668c3dcb42748ef169a39dff2db5bb3593e3417b5c3a2130aaa93c35
          • Opcode Fuzzy Hash: ebd01d174fd4e83e2e1580bedf064f9323874d874ffa3dc38d5a3f11ac3743ee
          • Instruction Fuzzy Hash: 3E21F974205A4082F75BDB67F8983E963A5A7CDBC1F548125FB0A4B7BACF7A85468300
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID:
          • String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
          • API String ID: 0-2665694366
          • Opcode ID: e46957de8d0d7f550480f01d4548edef366259036c3d56ae0839ea0d3c68293b
          • Instruction ID: 1bcb4be4b41258597c916f02f720e899b00cbc2271b5714e0f4fc2a240ebdf33
          • Opcode Fuzzy Hash: e46957de8d0d7f550480f01d4548edef366259036c3d56ae0839ea0d3c68293b
          • Instruction Fuzzy Hash: E452C8B7B006608BE769CF26E458BAC3BE5F348789F564119EF8A87790E739C445CB40
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID:
          • String ID: header crc mismatch$unknown compression method$unknown header flags set
          • API String ID: 0-1578397619
          • Opcode ID: 3af43f3dc18c60edea533527a6eae2cf31b0efeaf14438b947258dda31374eb8
          • Instruction ID: a40b4f7eeb893e8668556ea270e6571a9a9534dee9d4a1a5fa5445bfed601165
          • Opcode Fuzzy Hash: 3af43f3dc18c60edea533527a6eae2cf31b0efeaf14438b947258dda31374eb8
          • Instruction Fuzzy Hash: 32F16BF6A017508BE766CF2AE448FAD3BA5F748B88F064519EF49477A1DB78C841CB40
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID:
          • String ID: invalid distance code$invalid distance too far back$invalid literal/length code
          • API String ID: 0-3255898291
          • Opcode ID: 7c9114b61528bc5cc238620579f7b7e1a5fcee656165b77203f0716c45dcc4f3
          • Instruction ID: 4bc30c31d5369be2fea0e91bb57f01cfde68b72be588059c82c86efe6ab2f74d
          • Opcode Fuzzy Hash: 7c9114b61528bc5cc238620579f7b7e1a5fcee656165b77203f0716c45dcc4f3
          • Instruction Fuzzy Hash: 7FD118B36186D48BD31ACF2AE4543AD7BE1F39A380F158116FB9A87791D63DCA45C700
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID:
          • String ID: incorrect header check$invalid window size$unknown compression method
          • API String ID: 0-1186847913
          • Opcode ID: 369fddeedd623045c3e54c4fafef62d3b6d8744f4ee7e738b4065239b98ef2e6
          • Instruction ID: 7065db804ecbd339892b86f4213e7b548faa65891f889172d45823b247956f57
          • Opcode Fuzzy Hash: 369fddeedd623045c3e54c4fafef62d3b6d8744f4ee7e738b4065239b98ef2e6
          • Instruction Fuzzy Hash: 8791B1F2B006108BF766CF2AE444BAD3BA1F348798F558119EF49837A4DB39C841CB41
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID:
          • String ID:
          • API String ID: 0-3916222277
          • Opcode ID: c9376aada4035d1c729739b713a0d204fb234905f79b81ba5d9cded43b7702df
          • Instruction ID: 46121d5d064ece60378a54124184adae534b32e78be6cb28e5c8b299c28f366b
          • Opcode Fuzzy Hash: c9376aada4035d1c729739b713a0d204fb234905f79b81ba5d9cded43b7702df
          • Instruction Fuzzy Hash: 8671FEB23341B48BE7758B1EA414BAA7790F36A74DFD56105EBC647B41CA3DB900CB50
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID:
          • String ID: invalid block type
          • API String ID: 0-1830746294
          • Opcode ID: b8c22f6865fc81d5a946588033371811782f070ef05fbe15ab16b4c534e215e0
          • Instruction ID: 32191194aa00f26ddf8c5f16928a4772891d642f1e76c853c8e0ae2284350c4b
          • Opcode Fuzzy Hash: b8c22f6865fc81d5a946588033371811782f070ef05fbe15ab16b4c534e215e0
          • Instruction Fuzzy Hash: A461B6F7A00A148BE725CF26E4487AD3BA5F389798F164115EF49837E4DB78C840CB81
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: ef5724f582bfe39a7dd0e0c0f617d0b3705198104ef2b12f5b62fe71b1989c9a
          • Instruction ID: 8bbc6c47dee08027fa25b27d9dda089a96deba9bce490c678dd9d11e12d53def
          • Opcode Fuzzy Hash: ef5724f582bfe39a7dd0e0c0f617d0b3705198104ef2b12f5b62fe71b1989c9a
          • Instruction Fuzzy Hash: 7122B4B7B784504BD71CCB19E892FA97792F394308709A12CEA17D3F44DA3DEA06CA00
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: df3c0f16e517c9844db4100ef247279ccafa913ad56c8f9a661e96aeb3eae09c
          • Instruction ID: 8d7d85578ff8d30840b5dd33f7109b10072fd9c5d8802ae9261e17604037b4f9
          • Opcode Fuzzy Hash: df3c0f16e517c9844db4100ef247279ccafa913ad56c8f9a661e96aeb3eae09c
          • Instruction Fuzzy Hash: BB811B723341B48BE7668A1EA810BEA7690F3697CEFC56104FBC647B45C93DFA008B50
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: ecf604365bc74a7700bf7bef40dad3a0db32401866a6d4588734332ba01f77bc
          • Instruction ID: a2a79fe0975fe07a1a6f98e5fe61af50c4722b07db36e550e03a0058a0ad4f09
          • Opcode Fuzzy Hash: ecf604365bc74a7700bf7bef40dad3a0db32401866a6d4588734332ba01f77bc
          • Instruction Fuzzy Hash: 9341B7B776864046FBAACF1AF010BEE2790E7997C4F94D114DB8697AF4CA7AD405CB00
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 78b3906d9e636abe6505bff2dc56b0ce89a32b411432f25129cd3c57cbb4a7c4
          • Instruction ID: 7ceb01bf0c6858d75b091e3c0b9fa1911bdffd09b7d4f35d2f0d72c2bac5529e
          • Opcode Fuzzy Hash: 78b3906d9e636abe6505bff2dc56b0ce89a32b411432f25129cd3c57cbb4a7c4
          • Instruction Fuzzy Hash: 8F21986750D7C45AEB9B8A350C693D82FA1A7DBF40F8E809793948B2D3D42F4809D726
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 94ffcd7b2aa7afea8f8b4d5e1dacadd5416483420bc01bcc2917f4a22e4be5db
          • Instruction ID: 7d8c7ecb94f716e15ec340db65f75d207dbc83078b8a2134052a74db768b54fc
          • Opcode Fuzzy Hash: 94ffcd7b2aa7afea8f8b4d5e1dacadd5416483420bc01bcc2917f4a22e4be5db
          • Instruction Fuzzy Hash:
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID: Window$Thread$Current$AllocateEnableEnabledForegroundHeapLongProcessVisible
          • String ID:
          • API String ID: 684997728-0
          • Opcode ID: 06e556fb84109f7703ba8c4f150bcd6c05177cf0532b0547e81cf47e16f51b58
          • Instruction ID: add6a7263ba92d2c82b7f60adcf28b8975a4622892fe3dbafc5901b8b8f3b33e
          • Opcode Fuzzy Hash: 06e556fb84109f7703ba8c4f150bcd6c05177cf0532b0547e81cf47e16f51b58
          • Instruction Fuzzy Hash: 9C115E31618A4086E74A9B77F9483E822A6AFCDBC5F048114EA064B7F6DF7AC445C300
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID: File$Create$AllocateHeapPointer
          • String ID:
          • API String ID: 1439325152-0
          • Opcode ID: 709c003b180588d05024e108b724dbd4194e9ea70836e421e272c211d5f2b526
          • Instruction ID: 6009b2be3adcbdfa25756a02a2cbead5770180272274b39c1e5fcb34f35404e6
          • Opcode Fuzzy Hash: 709c003b180588d05024e108b724dbd4194e9ea70836e421e272c211d5f2b526
          • Instruction Fuzzy Hash: 7251D1B1618A4082E762CB13B900BDA66D1B38DBF4F140714EFAA07BE6DB7AC4558B44
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID: Window$CurrentThread$EnableEnumWindows
          • String ID:
          • API String ID: 2527101397-0
          • Opcode ID: b4914a9be6336c46116b226ebbc2b0b52e26520c874d8051ba582cc84ffc7e42
          • Instruction ID: 9b71f8ee67f65033ac0d0dc0d51b083ccbcc06bf7857cf9a4d24eb6297d1c7b4
          • Opcode Fuzzy Hash: b4914a9be6336c46116b226ebbc2b0b52e26520c874d8051ba582cc84ffc7e42
          • Instruction Fuzzy Hash: 4D317CB2604A4086FB27CF22F5447D973A5F789BE9F080215EB990BAF9DB78C544C700
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID: File$AllocateHeapRead$Pointer
          • String ID:
          • API String ID: 3468988141-0
          • Opcode ID: 9286f118dbf639c165ce9cd9c840d6103be51a2853bf658482dd26fd6fb91e94
          • Instruction ID: 5d9fa424f8e9c360cdcedbf9c3b9fa765546122e486ef5834de2209a52ec65fd
          • Opcode Fuzzy Hash: 9286f118dbf639c165ce9cd9c840d6103be51a2853bf658482dd26fd6fb91e94
          • Instruction Fuzzy Hash: B851B07221564082EBA2EB17F4047EBA2A1F79ABC5F445122FF9A47BA8DF79C541C700
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.1151449712.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
          • Associated: 00000000.00000002.1151438436.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151449712.0000000140013000.00000040.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151477173.0000000140014000.00000080.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.1151491138.0000000140016000.00000004.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_140000000_1213af0.jbxd
          Yara matches
          Similarity
          • API ID: ByteCharMultiWidemalloc
          • String ID:
          • API String ID: 2735977093-0
          • Opcode ID: e834e6c37fca6f31dd2b295d3aab8ad4f6e75fe9bb5d7f8e5dbe007a946fd7cc
          • Instruction ID: bdd411829624a52d167fa3a130f5347d384e1070f5ab9c18ea42ffc64bdf327f
          • Opcode Fuzzy Hash: e834e6c37fca6f31dd2b295d3aab8ad4f6e75fe9bb5d7f8e5dbe007a946fd7cc
          • Instruction Fuzzy Hash: 4B216A71205B8185EB15DB66B4503AAB7A4F789BE4F480229FB9A07BA9DF38C510C704